Revision C Audits

A design-responsible organization that already has robust systems for risk, project, and configuration management will most likely not be as affected by the changes as another organization where such systems are not yet in place.

Ever since the 2009 release of Revision C to AS9100, aerospace component and original equipment manufacturers have had to wrestle with their decisions regarding when they should upgrade their certified management systems to the new revision.

As is often the case, the passage of time has made the answers clearer. As of July 1, 2011, all audits for the Quality Management System Requirements for the design and/or manufacture of aerospace products must be to the particulars of AS9100C, and by July 1, 2012, any AS9100 certificates not registered to Revision C will be cancelled.

This article addresses the significant changes made by Revision C; what organizations must do to comply; and how an organization can get through the audit process smoothly and cost-effectively.
 

Most Significant Changes
The areas specifically addressed by Revision C include continuous improvement, internal audits, customer satisfaction, customer focus, quality policy, quality objectives, management review, and product realization.

The most obvious changes incorporate process- and risk-management features. With Revision C, the illustration of continuous improvement and the measurement of process effectiveness to meet customer requirements are significantly more important than before. Likewise, manufacturers are now required to establish, implement, and maintain a process for managing risk to the achievement of applicable requirements.

Additionally, changes allow organizations, regardless of their size or product/service offerings, to more readily adopt and adapt the standard to better suit their needs and their applicable customer/statutory/regulatory requirements. In addition, the strict focus on aerospace broadens to include organizations that produce products for the aviation, space, and defense industry.

Another significant change, especially from an auditing perspective, involves the removal of scoring. Under the previous standard, auditors were expected to score based on the outcome of the audit, and the number and nature of nonconformities. While this seemed a reasonable idea in theory, in practice what it did was to put significant pressure on both the auditors and the auditee. In addition, differences in auditor styles resulted in inconsistencies in scoring, as well as developing a perception of some auditors being soft graders, or specific audit findings placed in categories that were not as score-impactful as categories that are more appropriate. The new revision's elimination of the somewhat subjective scoring feature will make the overall auditing field more level, reducing the potential impact of individual bias.

A very important difference between Revisions B and C is the new focus on process effectiveness, and the tools used to measure and analyze it. A new requirement of Revision C calls for Certification Bodies to use a Process Effectiveness Assessment Report (PEAR) to determine the overall effectiveness of each identified core process. With PEARs, each core process must have specific metrics established for the process, or those processes as identified within the requirement of section 7.0, so that measuring effectiveness can be done readily and consistently. Further, all organizations currently or expecting to be registered are required to have the ability to track metrics to on-time delivery (OTD), performance, and quality objectives. Unlike the previous standard, in order to earn its initial registration, Revision C requires an organization to have a full 12 months of OTD- and quality-supporting data before achieving registration to AS9100, AS9110, or AS9120 standards.

Impact on Organizations
A design-responsible organization that already has robust systems for risk, project, and configuration management, will most likely not be as affected by the changes as an organization where such systems are not yet in place. Similarly, larger organizations that already have established metrics to monitor and analyze their various processes will probably not need to implement additional metrics to measure and control each of the core products, as the existing business metrics will most likely suffice.

Some smaller organizations, where personnel and resources are already under stress, may be burdened by the need to add processes to address project management requirements and/or the establishment of OTD and quality metrics. Further, many smaller organizations may struggle with the risk management requirement, as they will need to determine if they should be doing a Failure Modes Effects Analysis (FMEA) or a Process FMEA. Frequently, many smaller organizations do not even know how to start implementing such tools.

Further, the full-year worth of data requirement could prove to be problematic for those organizations that may not yet have the 12 months of quality management systems performance data.

To determine the direct impact Revision C will have on a particular organization, an effective gap analysis would focus on assessing the major changes made, and evaluating the organization's response. For example, one could assess implementation and measurement of risk- and process-management, and then see if expectations are being met. Where the goal or metrics fail, formal actions are required.

Completion of a complete internal audit of the organization prior to the certified body's (CB) external audit helps ensure full compliance with the new standard, after which a management review would be necessary. To organize the internal audit, the company first should ensure that all of the requirements as stated in the 9100 standard are implemented and in an effective manner. Next, it should assure that appropriate documentation exists for its quality manual, supporting work instructions, standard operating procedures, and the like, and assure that the documented instructions are being followed. It will work best if the organization's internal auditors are qualified and thorough in conducting the audit, and that any found deficiencies get corrections via a robust corrective/preventive system.

Some organizations may choose to audit using checklists developed based upon the organization's internally documented systems, while others may audit to the specific AS91XX standard that is being implemented. Alternatively, since CB must use the new AS9101D Objective Evidence Report, an organization would be wise to purchase this document and audit to it.

External Auditing Firms
In seeking a certified body to perform its external audit and provide Revision C certification, a manufacturer should look for a firm that has customer-service focus. Achievement of the best results are when the CB is involved with the organization from the very beginning of the process, and throughout each of the three-year audit cycles. The manufacturer will be best served by a CB staffed by knowledgeable and competent employees and management, those able to respond to the manufacturer when questions or problems arise. Very few organizations can thrive when their customers are not able to reach them or get responses in a timely basis. Unfortunately, many CBs have not seemed to embrace this concept. It is important for a manufacturer to look for a provider that has the resources and capabilities to help the organization achieve certification, as compared to one that will only pass or fail the manufacturer.

In addition to certifying to 91XX standards, it can be very helpful, and cost effective, to seek a CB that can also certify to other standards, such as environmental management systems, safety programs, and the like.
 

Five Steps to Take
To make sure its Revision C certification goes smoothly and adds value, compared to one that consumes resources and adds undue cost, here are five steps a manufacturer can take.

The manufacturer should request quotations from several qualified registrars, and check their references, including the Online Aerospace Supplier Information System (OASIS) database.

Travel costs can add up very quickly, especially for smaller organizations and/or organizations with multiple sites. It is important for the manufacturer to identify the strategic locations of a CB's qualified auditors, or even negotiate the travel costs into the contract, so no surprises occur after the audit is completed.

Some organizations, such as small or minority-owned business, are eligible for state subsidies that may reduce or even eliminate an organization's costs, so it would behoove the manufacturer to look for these opportunities.

Ensure that an extremely effective and thorough gap analysis is or has been conducted so that ample resources – both human and capital – can be planned and assigned accordingly.

If working with an outside consultant to assist in the process, as with the CB, shop around and ensure the consultant has a very good history and reputation.

Finally, the best return on the Revision C investment will be when its requirements become part of the organization's normal everyday processes and culture. Implementation of the standard should not be seen as something outside of the organization and a burden on its employees; rather, it should become engrained in the everyday activities throughout the organization, with management leading by example.
 

TUV Rheinland of North America Inc., Systems Business Stream, Certification of Management Systems
Boxborough, MA
tuv.com/en/usa/home.jsp