New AS rules: Can’t Fire Your Registrar for Bogus Audit Findings

by Christopher Paris

SAE finally released AS9104/1, the document which defines some key rules for certification bodies (“CB’s, or registrars) when conducting AS9100/AS9110/AS9120 certification audits. Never mind that this rulebook comes a few years after the release of AS9100 Rev. C itself, and only a few months before the transition deadline to the new standard, it’s important for AS certified companies to get familiar with a few key points.

The most important part of AS9104/1 is the “audit tables” which define the minimum number of days required to audit an organization based on the specific standard and number of employees in an organization.

A less noticeable requirement, but one which stands to have a significant impact on many registered organizations, is a new rule that limits the ability of certified organizations from “transferring” their registration from one registrar to another if there are any open corrective actions.

8.8.(b) No certificate transfer between CBs shall occur, when the CB controlling the existing certificate has nonconformities documented that are awaiting corrective action closure and acceptance.

The intent, we can infer, is to prevent companies from “registrar shopping”, in order to find a CB that is willing to ignore certain problems and issue a certificate when their current registrar isn’t. Which sounds fine.

The problem is that there’s no data available anywhere to prove that this is a widespread problem warranting this rule be written in stone. Registration transfers are rare, and no one is gathering data on them as a whole, never mind assessing the reasons companies may choose to transfer. Instead, this comes from the typically cynical, “the end user is the problem” mindset of registrars and aerospace primes that create the AS series of standards, through the IAQG and AAQG.

Meanwhile, the real day-to-day problems faced by registered organizations — including the frequent citing of “bogus” nonconformities (findings that are not supported by evidence, or which do not reflect an actual requirement of the particular AS standard) remains “undiscussed” in the standards. The powers that be presume that their system of complaints handling, Accreditation Body oversight and auditor training covers this.

History tells us it doesn’t.

Examples

Almost monthly I receive reports — or personally witness — examples of CB auditors failing to write proper findings. The two biggest problems are, as mentioned, auditors writing up findings that are not substantiated by actual AS9100 requirements, or auditors failing to write up nonconformities while properly recording objective evidence, making the correction of the problems often impossible. (You can’t perform “immediate containment” if the auditor doesn’t record what needs to be “immediately contained.”)

Take, for example, the case where an NQA auditor wrote both major and minor nonconformities against an AS9100 certified client for failing to implement most of the clauses of AS9100 Rev C, including risk management. The problem? He was auditing to the Rev. C standard almost a year before it had been published. He was on the IAQG committee, had a draft of an unpublished standard, and was using that to audit clients. When the client confronted NQA and requested an audit using the proper standard, NQA refused, claiming that a Stage 1 audit could be conducted “can be used and credited to the registration process’; even if the standard used has never been published. NQA withdrew the major nonconformity, but upheld the minor. The client fired NQA and hired a new registrar, who provided audits with the appropriate, current version of the standard.

Under these new rules, NQA might have stopped the transfer entirely, and been in their rights to do so.

Consider the incident when an SGS auditor appeared at an Oxebridge client an entire day early, and then began auditing management review. Because the latest management review meeting had been held the day before, the minutes were not yet typed up. Staff scrambled to type up the minutes, and then presented them to the auditor about an hour later. Having already moved on, he refused to accept the official minutes because they were not presented on time — despite the fact that he was already auditing a day early, in violation of his schedule and contract with the customer. He wrote a minor nonconformity for a lack of minutes, even though they were sitting right on the desk in front of him. When the client called SGS to complain, the SGS rep said “we make it a policy never to challenge our auditors” and the nonconformance stuck.

If that client had elected to fire SGS for what was a violation of SGS’ accreditation rules, the new rules would prohibit any other CB from taking over the client, until the ridiculous nonconformity was closed to SGS’ satisfaction.

Consider the case where an NQA auditor cited a client for lack of FOD control because a large torque wrench wasn’t “shadowboxed” even though the parts made by the company are so small, with openings of less than an inch in diameter, that the torque wrench could never physically “fall into” the parts, making FOD of that type physically impossible. The auditor was applying flight-line FOD controls for a tiny, bench-assembly operation. (He even suggested “FOD walks” for the two desks where assembly was performed.)

And then there’s the case where a CB auditor threatened a client with nonconformities if the (female) QA Manager didn’t meet him for “auditing” at 1 AM in the hotel lobby. I can’t talk much more about that one, since I am pretty sure it’s going to court, and won’t be something ANAB ever sees directly. I think we will be reading about it in the papers, though.

You Have to File a Complaint – Here’s How

I’ve been an advocate for client’s rights, telling them over and over that when confronted with these two problems they must respond back to the registrar with an appropriate challenge. The method is simple, it follows expected procedure, and escalates things only as necessary:

1.) In the official corrective action response to the finding, clearly and politely explain why you feel the nonconformity is NOT a nonconformity, or explain how the lack of evidence prevents you from taking action. In the latter case, ask the CB auditor for additional evidence. (If they don’t have it, the finding should be dropped.)

2.) If the registrar upholds the nonconformity anyway, write a formal complaint (call it a “concern” if the word is too harsh to you) explaining why you feel the nonconformity is not valid, and why it is impossible to take action on. remember, under accreditation rules, the registrar MUST record and respond to this complaint, and cannot take any punitive action against you. While this process is underway, your certification will not be in any jeopardy.

3.) If the registrar fails to respond at all (which happens), or if their response is lacking, escalate the complaint to ANAB or the registrar’s accreditation body. ANAB, for example, has a wonderful web interface for filing such complaints.

In all cases, be polite and present evidence. For instances where a registrar auditor has failed to provide objective evidence, scan the actual report and submit that.

Clients are afraid to file complaints or concerns against registrars for fear that their “nice” auditor will lose his job, or the registrar will take some kind of revenge on the company by stripping their certification. Neither of these ever happen, and these fears are not grounded. In the past, it was fine to just “put up with” these problems rather than challenge a registrar, but under the new AS9104/1 rules, you won’t have a choice. And now you can’t fire your registrar — even for cases of gross misconduct — if there’s an open corrective action in your file.

Under these rules, even “bogus” nonconformities will remain open unless challenged.