Registration Management Committee (RMC)

Effective Auditing of
Purchasing & Subtier Supplier Control
Processes

Boston, MA
July 21 - 22, 2011

Tim Lee, BCA Supplier Quality Manager & IAQG OPMT Chairman
Sidney Vianna, DNV Business Assurance & AAQG Secretary

Company Confidential

Auditor Workshop
Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Voice of the Customer

George Buswell, Director
BCA Supplier Quality
Regional Operations
Why the added focus on Subtier Supplier Control?
Observations
Expectations

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Why the added focus on Subtier Supplier

Control?
Boeings business model
High Level Systems Integrator
Deeper Supply Chain
More complicated incoming product
Higher percentage of defects attributable to
subtier suppliers

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Observations What I have seen

Failure to understand contract requirements

Ineffective incoming inspections
Poor execution of FAI
Unwarranted delegation of inspection authority

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Expectations CB Oversight
Be above reproach in complying with requirements
Focus on effectiveness
- Take it personally
- Go the extra mile

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

AS9100 Rev C Criteria

4.2.4 Control of Records - The documented procedure shall define the method for controlling
records that are created by and/or retained by suppliers.

7.1.2 Risk Management - The organization shall establish, implement and maintain a process
for managing risk to the achievement of applicable requirements, that includes as
appropriate to the organization and the product

7.1.4 Control of Work Transfers - The organization shall establish, implement and maintain a
process to plan and control the temporary or permanent transfer of work (e.g., from one
organization facility to another, from the organization to a supplier, from one supplier to
another supplier) and to verify the conformity of the work to requirements.

7.4.1 Purchasing Process - The organization shall ensure that purchased product conforms to
specified purchase requirements.
The organization shall be responsible for the conformity of all products purchased from
suppliers, including product from sources defined by the customer.
The organization shall evaluate and select suppliers based on their ability to supply product in
accordance with the organization's requirements. Criteria for selection, evaluation and reevaluation shall be established.

7.4.2 Purchasing Information - Purchasing information shall describe the product to be

purchased, including, where appropriate

7.4.3 Verification of Purchased Product - The organization shall establish and implement the
inspection or other activities necessary for ensuring that purchased product meets specified
purchase requirements.
Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

AS9101 Rev D Audit Requirements

0.2 Auditing Approach - When evaluating an organizations quality management system,

there are basic questions that should be asked of every process, for example:
Is the process identified and appropriately defined?
Are responsibilities assigned?
Are the processes implemented and maintained?
Is the process effective in achieving the desired results?

4.2.2.8 Special Processes - b) Monitoring, Measurement, and Control of Special Processes For outsourced special processes, the audit team shall verify that the organizations supplier
control process addresses these items accordingly. In addition, the audit team shall review
the use of customer-designated sources, as required.

4.2.2.5 Identifying and Recording of Audit Findings - The audit team shall record detailed
objective evidence (e.g., reviewed procedures, shop orders, training records, products,
verification records). The objective evidence shall be recorded on a standardized form [i.e.,
OER (see Appendix A)] or on the CBs own documentation. In this case, the CB document
shall meet the intent of the OER.
The results of effectiveness shall be recorded on the PEAR (see Appendix C) for each audited
product realization process.

Appendix A - Objective Evidence Record (OER)

7.4 Purchasing - Questions 219 through 250

Additional Information

7.4 Rev C Change

Rationale

Boston, MA
July 21-22, 2011

9100
Support

Registration Management Committee (RMC)

Focus on the Process

If you audit subtier supplier control processes independently there is a risk

of overlooking the interrelationships. Audit results may not add value.
Examples of Control of Purchasing Processes

Records
Management

Customer

Supplier Quality
Surveillance &
Performance

Supplier Selection
Purchasing

Purchased Product
Inspection

Project Planning
Risk Analysis

Boston, MA
July 21-22, 2011

Supplier

Registration Management Committee (RMC)

Focus on the Process

If you audit subtier supplier control processes independently there is a risk

of overlooking the interrelationships. Audit results may not add value.
Examples of Control of Purchasing Processes

Records
Management

Customer

Supplier Quality
Surveillance &
Performance

Supplier Selection
Purchasing

Purchased Product
Inspection

Project Planning
Risk Analysis

Boston, MA
July 21-22, 2011

Supplier

Project Planning
Risk Analysis

Registration Management Committee (RMC)

Focus on the Process

Focus on auditing using a Process approach and the hand offs
Examples of Interrelationships - Control of Purchasing Processes

Records
Management

Purchased Product
Inspection

Supplier Quality
Supplier
Boston, MA
July 21-22, 2011

Supplier Selection
Purchasing

Project Planning
Risk Analysis

Registration Management Committee (RMC)

Focus on the Process

If you audit subtier supplier control processes independently there is a risk

of overlooking the interrelationships. Audit results may not add value.
Examples of Control of Purchasing Processes
Buy Decisions

Project Planning
Risk Analysis

Product Info

Supplier Selection
Purchasing

Results

Purchased Product
Inspection

Supplier Quality
Surveillance &
Performance

Audit Trail

Customer

Supplier

All Processes interact and process

performance is dependent on
effective handoffs
Boston, MA
July 21-22, 2011

Records
Management

Registration Management Committee (RMC)

Planning for an Effective subtier

supplier control audit
Sidney Vianna, DNV Business Assurance &
AAQG Secretary
Audit Planning: Provide guidance on planning an
effective subtier supplier control audit
Audit Conduct: Establish audit trails, Know what to
look for, focus on customer unique requirements,
use lessons learned

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Planning for an Effective subtier

supplier control audit
Audit Planning

An effective audit requires upfront planning

prior to conduct.

You must have an understanding of the clients

processes

How much product is purchased?

Raw material, COTS or complete end item

Inspection and Verification methods

How does supplier performance drive decisions

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Audit Planning

Do not forget the value stream approach to

effective auditing:
INPUT
Customer who
has a need

OUTPUT
Customer who
has a need met

Step

Step

Step

Step

Input

Output

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Planning for an Effective Audit

Focus on the parts of the purchasing
processes that relate to subtier control
For example, OASIS feedback loops,
customer requirements, key characteristics
management, critical items, outsourced
processes, work transfers, notification of
changes, reporting of nonconformities, doc
control transmittal to subtier suppliers, etc
Obtain process approach information and use
this when planning the audit and
establishment of audit trails
Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

OASIS feedback loops

From AS9101D

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Understand Subtier Control Requirements

flow down to the supply chain

the applicable requirements
including customer requirements,

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Remember:
For the subtier supplier to be able to perform
adequate 7.2, the organization must perform
7.4 well
In other words, without adequate purchasing
information by a customer, contract and
product requirements review will suffer

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Customer requirements
It starts at contract review
The organization must perform effective contract review,
including special attention to Customer Specific
Requirements, as it relates to subtier control.
As a CB auditor, you must verify that flown down-able
requirements are identified and the interface between
review of requirements and purchasing is effective.

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Customer requirements (sub-tier)

6081 SOFTWARE QUALITY

PROGRAM PLAN REQUIREMENTS

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Customer requirements (sub-tier)

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Customer requirements (sub-tier)

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Key characteristics & Critical Items

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Review of Supplier Performance

Are levels of control, e.g., increased incoming

inspection, supplier audit, source inspection,
etc. based on the periodic review of supplier
performance?
Is data on supplier performance available?
(AS9100C 8.4.d)
Is Risk being considered when selecting and
using suppliers? (AS9100C 7.4.1.f)

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Notification of NCs
AS9131 might be
invoked
Customers may have
specific reporting
requirements

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Notices of change
notify the organization of changes in product and/or
process, changes of suppliers, changes of
manufacturing facility location and, where required,
obtain organization approval

First Article Inspection

FAI AS9102 Requirement

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Outsourced processes
The organization has to demonstrate that it exercises sufficient
control to ensure that this process is performed according to the
relevant requirements of AS9100, and any other requirements of the
organizations quality management system.
The nature of this control will depend on the importance of the
outsourced process, the risk involved, and the competence of the
supplier to meet the process requirements. Based on the nature of
the control, it should consider the processes referred to quality
management system for management activities, provision of
resources, product realization and measurement, analysis and
improvement.
Control MUST go beyond stipulation of requirements in a P.O.
The outsourced organization does not necessarily have to have a
certified Quality Management System, but it has to demonstrate the
capability of the previously mentioned processes.

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Outsourced processes
Remember that outsourced processes go beyond manufacturing
processes and can include design development, verification and
validation testing, prototyping, software development, warehousing
and distribution, packaging (crating), etc
Flowdown of requirements is CRITICAL.
Special processes must be validated and revalidated as necessary.

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Work transfers
Work transfers also present a challenge related to subtier supplier
control. Especially because, many times, the transfer is done to a
sister plant (within the same organization).
AS9100C 7.1.4 The organization shall establish, implement and
maintain a process to plan and control the temporary or permanent
transfer of work (e.g., from one organization facility to another,
from the organization to a supplier, from one supplier to another
supplier) and to verify the conformity of the work to requirements.
AS91007.4.2g) notify the organization of changes in product and/or
process, changes of suppliers, changes of manufacturing facility location
and, where required, obtain organization approval

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Planning for an Effective Audit

The type and extent of control applied to the supplier and
the purchased product shall be dependent upon the effect of
the purchased product on the subsequent product realization
or the final product.
Criteria for selection, evaluation and re-evaluation shall be
established.

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Reflection What have we learned

Thats right its time for a:

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Quiz
As you audit an organizations supplier evaluation
process, you notice that the only type of oversight
they do onto their suppliers is an annual, one-page,
self-directed survey, with basic questions about their
QC program.
Some of the products this organization buys contain
Critical Items.
Is this method of subtier supplier control adequate?

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Quiz
Organization XYZ (a build to print shop) accepted a contract
from an AAQG Member Company to manufacture a Pulley
Bracket Assembly that also included a casting detail part.
Since the organization did not have capability to produce
castings, they planned to purchase this detail part. The
source selection team decided to use a local casting supplier
they have used in the past for their John Deere tractor
contracts. They have an excellent quality rating!
Note: The casting required NDT (Penetrant Inspection and
Radiographic Inspection) prior to part acceptance.
Can a commercial subtier supplier be used to fabricate this
product? Why or Why not? Any concerns?
What flowdown requirements would you expect to see in the
contract to this subtier?

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Quiz
Client Acme Tool and Die has accepted a contract from an
AAQG Member Company to manufacture a chrome plated
shaft part. The member company has included an AS9102
FAI requirement in the contract. Since the organization did
not have capability to chrome plate the part, they planned to
use an approved plating source and perform the FAI
inspection activity after receipt of the part from the subtier.
What flowdown requirements would you expect to see in the
contract to this subtier?
Any issues with the FAI being completed after processing?

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Quiz
Upon review of ABCs management review records the CB auditor
noted that they had completed an improvement project in their
Receiving Inspection Department. The problem statement related to
improvement of flow time and assuring timely delivery of purchased
product to the shop floor. When asked about performance, the QA
Manager stated:
We hired a sharp QE that helped us implement statistical
sampling inspection strategy and a new supplier delegation
program.
We implemented these two changes and we reduced our
bottlenecks by 95%
The product doesnt sit in a box on the dock, it goes straight to
the shop floor

Do these methods conform to AS9100?

What are some of the audit trails you would follow to verify
conformance?
Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Lessons Learned
Change is constant and this includes Clients purchasing activities and
changes at their subtier suppliers
Outsourcing due to Cost Pressures increase risk (Use of Foreign Sources)
Quality representatives may not be actively involved in the purchase
contract process, therefore adequate quality requirements may not be
flowed to suppliers.
The organizations supplier quality team may not be conducting contract
reviews with their subtier suppliers to ensure that the subtier supplier
understand requirements.
Additional focus on three critical areas will help an organization mitigate the
potential risk for Non-conforming Product being received from a subtier.
They include:
Requirements Flow down- Requirements are understood and flowed
down to the appropriate levels of the supply chain, including critical
subtier suppliers
Supplier Selection- Suppliers must have the right capability and
capacity to understand and perform the work and/or manage their
subtiers (tier 2, 3,4) to do so
Verification of Purchased Product- Organization must perform regular
oversight of their suppliers to verify requirements are being meet,
including a review of the Suppliers subtier control process
Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Auditor Resources
Supply Chain Management Handbook

SCMH

Chapter 2 Contracts Reqmts Flowdown

Chapter 8 Supplier Quality
ISO 9001 Auditing Practices Group
Auditing the Procurement
and Supply Chain Processes
Customer Web sites
Boeing - Doing Business

Boston, MA
July 21-22, 2011

Boeing
Doing
Business

9001
Practices

Registration Management Committee (RMC)

Summary
Upfront planning is key to success
Focus on the process
Use results data to drive your audit trail
Understand customer flow down expectations
Add value to the organization by conducting an
effective subtier supplier control audit
Continue the Learning Journey use the
resources

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Good Luck!
May The Force be
with you..

Boston, MA
July 21-22, 2011

Registration Management Committee (RMC)

Good Luck!
May The Force be
with you..

Boston, MA
July 21-22, 2011