[This article was originally written for AS9100 C in 2014, but I have updated it for Rev D.]
AS9100’s requirements for configuration management (CM) are well understood by the massive aerospace primes, but can present overkill and confusion for small downstream suppliers. Fortunately, for the small machine shop, the configuration management requirements can be easily met.
Normally, there are two types of machine shops: those with design responsibility, and those which merely manufacture products per the customer’s design. This article will discuss the approaches for both.
Let us start by reviewing the CM clause within AS9100 revision D:
8.1.2 Configuration Management
The organization shall plan, implement, and control a process for configuration management as appropriate to the organization and its products and services in order to ensure the identification and control of physical and functional attributes throughout the product lifecycle. This process shall:
(1) control product identity and traceability to requirements, including the implementation of identified changes;
(2) ensure that the documented information (e.g., requirements, design, verification, validation and acceptance documentation) is consistent with the actual attributes of the products and services.
Those knowledgeable in Revision C of AS9100 will notice the clause has been dramatically truncated. Whereas Rev C required specific steps (configuration planning, identification, change control, configuration status accounting and configuration audits), the new Rev D language makes no specific requirements. This is in keeping with AS9100’s intent to align with the more relaxed ISO 9001:2015 upon which it is based. Whether or not this is a good thing is up for debate.
While it’s good that configuration status accounting and configuration audits were removed — they were a bit much for most machine shops — the new lack of specificity will pose new problems for companies that don’t understand what CM actually is, nor the typical steps to take. So let’s step back and try to wrap our heads around the concept first.
Configuration Management – The Basics
Configuration management is defined by ISO 10007 as “coordinated activities to direct and control the interrelated functional and physical characteristics of a product [as] defined in the requirements for product design, realization, verification, operation and support.” That is quite a lot to manage, so a shorter definition might be “managing the components of a product.”
For the machine shop, such “management” generally falls into two areas of focus: document control and product identification. The document control aspect is concerned with the identification of design data (drawings, for example); the product identification aspect is concerned with ensuring the revision level of parts is verifiable when looking at physical parts. As the 8.1.2 clause indicates, this activity is limited to CM “as appropriate to the product.” Therefore CM does not need to be applied to setup tooling or equipment; doing so is optional.
Configuration management is necessary when products are comprised of various levels of parts that come together to form a final, complex assembly. For the purposes of this article, we will simplify this to two levels: the master part, which is then comprised of component parts. See below.
For such assemblies, not only must the master part be identified with a part number and revision level, each component part must also be identified by part number and revision level. The print for the highest level master part must include an indication (normally a list) of the components including – again – their revision levels.
Configuration Management Planning
Whereas Rev C specifically called for “configuration management planning,” the new revision simply says you must “plan a process for configuration management.” Let’s just skip the unnecessary debate and assume it still means the same thing.
If so, in the typical machine shop, this is easily accomplished by developing a single, documented Configuration Management Procedure. This can be included in your Quality Manual, or made as a separate document. Generally, this procedure would only be a few pages long, and define the overall methods for configuration management that you implement. It will include the two aspects I mentioned: document control and identification of configuration items. It’s best to proceed through the other requirements to understand how you might implement CM, and then you can write your procedure based on that, at the end. So we will revisit this in a moment.
Configuration Items
You won’t see this mentioned in any edition of AS9100, but “configuration items” (sometimes called “configured items” or CIs) are an important first step, typically done during the planning stage above. All this requires is determining which products are subject to configuration management; for example, your products which are comprised of subassemblies, etc., are clearly CIs. You may opt to include tooling and fixtures as CIs if you choose. Determining CIs is like scoping your quality system: you are deciding what products are subject to configuration management, and thus (equally importantly) which are not.
(As an aside, in really robust CM systems, nearly everything is treated as a configured item, including personnel, laptops, documented procedures, services and more. It can get very complicated very quickly. We’re sticking to the “small machine shop” scenario here, though.)
Again, the minimum here would be to identify your complex parts as CIs, being sure to include any products or parts where configuration management is flowed down as a requirement by your customer. List these products, in broad definitions, in your Configuration Management procedure, developed during the planning step above. This can be as simple as:
Configuration items include all products built by Ape-X Industrial Solutions; they do not include tooling, equipment or fixtures.
Or:
Configuration items include those products comprised of multiple assemblies or subcomponents; products which are comprised of a single unit are not treated as configuration items. Where the customer flows down configuration management for a given product, these shall be treated as a configuration item regardless of all other aspects.
Likewise, you can add a literal list of products, by part numbers, which are to treated as configuration items. It’s entirely up to you. Again, the goal here is to draw a border around which products will be subject to configuration management, so that you don’t find yourself applying CM to everything under the sun.
(Another FYI: in AS9100, the concept of “critical items” is discussed. These are also sometimes called “CIs,” but are not to be confused with configuration items. They are two totally different things. Remember, AS9100 does not actually mention “configuration items” at all, but the concept is a basic idea in professional configuration management.)
Configuration Identification
The typical next step in CM is to manage “configuration identification.” In AS9100 Rev C, this step was called out explicitly, and once again it’s only hinted at in Rev D. The goal of configuration identification is to consistently ensure that product is properly identified not only with its current part and revision status, as well as to ensure that all sub-components are identified at their current part numbers and revision levels.
In the typical machine shop, this is accomplished as follows:
- Conceptual identification: when designing parts, these must be assigned both a part number and a revision level. This would then be captured in the associated design data (drawings, solid models, etc.) A method must exist to be able to identify which sub-components are used to form the higher-level assembly; again, this may be a “Master Data List” (MDL) of associated component parts within the master part’s design data, or it may be done through a numbering scheme which identifies the master part for which all component parts are associated. For machine shops with design responsibility, this applies; for machine shops without design responsibility, the shop must ensure it obtains the proper design data from the customer.
- Physical identification: physical products must be identified with the part number and revision. (Both are required; one without the other fails basic CM expectations.) Such identification can be a physical marking/tagging on the part, or merely having paperwork nearby when marking or tagging is not possible (such as when a part is going through a furnace, or being plated.)
Configuration Change Control
The third step is for “configuration change control.” This is an important requirement aimed at ensuring the known configuration identification is maintained when the part’s design is changed. The changes may occur from two directions: a change to the master part, which impacts on one or more of the sub-components; or a change to one of the sub-components, which thus changes the master part.
For machine shops that design parts, the design change process (often via an Engineering Change Order) must include updating related parts at the higher and/or lower levels. A change to a component will always necessitate a change to the highest level master part, for example, since the master part’s revision level is always reflective of a specific set of components, each of a specific revision level themselves.
For machine shops that do not design parts, but merely manufacture parts designed by their customer, the only requirement would be to maintain the configuration of the customer. This means not altering the design of the product, and ensuring the parts produced always match the design data provided. When the customer changes the design, there must be a method to ensure the changes are implemented as directed by the customer; this could be purging of the old parts, or using up the existing stock and applying the change only to new orders, etc.
Bells & Whistles: Configuration Status Accounting and Configuration Audits
As I mentioned, the previous edition of AS9100 specifically required “configuration status accounting” and “configuration audits.” The new standard, Rev D, does not, but I am going to include this here in the event that you need some background on the two terms.
The first term, “configuration status accounting” (or CSA) confuses a lot of folks, but it helps if you shuffle the words as follows: “accounting of the configuration status.” ISO 10007 defines this as including the “recording and reporting of product configuration information, the status of proposed changes and the status of the implementation of approved changes.” It merely means maintaining knowledge of the product’s configuration, even when it changes.
For large design and manufacturing houses, CSA can be complicated. Imagine an aircraft manufacturer: they must account for the configuration of all parts at all levels of the aircraft, from the very first bolt produced, through to the final aircraft itself, which may be comprised of hundreds of thousands of part numbers. A robust CSA program helps keep all this on track. For machine shops, however, the activities associated with part identification and change control comprise CSA, and therefore no additional effort is required. However, your configuration plan document (from the first requirement, above) should clearly indicate this.
Configuration audits are an assessment of a product, whether while it’s in process or perhaps at final inspection, to verify it is comprised of all the proper configured items: the correct parts and subassemblies, each at the correct revision level. For large manufacturers this can be an incredibly complex activity; imagine auditing the final aircraft to ensure that every screw and bolt and plastic bit is at their correct revision levels.
For small machine shops, special configuration audits are rarely necessary. Instead, the final inspection of products should include a step that ensures the final assembly is comprised of all appropriate sub-components, each at their appropriate revision level, and that all revision levels match the approved design (prints, models, etc.) So final QA inspection can count as a configuration audit. Once again, this should be defined in the configuration plan document, so this is clear.
Configuration Management Planning (Redux)
Coming back to the Configuration Management Plan document, as we said, a procedure would suffice for small machine shops. Beyond the typical header and introductory material, the content should look like this:
- Scope of CM activities: a description of how much CM the company is responsible for, whether the shop is design responsible or not, and the role the customer may play in any of the CM steps.
- Unique definitions: any company specific CM-related definitions that may differ from those in the industry.
- Definition of configuration items: define which products will be subject to the configuration management procedure, and (if you like) which will not. Always include language that says if the customer flows down CM requirements, those will trump any internal requirements you’ve set for yourself.
- Configuration identification: define how the company creates part numbers, how part revisions are assigned, how design data (drawings, models, etc.) include this data, and how product (including purchased parts) are physically identified.
- Configuration change control: define the methods for changing product design data, including how revisions are advanced, and how such changes are approved. This may be included in related design procedures, so referring to these may be sufficient.
- OPTIONAL:
- Configuration status accounting: include an explanation that the activities for identification and change control (above) constitute CSA, and that work orders or travelers will monitor the configuration status throughout production.
- Configuration audits: include an explanation that configuration audits are not required “due to the limited CM requirements applicable to the company.” Then, explain that final QA inspections will “audit” the configuration of the finished product before delivery, and that signoff of QA shall constitute a record of a successful configuration audit.
Your mileage will vary with the effectiveness of this approach. Some small machine shops may nevertheless have significant design responsibility, or may work on very complex products, so a more robust process may be required. But for the majority of small shops, this approach will be sufficient to both meet AS9100 as well as ensure good configuration control to ensure the quality of finished products.
Christopher Paris is the founder and VP Operations of Oxebridge. He has over 30 years’ experience implementing ISO 9001 and AS9100 systems, and helps establish certification and accreditation bodies with the ISO 17000 series. He is a vocal advocate for the development and use of standards from the point of view of actual users. He is the writer and artist of THE AUDITOR comic strip, and is currently writing a pulp novella called DR. CUBA.
