by Christopher Paris

As more and more supporting documents, facts and actual audit experiences leak out, one thing is becoming clear: AS9100 revision C is a very different animal than its predecessor, Rev. B. But a page-to-page comparison between the standards themselves wouldn’t reveal many differences other than a new emphasis on risk, and some clumsy clauses on project management and configuration management. So what makes this such a “new” approach, and why is it such a windfall for the aerospace prime OEM’s who comprise the IAQG, the group that authored it?

AS9101 revision D reveals the primes’ real motives. This document, rarely seen by certified end users of AS9100, is the rulebook for Certification Bodies and their auditors. It defines how they are supposed to conduct objective, third-party audits of AS9100 to comply with the IAQG’s needs. Under previous iterations, those needs were fairly in line with what the world had accepted for third party conformity auditing, as defined in the international standard ISO 17021, or its previous incarnation “ISO Guide 62.”

When Auditing Was Impartial

With ISO Guide 62 / ISO 17021, the rules for CB auditing were vetted by the entire world, by the members of the International Organization for Standardization. Under previous versions of AS9100/AS9101, the IAQG did little to rock that boat, and some — myself included — though the additional oversight required by the aerospace rules was a welcome way to ensure fair, objective audits.

With AS9101D, however, the IAQG abandons international agreement, and creates an entirely new definition for third party conformity assessment. Now, aerospace auditors are given the mandate (albeit not adequate training) to “judge the effectiveness of processes” of a client, as a “complimentary” role alongside their normal conformity assessments. This seems like a subtle shift, but hardly. Under ISO 17021, auditors were tasked with assessing whether the company effectively implemented its management system; despite a lot of historical retconning from IAQG/AAQG and registrar reps, that is a very different thing from judging effectiveness of processes. Implementation ≠ processes.

For decades, the world understood that management systems are terribly difficult to audit in the same way one calibrates a micrometer, or verifies that a meter pole matches the international standard for what defines “1 meter.” So to date, the rules required impartiality and a reliance on objective evidence as ways to ensure that auditors (humans) could assess compliance to a document (standard) that is open to interpretation. And we did okay, despite some glitches. Impartiality is strongly stressed in 17021:

4.2.1 Being impartial, and being perceived to be impartial, is necessary for a certification body to deliver certification that provides confidence.

The IAQG shift now allows auditors to exercise subjectivity in “judging effectiveness,” while claiming impartiality as they “assess conformity.” The IAQG doesn’t seem to realize that the two mandates are contradictory, and the lower denominator will inevitably win out.

Their claims that judging process effectiveness can be done objectively are being proven wrong on a daily basis. A future article will post explicit evidence, but in just the past few months we have watched as auditors have openly consulted, by:

  • re-arranging client processes during the audit, and then writing up final reports to reflect the processes the auditors designed themselves;
  • providing turtle diagrams, forms and documents created by the auditor, and then having the client fill them out, pretending they were pre-existing records;
  • providing “sample” Quality Manuals from other CB customers, without permission and in violation of confidentiality and nondisclosure agreements;
  • requiring companies to adopt specific aero prime OEM methods, based on the auditor’s previous employer, the OEM;
  • funneling consulting work to “shell companies” operated technically by the auditor, but “officially” managed by a relative or associate.
In all such cases, the auditors are “judging effectivness” by (1) providing consulting and training on the spot, and then (2) auditing their own work. Since none of that gets captured in the final reports, ANAB will never see it.

(How ANAB assessors can make minor tweaks to their approach and “catch” these problems will be the subject of an upcoming article.)

But what does the IAQG get for adding this mess? Where’s the benefit?

A Plague of Arrogance

That is also plainly defined in AS9101. That document requires, for the first time, AS9100 clients to provide their registrar with a demographic breakdown of their customer base, including which are their top customers as far as sales and order volume. This was a strange request when it first came out, and most of us shrugged it off as a means for OASIS to do some demographic number crunching on AS9100 adoption and usage statistics.

Not so. AS9101 rules, and subsequent AATT training, require the auditors to give priority to the client’s largest customer. If a company has 56% of its sales to Honeywell, then the AS9100 auditor is bound to apply a majority of the audit time to auditing Honeywell requirements. That means less time auditing AS9100 and ISO 9001 clauses, and more time on SPOC stuff.

This is problematic in a number of ways: it forces — by threat of de-certification — that the company either adopt the requirements of its’ single biggest customer on all OTHER customers, or create a massively complex QMS that has multiple processes, procedures and workflows depending on each customer. Aero primes like Honeywell, Boeing, L3 et al are not known for attempting to make things easier on their suppliers, so that “bulk” will now be forcibly shoved onto the company’s entire customer base. Obviously, the costs associated with that bulk will likewise be pushed down to the company’s minority customers, who lack the purchasing power to do anything about it.

This flies in the face of ISO 9001 and ISO standards in general, which promote the idea of customer satisfaction – meaning ALL customers, not just your biggest one. By forcing companies to focus only on their large aerospace prime OEM customer, the IAQG is basically giving a big middle-finger to anyone else, and telling your other customers to go to hell.

Astoundingly, it also directly conflicts with ISO 17021, which states (emphasis mine):

4.2.3 To obtain and maintain confidence, it is essential that a certification body’s decisions be based on objective evidence of conformity (or nonconformity) obtained by the certification body, and that its decisions are not influenced by other interests or by other parties.

Perhaps this is why AS9100 is published by SAE and not ISO — AS9100 doesn’t meet international criteria for conformity assessment. When you have specific commercial entities write a standard, then write the rules for auditing that standard, and then specifically hard-code their own companies’ requirements into both of them… a massive conflict of interest arises. More on this in a moment.

I call this “Flowdown of Assholism.” If you are a supplier to even a small AS9100 certified company, you are not going to like how your customer starts treating you because they will have to adopt the beat-em-up practices and attitudes of the aero primes.

Follow the Money

How does this turn into a financial windfall for the aero primes?

Under AS9100B and previous incarnations, the aero primes were still conducting their own supplier audits, although to a lesser degree than the days pre-AS9100. But the remaining audits were expensive and time consuming, so the IAQG took the next logical step: they hijacked the entire CB auditor pool for its own use.

And it got it for free.

Now CB auditors are no longer working to comply with internationally accepted standards of impartial conformity assessment, they are merely working for the aero primes, tasked — through hard-coded requirements in AS9101D — to conduct 2nd party audits rather than objective 3rd party ones.  If this works out, the IAQG member companies will be able to shut down their supplier audit functions entirely, saving millions of dollars, and laying off hundreds of supplier auditors.

And remember: because they write the rules, they didn’t have to pay a single cent to “outsource” their responsibilities to the duped Certification Bodies.

I say “duped” because the CB’s got on board with this change, like grinning bobblehead dogs on a taxi dashboard, abandoning any sense of international responsibility or concern for impartiality, no doubt seeing dollar signs from an expected increase in AS9100 clients. What they don’t know is that there is already a silent backlash: companies are opting instead to stick with, or implement, ISO 9001 rather than go for the AS9100 “upgrade”. Some may skip it all entirely, and implement CMMI, cutting the entire IAF/IAQG/AB/CB hierarchy out of the loop, and just give their money to SEI; it may be expensive, but it’s certainly more objective and less political.

Whatever happens, the CB’s will have been complicit in another brand-marketing misstep for AS9100, as it gets viewed more and more as a “bloated” and “expensive” scheme invented by huge, monolithic companies who are far removed from the actual realities of the average user organization.

Not expecting the cynics at IAQG to wake up any time soon, only dollars will snap them out of their idiocy. There is a possibility that the increased mandating of “giant aerospace requirements” on small suppliers will force those suppliers to raise prices on products to the extent that the primes actually see their own pocketbooks affected, a sort of backwash effect that would be deserving. Unfortunately, though, companies would have to raise their prices on smaller customers first, so the impact may never get felt by the primes, and companies may just find it easier to close up shop entirely, or abandon their other customers and yield to the inevitable indentured servitude of being a “captured shop.”

None of those is good for the industry, or for America.

The Sleeper Must Awaken

ISO, through the IAF, needs to stand up against this gross land-grab by the IAQG, and apply pressure back on it to bring the auditing process back into a fair, objective, and all-encompassing assessment of conformity. ISO needs to revoke the SAE/IAQG’s right to use ISO 9001 text as a basis for AS9100. They can also revoke the IAF’s recognition of the IAQG, and force accreditation bodies like ANAB to stop issuing accreditation under the IAQG’s ICOP program, at least while doing so under the ISO/IAF banner. These are off-the-cuff ideas, and a future article will analyze ISO 17011 and the IAF MLA’s & MD’s in more detail, to present a more standards-backed way to get IAQG to follow international rules.

Politically, this is an electrified third rail plugged into a gas-soaked nuclear power plant. Rejecting the flood of aerospace dollars into the QMS certification scheme would be career suicide for anyone attempting it. Worsening matters, this couldn’t be done easily by a committee which could spread the responsibility (and fallout) around. Instead, there is probably only one guy who can actually do this: IAF President Randy Dougherty. The problem there is that Mr. Dougherty is also one of the senior-most managers at ANAB, a situation which was bound to one day present an “uncomfortable” situation. This is it.

Because, as the IAQG’s (and manager of registrar Det Norske Veritas) Sidney Vianna said openly, “the real users of AS9100 are the OEM’s.”

The creator of a thing is the consumer of a thing? Well okay, fine: if they are the consumer, then let them pay for it. Cut them loose from accredited recognition and the IAF, and let them flounder on their own.

IAF: you can fix this. Do the right thing.

Advertisements
Traditional Tri-System