OASIS and RMS for Aerospace Auditors

1. OASIS and RMSfor Aerospace Auditors PRI Registrar Updated 01-Jul-2019

2. Introduction • This training will cover PRI Registrar’s process for Aerospace audits, using both OASIS and RMS. • IAQG has provided training material on the functionality of OASIS via their Help section. • PRI Registrar has provided training material on the functionality of RMS via our RMS Help page. • Please review the IAQG and RMS training materials, and contact Samantha Brock (sbrock@p-r-i.org) with any questions.

3. Introduction • The IAQG training, along with a large collection of guidance material is available via the Help icon in OASIS. • In many cases, OASIS will provide targeted help topics, depending on what page the user is on when they select the Help icon.

4. Introduction • If the targeted help topics don’t address the current need, selecting the “General Help” link leads to a page with the full selection of help topics.

5. Introduction • The RMS Help Materials page contains a number of tools and resources, including a guide specific to the use of RMS for an Aerospace audit. • The page is accessible through the RMS Help tab: • Help -> Auditor Help -> RMS Help Materials

6. Scheduling Scheduling

7. Scheduling • All scheduling activities will be conducted in RMS. • Audit dates will still be set in RMS, and must be accepted by both auditors and clients. • Audit days and any notes will continue to be listed in RMS audits.

8. Scheduling • Multisites • RMS and OASIS treat multisites in fundamentally different ways. • RMS treats each site as its own audit, while OASIS treats all site visits as part of a single audit. • The individual site audits will be scheduled and accepted separately in RMS, but all site visits and audit teams will be assigned as part of a single audit and audit team in OASIS. • The Master Lead Auditor will be assigned as the Lead Auditor for the overall multisite audit.

9. Pre-Audit Pre-Audit

10. Pre-Audit • Approximately 45-60 days prior to the scheduled start of an audit, the office is responsible for creating an audit entry in OASIS. • Once the audit has been created, all assigned auditors will receive an automated email from OASIS, informing them that the audit has been created.

11. Pre-Audit • Planning documents, and any audit documents still completed outside of RMS or OASIS will be downloaded from the RMS audit, in the Plan tab. • The Audit Planning Resource (RF-114) and the client’s Interaction of Processes Diagram are uploaded by the client in the Plan tab and are available to the auditor to use in completing the Audit Plan (RF-12). • If the Planning Resource or IOP Diagram are not uploaded in RMS in sufficient time to complete your Audit Plan in the required timeframe, contact the customer to request the forms. If you continue to have problems, contact the assigned Account Specialist, who will be able to assist in obtaining the forms. • The Audit Plan (RF-12) is to be uploaded in RMS in the Plan tab when it is emailed to the client, at least 30 days prior to the start of the audit. • The plan that is uploaded prior to the audit need not be the final version, and it does not need to be updated with any revisions. • The Opening/Closing Meeting Attendance Sheet (RF-20) may be downloaded from the Plan tab ahead of the audit, and will be submitted once complete, following the audit.

12. Example

13. Pre-Audit • When you receive automated emails from OASIS, they will include the client name and the audit number. • In an effort to manage work internally, PRI Registrar uses an OASIS-specific audit numbering system. • The number will consist of the initials of the client manager handling the audit, followed by the RMS audit number and a portion of the client name. • Because an initial audit in OASIS includes both the Stage 1 and Stage 2 audits, the RMS audit number used will be from the Stage 2 audit. • Likewise, because OASIS includes all sites in a multisite as part of a single audit, the RMS audit number used will be taken from the central site audit.

14. Audit Audit

15. Audit: General • During the audit, auditors should reference the RF-115 provided in the RMS Help tab for a description of which documents are required for a given type of audit. • For the IAQG forms, all data is to be entered directly into OASIS, in the appropriate form/section. • Please refer to IAQG’s training for additional detail.

16. Audit: General • It is the responsibility of the Lead Auditor to enter the client processes in OASIS, when that information is available. • List the processes that will appear on the QMS Matrix (and PEARs), per the Audit Program schedule. • This will need to be done at all initial audits. Processes will be pulled forward for future audits.

17. Audit: General • During the audit, the auditor is responsible for verifying the OASIS Administrator, and additionally, the OASIS Representative. • OASIS makes verifying this information very easy with a dedicated button.

18. Audit: General • When completing the IAQG forms, the auditor(s) need to be sure that they have completed all fields (with “N/a” if no response is required). • OASIS will not prevent an incomplete form from being submitted.

19. Audit: General • Integrated Audits • AS9101F 4.2.3 states: • “Separate reports shall be issued for combined audits (i.e., one for each audit performed for each standard). Where appropriate, processes common between the standards may be reported on the same PEAR (see Form 3) and QMS Process Matrix Report (see Form 2).” • Unfortunately, OASIS does not possess the functionality to allow for multiple standards to be listed within an audit. Nor does it possess the functionality to link separate audits for shared documentation. • As a result, for all integrated audits, the auditor must complete full IAQG documentation for each standard. • PRI Registrar is not asking for duplications of our internal paperwork. Completed PRI-specific documentation is to be completed in or uploaded into the integrated audit in RMS.

20. Audit: QMS Matrix • In the case of non-single sites, please note that there is no requirement for separate QMS Matrices. • All applicable sites can be listed on a single QMS Matrix. • Multiple matrices may still be used, when appropriate. • When completing the QMS Matrix, please note the difference between “NA” and “NE”. • NA: Not applicable to the client’s AQMS • Must be justified in the Audit Report and client’s management system scope. • NE: Not evaluated at the current audit • All applicable clauses must be evaluated at the Stage 2 or recertification audit, and at least once during the surveillances.

21. Audit: PEARs • OASIS will allow PEARs be shared across sites, as appropriate. • Multiple auditors will be able to access and contribute to any PEAR in the audit, at any time. • As a courtesy, team auditors should not alter existing data without the prior approval of the team lead. • When entering new information into a shared PEAR, the auditor shall preface the new text with their initials and date. • Before the lead auditor submits the audit package to CB Review, it is their responsibility to review the final PEAR for appropriate content. • Ensure that PEAR ratings are properly imported onto the QMS Matrix. • It is recommended to created the PEARs in the system before creating the QMS Matrix, as this makes importing the PEARs easier.

22. Audit: NCRs • NCRs • When entering NCRs into OASIS, be sure to enter the Issue Date as the end date of the audit so that due dates calculate correctly. • Be sure to import the site information for each NCR.

23. Audit: NCRs • For detailed instructions on NCR Management in OASIS, all auditors are strongly encouraged to read (in detail) the IAQG presentation on the topic. • For general requirements for NCR Management within PRI Registrar’s process, auditors are also encouraged to read (in detail) the PRI training on the topic.

24. Audit: NCRs • The office will have limited ability to monitor NCR management, and so it becomes the auditor’s responsibility to drive the process. • NCR dashboards have been implemented in RMS (for both client manager and auditor use), but these simply track due dates; they will not provide real-time NCR status updates.

25. Audit: NCRs • It will be the primary responsibility of the lead auditor to ensure none of the NCR deadlines are missed. • If due dates are encroaching, and the client is unresponsive, the lead auditor should contact the Account Specialist for help.

26. Audit: NCRs • If an NCR at a surveillance audit is being left in the “accepted” status (the plan has been accepted, but there is no evidence of implementation of the plan), then the auditor is to leave the NCR open when submitting the audit to CB Admin Review status. • For the next audit, a modification to the previous audit will be initiated by the office to allow the auditor to add their (robust!) verification statement and close the NCR(s).

27. Audit: NCRs • For NCRs that were accepted (not closed) at the previous audit: • Search for the modified audit by changing the “Status” field in OASIS to “Modification in Progress”. • If the auditor is unable to locate the modification, contact the office for assistance. • If an NCR cannot be verified, then explain why in Section 3 of the NCR, indicate that it will be re-written in the current audit, reference the new NCR number, and then close the NCR.

28. Audit: NCRs • For NCRs that require containment, OASIS does not offer functionality to allow submittal of partial responses in order to meet the requirements of containment. • In these cases, the client must post a message in the NCR Discussion tab to alert the auditor that containment / correction have been submitted. • The auditor shall review the containment / correction and indicate rejection or acceptance in the NCR Discussion tab. • Doing this will document the timing of acceptance in order to demonstrate conformance with containment deadlines. • If the containment cannot be accepted within the required timeframe, the lead auditor shall contact the client manager.

29. Post-Audit Post-Audit

30. Post-Audit • It is required to leave all NCRs and associated PEARs with the client prior to leaving the client’s facility. • If possible, all NCRs and associated PEARs must be completed in OASIS prior to the closing meeting. • If entering these documents into OASIS is not possible (e.g., no internet), then they must be documented on the RF-22 NCR Summary Report and IAQG PEAR forms and given to the client at the closing meeting. • The RF-22 and PEAR forms can be downloaded from the RMS Help page. • If the NCRs can be entered in OASIS prior to leaving the facility, these forms are not required. • Remember that audit documentation completed on-site must be done during non-audit time, which must be reflected on the audit plan

31. Post-Audit • PRI Registrar expects that audit documentation will be completed and submitted within 5 business days, if possible. • When all OASIS documentation is complete, the lead auditor shall inform the assigned Account Specialist. • OASIS does not alert the office until the package is submitted, which is not until after NCR disposition. • In order to keep the audit process moving, and so as not to run up against OASIS publish deadlines, the auditor shall keep the Account Specialist updated on their progress through the audit process in OASIS.

32. Post-Audit • In addition to the OASIS documentation, there is a supplemental audit report that will be completed directly in RMS, covering topics such as: • Validation of cert structure and audit days • Confirmation of scope of certification • Update of client information • Request additional time or special audits • Tentative date of the next audit • The final version of the Audit Report (RF-12) shall be uploaded (as a pdf) in OASIS, only, and does not need to be updated in RMS. • The completed Opening/Closing Meeting Attendance Form (RF-20a) shall be uploaded in RMS in either the Plan tab, or the Documents section of the Report tab. • Any other documents the auditor wishes to submit as part of the audit record may be uploaded in Other Documents, in the Documents section of the Report tab.

33. Post-Audit • The expense report for the audit shall be completed in RMS following the end of the audit. • PRI Registrar requests that the expense report be submitted within 7 business days of the end of the audit, or as soon as possible once all expenses are available (e.g., toll receipts). • Please refer to the Auditor Travel Policy for additional information on submitting expenses.

34. Conclusion • If you have any questions about PRI’s expectations regarding the use of OASIS and RMS, please contact: • Samantha Brock (sbrock@p-r-i.org) or • Pete Kucan (pkucan@p-r-i.org)