Sea change in aerospace and defence certification process

The International Aerospace Quality Group’s (IAQG’s) certification process for aerospace and defence organisations, under the AS9100 series, has undergone significant changes in recent months.

Certification bodies (CBs) continue to use the International Accreditation Forum (IAF) baseline audit durations for initial, surveillance and recertification audits, but – following the changes to the AS9100 series – they will be adopting a performance-based approach.

This can increase or decrease audit durations, depending on the risk posed by an organisation’s aerospace quality management system (AQMS).

Introducing OCAP and PBS/RP

The CBs will be conducting a risk and performance analysis of an organisation’s AQMS before determining the site audit duration and therefore cost. This analysis, known as the organisation certification analysis process (OCAP), is an evaluation that influences audit time based on the organisation’s risk profile. The duration includes on-site and off-site activities, such as planning, report writing, and the audit itself.

Additionally, there is a new optional process called the performance-based surveillance/recertification process (PBS/RP). PBS/RP allows organisations that can demonstrate a consistently high-performing AQMS to reduce the duration of their surveillance and recertification audits. Conversely, a poor-performing AQMS will be penalised by increased audit durations.

The CB process is based on data and/or information provided by the organisation, together with demonstration of continuous maintenance of effective AQMS practices.

Key elements of OCAP

OCAP involves scoring several risk and performance elements, with lower scores indicating better performance. These elements include:

1. Complexity of the organisation:

• Is it single or multi-site?
• The number and uniqueness of processes.
• Scope size.
• Scores: LOW (1), MEDIUM (3), HIGH (6).

2. Internal audit programme performance: 

• Effectiveness of internal audits.
• Scores: LOW (1), MEDIUM (3), HIGH (6).

3. On-time delivery

• Meeting customer delivery targets.
• Scores: EXCEEDS (1), MEETS (3), BELOW (6).

4. Conformity of delivered products/services:

• Product and/or service quality.
• Scores: EXCEEDS (1), MEETS (3), BELOW (6).

5. Customer complaints and feedback:

• Handling of complaints and feedback.
• Scores: EXCEEDS (1), MEETS (3), BELOW (6).

6. Effectiveness of operation processes:

• Performance evaluation assessment record. (PEAR) scores from previous audits.
• Scores: PEAR = 5 LOW (1), PEAR = 3-4 MEDIUM (3), PEAR = 1-2 HIGH (6).

These scores combine to form a Total Risk Score, which categorises risk as HIGH (25-36), MEDIUM (12-24), or LOW (6-11). This risk assessment impacts the audit duration:

• HIGH risk: Add 10%
• MEDIUM risk: No change
• LOW risk: Subtract 10%

Adjustments to audit durations

CBs may also adjust audit durations if certain processes are not present. For example:

• Management of the QMS: -10%
• Design and development of products and services: -20%
• Control of externally provided processes, products and services: -15%
• Control of production and service provision: -20%

Audit durations can be increased to verify corrective actions or because of contractually mandated standards. An additional 20% of the site audit duration is allocated for analysis, planning, and report writing.

Example calculation

As an example of the above, let us consider a ‘make to print’ machinist organisation, with 165 employees, that is applying for recertification.

Based on IAF guidelines, the audit duration is seven days. Using the risk and performance elements outlined above, the organisation’s risk factors might be:

• Complexity: Low (score 1).
• Internal audit: High (score 6).
• On-time delivery: High (score 6).
• Product conformity: Medium (score 3).
• Customer complaints: High (score 6).
• PEAR Scores: High (score 6).

Total Risk Score: 28 (HIGH risk).

This would mean the following audit duration adjustments:

• Risk addition: +10% (0.7 days)
• No design process reduction: -20% (1.4 days)
• Net adjustment: -0.7 days

This then gives a final audit duration of:

• Initial: 7 days
• Adjusted: 6.3 days (rounded to 6)
• Plus, OCAP Activities: +20% (1.2 days)
• Final Duration: 7 days

PBS/RP for high performers

PBS/RP allows organisations to reduce audit time by up to 33% per site if they demonstrate sustained high performance. Eligibility for this process requires:

• completion of one AQMS certification cycle;
• low or medium OCAP risk scores;
• an effective internal audit programme as per ISO 19011: 2018 Guidelines for auditing management systems;
• competent auditors with approved ASD Lead Auditor training;
• ethics policy and communication processes;
• no major nonconformities or certificate suspensions in recent years;
• meeting customer satisfaction metrics.

Organisations that qualify and maintain PBS/RP status may see significant reductions in audit times and costs, though total reductions cannot exceed 50% of the baseline duration.

Conclusion

The IAQG’s new certification processes mark a significant shift towards risk/performance-based auditing. These changes are designed to improve supplier performance to end users and provide greater confidence for the global aerospace and defence customers.

By maintaining high standards and continuously improving their AQMS, organisations can turn these requirements into opportunities for growth and efficiency.

It remains to be seen if a similar scheme will eventually be adopted for third-party ISO 9001:2015 Quality management systems – Requirements certifications.