Internal Auditor Training Course: Understanding QS-9000 3rd Edition Requirements

1. QS-9000 Documentation and Internal Auditor Course Page 1 Internal Auditor Training

2. Course Outline Course Objectives Introduction to ISO/QS-9000 Chapter 1 Definition of a Quality System Quality System Documentation Progression Documentation Structure Chapter 2 Audit Levels Auditing/Registration Process KPMG 2001 Surveillance Schedule KPMG 2002 Surveillance Schedule Chapter 3 QS-9000 Requirements Quality System Assessment Chapter 4 Case Study IASG Sanctions QS-9000: 1998 Third Edition Interpretations Chapter 5 Internal Audit Overview Internal Audit Objectives Audit Planning Chapter 6 Phases of An Audit Auditor (Team) Preparation Opening Meeting Audit Investigation Prepare Audit Summary Closing Meeting Submission of Audit Package Tips for a Successful Audit Chapter 7 Addendum Division Quality Policy Division Policy - Internal Quality Audits Division Procedure, SOP-0019, Internal Quality Audits WI-0071, How to Use the QS Internal Assessment Database System 9000 Auto - Using the QS Internal Assessment Database WI-0012, How to Use the Corrective Action Database Example of Internal Assessment findings Form CAR-443, Example of corrective action request as generated from the internal assessment findings form PAR-033, Example of preventive action request as generated from the internal assessment findings form Page 2 Internal Auditor Training

3. Course Objectives • To assist you in understanding: • the requirements of the current revision of QS-9000 3rd Edition and the objective evidence needed to show conformance • how the Quality System is defined and the structure of each level of documentation. • the significance of interpersonal relationships (auditor etiquette) in the audit process and the importance of good interview techniques • how to use the QSA checklists during an audit. • the importance of taking audit notes during the process sufficient to provide objective evidence of system conformity as well as nonconformity with the documentation against which the audit is being conducted. • To provide you with the tools to successfully: • collect and analyze evidence during the audit, relate specific situations to the appropriate elements of the standard, and exercise objectivity in the review of evidence collected. • write reports based on objective evidence obtained during the course of the audit in the QSI Internal Assessment database. • evaluate the significance of nonconformities recorded during the audit and classify them in accordance with Division instruction WI-0012, How to Use the Corrective Action Database. • identify and undertake the responsibilities as an auditor. • plan and organize all aspects of an audit including the documentation reviews and conformance evaluation activities. • manage the opening and closing audit meetings Page 3 Internal Auditor Training

4. Introduction to ISO/QS-9000 Goal The goal for Quality Systems Requirements QS-9000 is the development of fundamental quality systems that provide for continuous improvement, emphasizing defect prevention and the reduction of variation and waste in the supply chain. Purpose QS-9000 Defines the fundamental quality system expectations of Chrysler, ford and General Motors, Truck Manufacturers and other subscribing companies for internal and external suppliers of production and service parts and materials. These companies are committed to working with suppliers to ensure customer satisfaction beginning with conformance to quality requirements and continuing with reduction of variation and waste to benefit the final customer, the supply base, and themselves. Approach QS-9000 is harmonization of Chrysler’s Supplier Quality Assurance Manual, Ford’s Q101 Quality System Standard and General Motor’s NAO Targets for Excellence with input from the truck manufacturers. ISO9001:1994 Section 4 has been adopted as the foundation for QS-9000 and is printed in Section I in italic type. Interpretations and supplemental quality system requirements have been harmonized and are printed in normal type. The word “shall” indicates mandatory requirement. The work “should” indicates a mandatory requirement with some flexibility allowed in compliance methodology. Suppliers choosing other approaches to satisfy a “should” must be able to show that their approach meets the intent of QS-9000. Where “typical”, “example”, “may” or “e.g.” are used, any suggestions given are for guidance only. Page 4 Internal Auditor Training

5. General Requirements Page 5 Internal Auditor Training

6. Definition of a Quality System • Quality Assurance Management System Objectives • Meet customer requirements • Make sure system is proactive, not reactive • Quality Assurance System • A quality assurance system employs process controls to assure adequate confidence that the end item will fulfill requirements and prevent nonconformities. • Quality Control System • A quality control system is, by definition, the operational techniques and activities used to fulfill requirements for quality. • Quality Plan • A document setting out the specific quality practices, resources and sequence of activities relevant to a particular product or contract. Page 6 Internal Auditor Training

7. Quality System Documentation Progression Page 7 Internal Auditor Training

8. Documentation Structure • The Quality Manual (defines approach and responsibility; written and controlled at Division) • The manual is the governing working document and should include: • Description of the system • Definition of policy • Commitment to quality • Responsibility and authority • Description and implementation of Level II procedures • Procedures (defines who, what and when; written and controlled at Division) • Procedures form the second level • Implement policies set forth in the manual • Procedures are interdepartmental (involve several departments) • Address the general flow and control of each system covered in the QS-9000 standard • Work Instructions (defines how; written and controlled by both Division and the plant) • Instructions form the third level • Instructions are intradepartmental • Provide the step-by-step information on how to perform a specific task • Records (records information and may become a quality record; written and controlled by both Division and the plant) • Records comprise the fourth level • Support the entire quality system • Demonstrate conformance to specified requirements Page 8 Internal Auditor Training

9. Audit Levels • First-Party Audits • The first-party audit is a quality system audit conducted by an organization on its own system (internal auditing) • The purpose is to assure management that the company’s quality systems are promoting the achievement of quality objectives. These audits can be performed by either the organization’s staff (provided they are independent of the systems being audited) or an outside agency (personnel from other plants). • Second-Party Audits • This audit is performed by one organization on another, with which the auditing organization either has, or intends to enter into, a contract to purchase goods or services. • The purpose is to assure the purchasing organization that the supplier’s quality system can sustain delivery of products or services if under contract or provide those goods on services at an agreed-upon quality level. • Third-Party Audits • The third-party audit is performed by an independent agency that is accredited. • The audit’s purpose is to provide assurance on the quality system’s effectiveness per a national standard such as QS-9000. Page 9 Internal Auditor Training

10. Auditing/Registration Process Desk Audit Level 1 Quality Manual Review at Registration Company Pre-Assessment Short on-site visit to review documentation and understanding of standard (optional step) On-Site Audit Multi-day visit typically with multiple auditors to determine degree of conformance Registration Board review of audit results prior to granting registration Surveillance Conducted every six to twelve months after registration Page 10 Internal Auditor Training

11. QS-9000 Requirements Page 11 Internal Auditor Training

12. 4.1 - Management Responsibility • Intent: To ensure management commitment to the quality system • Management with Executive Responsibility shall: • Define and document a policy for quality that includes objectives and its commitment to Quality • Ensure communication and implementation of this policy at all levels of the organization • Provide adequate infrastructure and resources • Define responsibility, authority and interrelationship of personnel • Assign independent resources for internal audit activities • Appoint a management representative with responsibility and authority to ensure implementation and maintenance of the quality system. • Management Review of the Quality System • Regularly scheduled review of objectives, audit results, complaints and key measurables • Records of the review of subsequent actions are required • Business Plan (the content is not subject to 3rd party audit) • Formal, controlled, documented, comprehensive (short & long term) • Methods to develop, edit and review the plan shall be documented • Organizational Interfaces (multi-disciplinary approach) APQP, CIP, FMEA, facilities planning, etc. • Customer Satisfaction • Documented process for determining satisfaction (frequency, objectivity and validity) • Benchmark and follow-up by senior management Page 12 Internal Auditor Training

13. 4.2 - Quality System • Intent: To develop, document and implement a comprehensive, effective quality system • Document and implement procedures as a means of ensuring that product conforms to requirements • Perform advanced quality planning (multi-disciplinary) • Clear standards of acceptability • Identification & acquisition of controls, processes, equipment, fixtures, resources & skills needed to achieve quality • Compatibility of design, production, inspection, etc. • Updating QC, inspection & testing techniques • Identification of suitable verification • Documented quality records • Feasibility reviews • Advanced Product Quality Planning Page 13 Internal Auditor Training

14. 4.2 - Quality System - PPAP • Production Part Approval Process • Intent: To require suppliers to fully comply with the PPAP process, to fully understand how the product will be manufactured and the capabilities of the manufacturing process. • Part specific and supplier specific • Subcontractor requirements • Engineering change validation • Supplier’s responsibility to verify that all changes are properly validated and implemented • Customer approval of PPAP submission prior to production. Page 14 Internal Auditor Training

15. 4.2 - Quality System - Continuous Improvement • Intent: To implement a system and an attitude of continuous improvement in all employees and operations • Identify opportunities for quality and productivity improvement and implement appropriate improvement projects • Develop specific action plans with measurables • Demonstrate knowledge of improvement methods and methodologies and use them as appropriate Page 15 Internal Auditor Training

16. 4.2 - Quality System - Manufacturing Capabilities • Intent: To employ systems and resources for the efficient operations of manufacturing support activities • Multidisciplinary facilities, equipment and process planning • Tool design and fabrication • Tooling and equipment management systems. Page 16 Internal Auditor Training

17. 4.3 - Contract Review • Intent: Customer expectations are identified and the ability to meet them is verified. • Contracts shall be reviewed before acceptance • Requirements are defined, documented and agreed upon • Any differences between order and tender are resolved • Ability to meet all requirements is verified • Supplier shall identify how amendments to contracts are made • Communication of contract activities should be through established customer channels • Records of contract review shall be maintained Page 17 Internal Auditor Training

18. 4.4 - Design Control • Intent: Customer expectations are understood and designed into the product • Design Control only takes place at New Product Development (Walled Lake) and the Division office. • Design inputs must include applicable statutory and regulatory requirements • Design outputs are verified/validated against input requirements • Formal documented design reviews are held at specified intervals • Design changes are documented, reviewed and approved • Prototype program must be maintained Page 18 Internal Auditor Training

19. 4.5 - Document & Data Control • Intent: To assure accurate and timely data is available to all employees • Control and maintenance of internally produced policies, procedures, instructions, forms, visual aids and specifications • Control and maintenance of external standards, reference materials, customer specifications and drawings • Availability of proper documentation at point of use • Timely review and approval of changes to documents • Prompt removal of obsolete documents from point of use Quality Manual Level 1 Level 1: Defines approach and responsibility Procedures Level 2 Level 2: Defines who, what, when Work Instructions Level 3 Level 3:Answers how Level 4: Prompts recording of information, e.g. forms, tags, labels. Once recorded, the item may become a quality record. (see 4.16) Other Documentation Level 4 Page 19 Internal Auditor Training

20. 4.6 - Purchasing • Intent: To ensure that vendors are capable of meeting the expectations of SPX Contech • Approved supplier list • Supplier selection based on their ability to meet requirements (history) • Define the extent of control over subcontractors • Produce and maintain records of performance • P.O.s shall clearly describe the product ordered • Review P.O.s for accuracy prior to release • Define arrangements for verification of purchased product • Document the right to verify at the subcontractor’s premises • Subcontractor development to QS-9000 as their fundamental quality system requirements Page 20 Internal Auditor Training

21. 4.7 - Control of Customer Supplied Product • Intent: To control any customer owned materials while in our cared • Procedures controlling verification, storage and maintenance of customer supplied product • Recording and reporting of any such product that is lost or unfit for use • Appropriate storage and maintenance • Includes tooling, customer owned packaging, equipment, etc. Page 21 Internal Auditor Training

22. 4.8 - Product Identification & Traceability • Intent: To maintain traceability of product, components, raw materials or production location to the extent required by customers and applicable standards • Identification of product during all stages of production, delivery and installation (individual products, batches or lots) • Rationale • Safety • Recall • Liability Page 22 Internal Auditor Training

23. 4.9 - Process Control • Intent: To ensure that all processes are planned, capable and managed to the extent necessary for meeting customer expectations • Designation of special characteristics • Documented work instructions that define manner of production • Suitable production equipment and working environment • Approval of processes and equipment (capability) • Workmanship criteria • Preventive maintenance • Planned, scheduled PM (with schedules met) • Predictive maintenance methods • Availability of replacement parts • Ongoing process/performance monitoring • Verification of job set-ups • Record of process changes with customer approval (effective dates) • Contingency plans to protect customer’s supply of product Page 23 Internal Auditor Training

24. 4.10 - Inspection & Testing • Intent: To provide adequate verification of quality requirements • ZERO defects of acceptance criteria on attribute sampling • documented by supplier and approved by the customer on all other data • Receiving Inspection • Incoming material verified per requirements (control plan) • Released only after verification • Receive statistical, inspection, test data and certifications • 2nd or 3rd party assessments or evaluations • If released prior to verification, must have positive recall • Accredited laboratories • Supplier laboratory requirements • Quality systems and personnel • Process control • Testing, calibration and statistical methods Page 24 Internal Auditor Training

25. 4.10 - Inspection & Testing (continued) • In-Process Inspection • Inspection and test according to quality (control plan) • Hold until all verifications are complete and in compliance • All process activities should be directed towards prevention rather than detection • Layout Inspection and Functional Testing • To customer material and performance standards • To customer specified frequency for all products • Final Inspection • All quality plan requirements complete to the control plan • Evidence of product compliance - records retained and authorized Page 25 Internal Auditor Training

26. 4.11 - Control of Inspection, Measuring & Test Equipment • Intent: To document and implement a system to control, calibrate and maintain all equipment used to verify product quality. • Unique identification & status indicator • Procedure, frequency, calibration status • Standards traceable to national/international recognized standards • Calibration services specified • Required accuracy and precision - GR&R • Maintain records • Suitable environment, handling and storage • Measurement System Analysis (MSA) on all types of measurement equipment Page 26 Internal Auditor Training

27. 4.12 - Inspection and Test Status • Intent: To identify the quality status of a product • Systems for identification of product during all stages of manufacture that indicate conformance or nonconformance to tests performed (tags, routing cards, physical location, etc.) • To ensure that only product that has passed all required testing is released, shipped or used • NOTE: Location of product in the normal production flow does not constitute a suitable indicator of status unless it is obvious. Page 27 Internal Auditor Training

28. 4.13 - Control of Non-Conforming Product • Intent: Response appropriately to non-conforming product • Identification - non-conforming product immediately identified • Documentation - non-conforming product supporting information • Segregation - clearly identified segregation area • Evaluation and disposition - define review & disposition authority (may use rework, scrap, etc.) • Prioritize reduction plan • Notification of concerned functions and/or customer • Rework instructions and re-inspections records are required Page 28 Internal Auditor Training

29. 4.14 - Corrective and Preventive Action • Intent: To deploy a formal system for the identification, resolution and prevention of both internal and external non-conformances • Documented procedures • Disciplined root cause analysis (8D) • Mistake proofing activities • Analysis of failures, complaints, audits, returns • Proactive - prevention and continuous improvement • Impact on similar process/product • Management review and verification of effectiveness • Documented records Page 29 Internal Auditor Training

30. 4.15 - Handling, Storage, Packaging, Preservation & Delivery • Intent: To ensure quality throughout the production, storage, transportation and delivery of product to both internal and external customers • Documented procedures of material handling and storage • Protect and Preserve product from damage, deterioration or loss of identity • Inventory management system to maximize turns and minimize inventory levels • Monitor and improve delivery performance to support 100% on-time delivery • Order-driven production scheduling • Compliance with unique packaging standards • Electronic communication Page 30 Internal Auditor Training

31. 4.16 - Control of Quality Records • Intent: To provide objective evidence of the effective implementation and operation of the quality system. To generate data for use in the analysis of processes, products and performance. • Storage responsibilities and retention periods identified • Hard copies or electronic media • Must be accessible and retrievable • Must be stored in a manner to preserve Page 31 Internal Auditor Training

32. 4.17 - Internal Quality Audits • Intent: To identify, document and communicate improvement opportunities through an objective periodic audit system • Assessment of the overall quality system to include all shifts • Documented procedures • Scheduled on basis of importance • Timely and appropriate corrective actions • Review by management • Appropriately certified internal auditors • Results linked back to the quality plan Page 32 Internal Auditor Training

33. 4.18 - Training • Intent: To ensure that anyone performing a task that impacts the quality of the product being manufactured has the appropriate skills and knowledge • Assign qualified personnel • Education • Training • Experience • Periodic review of training effectiveness • Maintain appropriate records Page 33 Internal Auditor Training

34. 4.19 - Servicing • Intent: To provide systems and resources for after-sales product servicing when part of the contract or purchase order • Currently, SPX Contech does not provide servicing to our customers Page 34 Internal Auditor Training

35. 4.20 - Statistical Techniques • Intent: To identify the need for statistical techniques required for establishing, controlling and verifying process capability and product characteristics • Identify need • Training of personnel • Documented procedures where appropriate Page 35 Internal Auditor Training

36. Section II - Customer-Specific Requirements • Intent: To require suppliers to fully comply with customer-specific requirements • Applies to all tier one automotive contracts • Identify the requirements • Documented procedures where appropriate Page 36 Internal Auditor Training

37. Case Study The internal auditor from SPX CONTECH/Metal Forge requested to see the calibration laboratory. When Sam Smith and the auditor arrived at the calibration lab, Smith introduced the auditor to Joe Caliper, lead technician for the calibration lab. Joe explained that he was repairing a voltmeter (the only one they have) for checking production unit (1.5) volt batteries. The meter had just been found out of calibration during the routine monthly calibration cycle. The auditor, through a series of questions, determined that the meter was reading 0.4 volts high, but it was a simple adjustment to the meter to bring it back into calibration. Joe indicated that this type of occurrence happens frequently but that all he has to do is repair and recalibrate the equipment and that’s the end of it. “I don’t even need to keep records of this,” he said. The auditor then asked, “Are batteries identified as a critical component?” Smith said, “Yes they are.” When the auditor asked to see the calibration records of the gages he had noted in assembly, Joe pulled the gage history cards and gave them to the auditor. One gage was out of calibration and the as-received data recorded. When asked what action was taken when a gage was out of calibration, Joe replied that he calibrated it and sent it back to the floor. When asked if statistical studies were performed on new gages, Joe replied that they did up to a year ago, but they got so busy he had to stop making them. “Perhaps we should proceed to incoming inspection,” said the auditor. “If you’re going that way,” said Joe, “here take this meter to Sam, I just calibrated it and he needs it.” Case Study Questions: Are there any deficiencies to ISO/QS-9000? If so, what are they? Page 37 Internal Auditor Training

38. Case Study - Answers The internal auditor from SPX CONTECH/Metal Forge requested to see the calibration laboratory. When Sam Smith and the auditor arrived at the calibration lab, Smith introduced the auditor to Joe Caliper, lead technician for the calibration lab. Joe explained that he was repairing a voltmeter (the only one they have) for checking production unit (1.5) volt batteries. The meter had just been found out of calibration during the routine monthly calibration cycle. The auditor, through a series of questions, determined that the meter was reading 0.4 volts high, but it was a simple adjustment to the meter to bring it back into calibration. Joe indicated that this type of occurrence happens frequently but that all he has to do is repair and recalibrate the equipment and that’s the end of it. “I don’t even need to keep records of this,” he said. 4.11.2.c Define the process….and the action to be taken when the results are unsatisfactory. 4.11.3 Records of calibration activity for all gages measuring, and test equipment, including those owned by employees shall be maintained. The auditor then asked, “Are batteries identified as a critical component?” Smith said, “Yes they are.” 4.11.2.f Assess and document the validity of previous inspection and test results when inspection, measuring or test equipment is found to be out of calibration. Page 38 Internal Auditor Training

39. Case Study - Answers When the auditor asked to see the calibration records of the gages he had noted in assembly, Joe pulled the gage history cards and gave them to the auditor. One gage was out of calibration and the as-received data recorded. When asked what action was taken when a gage was out of calibration, Joe replied that he calibrated it and sent it back to the floor. 4.11.2.e Maintain calibration records for inspection, measuring and test equipment. When asked if statistical studies were performed on new gages, Joe replied that they did up to a year ago, but they got so busy he had to stop making them. “Perhaps we should proceed to incoming inspection,” 4.11.4 Appropriate statistical studies shall be conducted to analyze the variation present in the results of each type of measuring and test equipment system. said the auditor. “If you’re going that way,” said Joe, “here take this meter to Same, I just calibrated it and he needs it.” Page 39 Internal Auditor Training

40. Internal Audit Overview • The internal audit is: • An independent structured sampling to determine: • Overall System Effectiveness • Status of Documentation and records • If customer interests are addressed • Internal audits tell us if: • We have a well defined and well documented quality system • We satisfy customer expectations • We are following our system • We have records and results of internal audits to substantiate this • Our quality system satisfies ISO/QS-9000 • We are in compliance with specific customer requirements Page 40 Internal Auditor Training

41. Internal Audit Objectives • Gather objective evidence • Based on facts • Unbiased (emotion or prejudice) • Could be a statement or comment • Within the scope of the audit • Verifiable • Make sure the system is not broken • Communicate findings to management • Satisfy customer expectations • Promote continual improvement Page 41 Internal Auditor Training

42. Who Is An Auditor? • In general, an auditor is an experienced individual with an ability to deal effectively with obstacles inherent in the process of building and/or improving a quality system. • An auditor is an individual who has the qualifications to perform any portion of an audit, including the duties of lead auditors, technical specialists, and other such management representatives and auditors-in-training. • A lead auditor is an individual qualified to organize and direct an audit, report nonconformances, and evaluate corrective actions. Page 42 Internal Auditor Training

43. Assessment Schedule Form (Specific) Page 43 Internal Auditor Training

44. Audit Planning • The Quality System Authority will: • Select the audit team • Select audit activities and areas • Review previous audit reports • BSI • Internal audits • Customer audits • Schedule the audit with the input of the auditee • Develop audit plan using QSA • Review quality manual and documentation • Supply the team with relevant documentation, i.e. Internal Development Assessment Form, work instructions, etc. • Identify time frame for audit Page 44 Internal Auditor Training

45. Phases Of An Audit • Phase I Auditor (Team) Preparation • Phase II Opening Meeting • Phase III Audit Investigation • Phase IV Prepare Audit Summary • Phase V Closing Meeting • Phase VI Submission of audit package Page 45 Internal Auditor Training

46. Phases I and II • Auditor (Team) Preparation • Review documentation packet as received from the Quality System Authority • Opening Meeting • Introduce team members • Explain your purpose • Describe specific areas, procedures, etc. to be audited • Request copies of documents as necessary • Welcome comments and questions • Put auditee(s) at ease • Stress cooperation • Tentatively schedule closing meeting Page 46 Internal Auditor Training

47. Phase III • Audit Investigation • Questions to obtain objective evidence • What (is the quality policy?) • When (do you involve your supervisor? • Where (do you find your work instructions?) • Why (do you do it that way?) • Who (records this data?) • Which (part are you running?) • How (do you know what dimensions to check?) • If (the process is not running to specification, what do you do?) • Make sure you ask the right people the right question and you’ll get accurate answers. • Make use of volunteered information. • Always be constructive, positive and helpful. • Remember: The auditee always gets the benefit of any doubt and to always keep them posted on the audit progress. Page 47 Internal Auditor Training

48. Phase III (continued) • Notes on what to record • People’s: • Name/Employee Number • Title • Who they report to • When someone refers to a document: • Number • Title • Revision Date • Make copy when required • Instruments (gages, measuring equipment, etc.): • ID number • Calibration status • Gather objective evidence • Suggestions for second person responsibilities • Take notes • Watches the time • Adds technical expertise • Maintains impartiality • Observes everything • Takes turns auditing and asking questions Page 48 Internal Auditor Training

49. Phase III (continued) • Interviewing Techniques • Recognize that the audit team’s presence may be an imposition • Keep promises - don’t break them • Be prepared - know the subject material • Be positive • Compliment the auditee • Always maintain control of the interview • Provide assistance in areas where misinterpretation of your question has occurred • Be a good listener • Don’t get involved in disputes between auditee personnel • Observe business ethics • Be professional • Keep questions short and to the point Page 49 Internal Auditor Training

50. Phase III (continued) Communication Do’sDon’ts Stop talking Be judgmental Put the speaker at ease Interfere Show you want to listen Be close minded (attitude) Remove distractions Wishful hearing Empathize Excessively talk Hold temper Ask questions Page 50 Internal Auditor Training