ISO to AS9100 nightmare

[Kronos147]

To the OP, it may help to create a compliance matrix, where each clause is listed, and what is the method of conformance, what documents, who is the process owner. That can be a great help to indentify gaps.

You may also use this document to help plan an internal audit, as objective evidence as to why you audited certain processes, and in what order.

9.2.2 The organization shall:
"plan, establish, implement, and maintain an audit program(s)... ...which shall take into consideration the importance of the processes concerned, changes affecting the organization, and the results of previous audits;"

 

[Golfman25]

We moved the stage 2 audit to late February.

I have a much better understanding of the requirements now, but still scrambling to pull everything together.

We are using color coded travelers and staff are generally learning the new procedures, which is good

Since I am simultaneously building the procedures, auditing my own work, and trying to train people, (and having to deal with confused or confrontational staff members) its proving to be pretty challenging. Especially since i am finding many nonconformities. I am in a constant dilemma. I could stop everything and simply do an internal audit, but due to time pressure and since i am the only one able to interpret the standard, any findings just come back to me, so it seems my best action is to just make decisions on my own.
The most major issue I noticed, is that information seems to ripple and lag through the organization, and im afraid i do not have the power to change that on my own

Management means well, and i am treated well, but are super limited in resources and are not able to be fully engaged in the qms development

Some days I wonder if i am biting off more than i can chew,

Having a good consultant would be incredibly useful, but due to budget and time we are most likely gonna have to ride this one out.

P.S @Randy it looks like he's worked with these standards:
QS 9000, M1003, ISO 13488, 14001, 9001, 13485, 16949, 18000, 22000

Sorry, but this sounds like another "top down" exercise. Why are you "building procedures?" At worst, you should simply be tweaking what you already do in the event there is a compliance issue. Why aren't the people you're training involved in the development of the procedure?

Here's my point. There are two way to do this:
A) "Fill out this form as it's required by the standard." You "train" people, who could care less and now think the standard is stupid because it's just additional paperwork for me. Things are constantly incomplete and it takes months if not years to correct the habits.

or

B) "Hey guys, the standard requires that we keep records of XYZ. What is the best way to do this without causing too much disruption for you. No idea is a bad idea." They tell you how to do it, you document it, and they are essentially already trained because it's their idea.

 

[music]

To the OP, it may help to create a compliance matrix, where each clause is listed, and what is the method of conformance, what documents, who is the process owner. That can be a great help to indentify gaps.

You may also use this document to help plan an internal audit, as objective evidence as to why you audited certain processes, and in what order.

9.2.2 The organization shall:
"plan, establish, implement, and maintain an audit program(s)... ...which shall take into consideration the importance of the processes concerned, changes affecting the organization, and the results of previous audits;"

I am using a planner board for this, and have already mapped out all the clauses in the standard
The same planner is used as the internal audit document

Things that I find difficult to audit:
4.4.1 - QMS shall address customer and applicable statutory and regulatory qms requirements - I'm not really sure if there are any 'applicable qms stat/reg requirements', mgmt doesn't have any answers for me either. We have regulatory requirements imposed by customers, but regulatory QMS requirements?

4.4.2 - establish and maintain a description of processes needed for the qms and their application throughout the organization;
Does a basic flowchart work? It isn't very clear what is meant by 'description'

 

[music]

Sorry, but this sounds like another "top down" exercise. Why are you "building procedures?" At worst, you should simply be tweaking what you already do in the event there is a compliance issue. Why aren't the people you're training involved in the development of the procedure?

Here's my point. There are two way to do this:
A) "Fill out this form as it's required by the standard." You "train" people, who could care less and now think the standard is stupid because it's just additional paperwork for me. Things are constantly incomplete and it takes months if not years to correct the habits.

or

B) "Hey guys, the standard requires that we keep records of XYZ. What is the best way to do this without causing too much disruption for you. No idea is a bad idea." They tell you how to do it, you document it, and they are essentially already trained because it's their idea.

Agreed. That's how I have been approaching it

 

[music]

From the posts, it seems that you were put in a position to “attain a certificate”, not develop a quality system. Something we have seen endless times in this forum; and those are two totally different things. As long as everyone know the script and the expected outcome, it will be a happy ending.

They understand the concept of a functioning quality management system, but resources are so limited that there just isn't any time to sit down and discuss our goals. Status quo is taking precedence right now, so I have to make do with what i have

 

[Kronos147]

I am using a planner board for this, and have already mapped out all the clauses in the standard
The same planner is used as the internal audit document

Good idea. I am not thrilled about the search function on Planner, but it should work.

Things that I find difficult to audit:
4.4.1 - QMS shall address customer and applicable statutory and regulatory qms requirements - I'm not really sure if there are any 'applicable qms stat/reg requirements', mgmt doesn't have any answers for me either. We have regulatory requirements imposed by customers, but regulatory QMS requirements?

If you are making coffee makers for airplanes, maybe the International Association Of Bean Roasters has some kind of requirement to include a warning label on the coffee maker that says "this liquid is hot." I.D. those things and have a plan.

4.4.2 - establish and maintain a description of processes needed for the qms and their application throughout the organization;
Does a basic flowchart work? It isn't very clear what is meant by 'description'

Take this with a grain of salt:
One you have defined your processes, these are the things that at minimum will require your auditor to do the 'Turtle'. I am a strong advocate of defining maybe a half-dozen processes, and defining sub processes, where required.

Example: Company A has Purchasing, Supplier Control, Supplier Assessment, Receiving, Receiving inspection....
Company B has "Supply Chain", and the control, assessment, purchasing, receiving, etc.. is under the Supply Chain umbrella.

As to a basic flowchart, sure! Two caveats - include a method to define the process owner, so it is clear, and get it in section 4 of your manual, so that "Top Management" has signed off.

Cheers

 

[music]

Good idea. I am not thrilled about the search function on Planner, but it should work.



If you are making coffee makers for airplanes, maybe the International Association Of Bean Roasters has some kind of requirement to include a warning label on the coffee maker that says "this liquid is hot." I.D. those things and have a plan.


Take this with a grain of salt:
One you have defined your processes, these are the things that at minimum will require your auditor to do the 'Turtle'. I am a strong advocate of defining maybe a half-dozen processes, and defining sub processes, where required.

Example: Company A has Purchasing, Supplier Control, Supplier Assessment, Receiving, Receiving inspection....
Company B has "Supply Chain", and the control, assessment, purchasing, receiving, etc.. is under the Supply Chain umbrella.

As to a basic flowchart, sure! Two caveats - include a method to define the process owner, so it is clear, and get it in section 4 of your manual, so that "Top Management" has signed off.

Cheers

From what I know, we are not 'regulated' by any authority that imposes QMS requirements,
We are a job shop, so ultimately any requirements that come to us are specific to the customer contracts relating to the job, and are always changing based on the work we are currently doing
The wording trips me up at the 'stat/reg qms requirements'. How are those different than customer regulatory requirements such as RoHS or REACH or something similar? From what I understand, those don't impose any requirements relating to the QMS.



For the second answer, our flow chart has the name of the process, the inputs and outputs, the connection to other processes, and the owners. But owners are not defined by name, rather by position. So Production would have the process owner "Production Manager". I'm assuming this is enough to meet the requirement, since there isn't anything mandating that the process owners be named.

Is this an adequate interpretation?

Your help is much appreciated

 

[Sidney Vianna]

We have regulatory requirements imposed by customers, but regulatory QMS requirements?

ITAR compliance in the context of an organization in the Aviation, Space and Defense supply chain is a commonly mentioned legal requirement which might affect you.

Not necessarily an additional regulation, but in a sector where counterfeit material and components are such a serious risk, failure to properly manage the origin and traceability of metal parts could, in an extreme case, bring the feds knocking on your door.

 

[Kronos147]

The wording trips me up at the 'stat/reg qms requirements'. How are those different than customer regulatory requirements such as RoHS or REACH or something similar? From what I understand, those don't impose any requirements relating to the QMS.

Let's start with the concept of a management system. This implies that all parts are working together for a common goal. Interpreting the requirements on an organization is what the management system needs to do. So, the need to integrated statutory and regulatory requirements into the system is what the is needed.

While the statutory and regulatory requirements may not impose requirements to the "QMS", they must be met by the organization.

If a new management team was put in place in your organization, would the document information (Quality Manual) ensure this new team would be aware of all of the requirements that impact the organization?

In the context of the organization section of the quality manual, a brief mention that the organization complies with all RoHs and REACH requirements would be a good addition.

For the second answer, our flow chart has the name of the process, the inputs and outputs, the connection to other processes, and the owners. But owners are not defined by name, rather by position. So Production would have the process owner "Production Manager". I'm assuming this is enough to meet the requirement, since there isn't anything mandating that the process owners be named.

Is this an adequate interpretation?

Yes, this sounds good. I applaud the decision to use titles in the flow chart, as well.

There are companies that have a process called "Production", and the process owner is the "Manufacturing Manager". IMHO, that is where it really helps to define the process owner.

As a contrast, if the process owner has the title "Production Manager", it cannot be assumed that is the process owner, as it may be the 'Director of Finance" that is actually the process owner. So it is good when this is all documented and has Top Management consensus.

 

[Golfman25]

From what I know, we are not 'regulated' by any authority that imposes QMS requirements,
We are a job shop, so ultimately any requirements that come to us are specific to the customer contracts relating to the job, and are always changing based on the work we are currently doing
The wording trips me up at the 'stat/reg qms requirements'. How are those different than customer regulatory requirements such as RoHS or REACH or something similar? From what I understand, those don't impose any requirements relating to the QMS.



For the second answer, our flow chart has the name of the process, the inputs and outputs, the connection to other processes, and the owners. But owners are not defined by name, rather by position. So Production would have the process owner "Production Manager". I'm assuming this is enough to meet the requirement, since there isn't anything mandating that the process owners be named.

Is this an adequate interpretation?

Your help is much appreciated

Do not "name" the person, unless you want to change things every time someone leaves the job. Title is more than sufficient.