Outsourced Internal Audit requirements for Aerospace Suppliers

[J.Enger]

Due to the struggles with performing our own Internal Audit, we are outsourcing it to accredited companies, and I was wondering what kind of verbiage I should add to our current Internal Audit Procedure.

What I have so far is this:

1.2 This procedure and associated documents only apply when Mac Machine performs Internal Audits by competent Mac Machine personnel. Should Top Management decide to use an accredited Outside Service Provider to perform the audit, this procedure will not apply.
1.2.1 The audit shall be a full scope audit to ensure Mac Machine is meeting the requirements set forth in SAE AS9100 Rev. D, in accordance with the requirements of AS9101:2016
1.2.2 The OSP shall supply credentials for the auditor assigned and these will be retained with the documentation from the audit.

One of my questions is in 1.2.1 "in accordance with the requirements of AS9101:2016". Is this the right requirement, or should it be to AS9104, or not needed at all?

Thanks in advance

 

[Sidney Vianna]

AS9101, currently under Rev. F is meant for the audits performed by the CB auditors, operating under the IAQG ICOP Scheme and it is not meant for internal audits. Some of the components of the AS9101 document could be used in the internal audit program, but others would be counterproductive.

 

[J.Enger]

So best thinking it to just delete that section and leave the rest?

1.2.1 The audit shall be a full scope audit to ensure Mac Machine is meeting the requirements set forth in SAE AS9100 Rev. D.

 

[Jim Wynne]

So best thinking it to just delete that section and leave the rest?

1.2.1 The audit shall be a full scope audit to ensure Mac Machine is meeting the requirements set forth in SAE AS9100 Rev. D.

What is a "full scope audit"?

 

[Guest]

Due to the struggles with performing our own Internal Audit, we are outsourcing it to accredited companies,

Accredited? For what?

Who does the audit and their (contractual: W2 or 1099 in the USA) relationship to your organization is of no importance to the conduct of audits. What is important is a) competency and b) results. You need nothing in any procedure any different than if YOU were doing the audit.

 

[Sidney Vianna]

You need nothing in any procedure any different than if YOU were doing the audit.

They certainly have to comply with the applicable requirements of AS9100D 8.4 for the outsourced internal audit service. While I agree that competence is critical, any organization outsourcing internal audits for the first time, would be hard pressed to know if the individual is competent or not, beforehand. At most they will be looking for credentials/qualifications. An experienced aerospace auditor who is very competent to audit aerospace suppliers involved in software development might be lost auditing a machine shop, because s/he might not have the required knowledge in that context.

To the OP, I suggest you peruse similar threads (scroll down the page). Many a discussions have been had on this topic before.

Good luck.

 

[J.Enger]

What is a "full scope audit"?

For us, a Full Scope audit means everyhting in AS9100, except for any exclusions (our case we exclude 8.3)

 

[J.Enger]

Accredited? For what?

Who does the audit and their (contractual: W2 or 1099 in the USA) relationship to your organization is of no importance to the conduct of audits. What is important is a) competency and b) results. You need nothing in any procedure any different than if YOU were doing the audit.

Again, it may just be wrong verbiage, but to me, accredited means the company meets the our requirements as detailed in 8.4 (has a registered QMS, etc) and the auditors have some form of record to show competency ( i.e. resume of work, any certificates of training, etc).

 

[Guest]

IMHO, using the "outsourced processes" to engage an internal auditor is futile. Expecting a perfectly good, experienced auditor - someone who has retired from auditing aerospace suppliers, or something equally applicable - to have a registered QMS is not going to happen. Certificates of training don't make good auditors. Resumes are often fictitious or not a good representation of the person's actual abilities. Auditors need to posses good soft skills, plausibility, integrity, and a bunch of other things which only a referral might reveal. I'd ask your local ASQ if they know of anyone.

 

[Sidney Vianna]

IMHO, using the "outsourced processes" to engage an internal auditor is futile. snip..... and a bunch of other things which only a referral might reveal. I'd ask your local ASQ if they know of anyone.

Nothing wrong with a referral, but 8.4 STILL applies to an outsourced internal audit provider.