Procedure 3 Quotes and Contract Review

Procedure 3 Quotes and Contract Review

Table of Contents 1 Definitions... 2 2 Quotes and Contract Review Process Flow... 3 3 Calculating Audit Day Requirements Process Flow... 4 4 Audit Duration... 4 4.1 Effective Number of Personnel... 5 4.2 Methodology for Determining Audit Duration... 5 4.3 Initial Assessments... 6 4.4 Surveillance Assessments... 6 4.5 Reassessment Assessments... 6 4.6 Temporary Sites... 7 5 Multisite Organisations... 7 5.1 Audit Times... 8 5.2 Calculating Sample Sizes... 9 5.3 Adding New Sites... 9 6 Combined/Integrated Systems... 10 6.1 Suspension, reduction, Withdrawal... 11 7 Amended Quotations... 11 8 Document Revision History... 12 Proc 03 / Issue 18 Page 1 of 12

1 Definitions Quotes and Contract Review Audit Duration-Audit duration for all types of audits is the effective time measured in auditor days required to carry out auditing activity. Auditor Day-The duration of an auditor day is normally 8 hours and may or may not include travel time or lunch depending upon local legislation. Effective Number of Personnel-The effective number of personnel consists of all full time personnel involved within the scope of certification including those working on each shift. Nonpermanent (seasonal, temporary, sub-contractors and contracted personnel) and part time personnel who will be present at the time of the audit shall be included in this number. Temporary Site-A temporary site is one set up by an organisation in order to person specific work or a service for a finite period of time and which will not become a permanent site. (e.g. a construction sites). Complexity Category (EMS, H&S only)- For EMS and H&S Systems, the provisions specified in this procedure are based on five primary complexity categories of the nature, number and gravity of environmental aspects or health and safety risks of an organisation that fundamentally affects the auditor time. Multisite Organisation- Multisite organisations are defined as organisations that have an identified central function (head/central office) at which certain activities are planned, controlled or managed and a network of local or branch offices at which such activities are fully or partially carried out. Audit of Integrated Management System- An audit of an organisation s management system against two or more sets of audit criteria/standards conducted at the same time. Integrated Management System- A single management system managing multiple aspects of organismal performance to meet the requirements of more than one management standard, at a given level of integration. A management system may range from a combined system adding separate management systems for each set of audit criteria/standard, to an Integrated Management System, sharing in single system documentation, management system elements, and responsibilities. Level of Integration- The level to which an organisation uses one single management system to manage multiple aspects of an organisational performance to meet the requirements of more than one management system standard. Integration relates to the management system being able to integrate documentation, appropriate management system elements and responsibilities in relation to two or more sets of audit criteria/standards. Proc 03 / Issue 18 Page 2 of 12

2 Quotes and Contract Review Process Flow Proc 03 / Issue 18 Page 3 of 12

3 Calculating Audit Day Requirements Process Flow 4 Audit Duration Audit duration for all types of audits includes on site time at a client s premises and time spent off-site carrying out planning, document review, interaction with client personnel and report writing. It is expected that the audit duration involved in the above processes should not typically reduce the total on-site audit duration to less than 80% of the time calculated shown in Doc 9, 14, 16, 26, 36 and 44 as applicable. This applies to the initial, surveillance and recertification audits. Where additional time is required for planning and/or report writing, this will not be justification for reducing on-site audit duration for any audit. If an organisation operates shifts, justification for and against auditing all shifts shall be detailed within the contract review. All justifications for additive and subtractive factors in relation to audit time shall be shown on the contract review form including adjustments made (Form 2 s). It is unlikely that the reduction of the audit duration would exceed 30% of the guidance times stated in Doc 9, 14, 26, 36 and 44 as applicable. A reduction is not permitted for AS 9100 or AS9120 time as specified in Doc 16. Proc 03 / Issue 18 Page 4 of 12

4.1 Effective Number of Personnel The effective number of personnel us used as a basis for the calculation of audit duration. Dependent upon the hours worked, part time personnel numbers may be reduced and converted into an equivalent number of full time personnel. Appropriate reduction should be made to the temporary unskilled personnel who may be employed in considerable numbers in some countries due to the low level of technology and automation. Appropriate reduction of number of personnel also should be made where significant proportion of staff carry out a similar function, for instance; transport, line work, assembly lines, etc. 4.2 Methodology for Determining Audit Duration The methodology used as a basis for the calculation of audit duration of an initial audit (Stage 1 & Stage 2) involves the interpretation of tables and figures within Documents 9, 14, 16, 26 and 36. A reduction is not permitted for AS 9100 or AS9120 time as specified in Doc 16. The QMS requirements identified in Doc 9 is based solely upon the effective number of personnel but does not provide for minimum or maximum duration. With regards to EMS, H&S and ISMS, the effective number of personnel within their respective docs (14, 26, 36) is also based on the complexity of the organisation and does not provide minimum or maximum duration. Where product or service realisation processes operate on a shift basis, the extent of auditing of each shift depends on the processes done on each shift, and the level of control of each shift that is demonstrated by the client. The organisation shall identify shift patterns within their application questionnaires and justification for or against auditing these shall be documented within the relevant Form 2. Auditing of shifts is mandatory within the Aerospace Scheme within the cycle as per Doc 16. Once the general starting point for auditor time has been established from the relevant scheme guidance table, the required time allocated to the audit shall be adjusted to account for the differences within the individual organisations Management System. Refer to the individual scheme documents for additional guidance (Doc 14, Doc 16, Doc 26, Doc 36, Doc 44) as some schemes have specific requirements for this process. Example factors requiring additional auditor time could be: Complicated logistics involving more than one building or location within the scope of the Management System; Staff speaking in more than one language or preventing individual auditors from working independently; High degree of regulation; Highly complex processes or relatively high number of unique activities; Processes involve a combination of hardware, software, process and service; Activities that require visit temporary sites to confirm the activities of the permanent sites whose Management System is subject to certification. Example factors requiring additional auditor time for EMS and H&S could be: Higher sensitivity of business compared to typical location for the industry sector; Views of interested parties; Indirect aspects and risks necessitating increase in auditor time; Proc 03 / Issue 18 Page 5 of 12

Additional or unusual environmental aspects or hazards or regulated conditions for the sector. Example factors permitting less auditor time could be: No/low risk product/processes; Prior knowledge of the organisation; Client preparedness for certification (already certified by another 3 rd party scheme); Processes involve a single general activity; Maturity of the Management System in place; Low complexity; High percentage of employees performing the same task. The time spent by any team member that is not assigned as an auditor (i.e. Technical Experts, Translators, Interpreters, Observers and Auditors-in-Training) shall not count in the established audit time and may require additional time to be added to the audit. The number of auditor days allocated shall not be reduced by planning longer hours per working day. Any additive or sub-tractive time shall be justified and document within the contract review document related to that scheme (Form 2 s). 4.3 Initial Assessments Audit duration involved in combined off-site activities (planning, document review, report writing etc) should not reduce the total on-site audit duration to less than 80% of the time calculated following the methodology as detailed above in section 4.2. Where additional time is required for planning and/or report writing, this will not be justification for reducing on-site audit duration. Certification audit duration may include remote auditing techniques such as interactive webbased collaboration; web meetings, teleconferences and/or electronic verification of the client s processes. IMS do not currently perform remote auditing techniques, if we should in the future then these must be performed in accordance with IAF MD4. 4.4 Surveillance Assessments The total amount of time spent annually on surveillance visits should be 1/3 of the time spent on the initial certification audit rounded up to the nearest 0.25 days. The day allocation shall be reviewed each year during the audits to ascertain changes in the business including personnel numbers. The audit plans and contracts stipulate that clients are to inform us of any changes. 4.5 Reassessment Assessments The total amount of time spent on reassessments should be 2/3 of the time that would be required for an initial certification audit rounded up to the nearest 0.25 days. Proc 03 / Issue 18 Page 6 of 12

A full review is completed prior to the reassessment using a triennial review form (Form 34). A review of the employee numbers, performance and changes over the surveillance cycle shall be performed and the reassessment days calculated from that review. A new quotation shall be issued at this point. If after a full surveillance cycle an individualised surveillance and recertification programme may be designed for the client. If this option is chosen the cycle will follow the requirements of IAF MD3 for Advanced Surveillance and Recertification Procedures. 4.6 Temporary Sites In situations where the certification applicant or certified client provides their products or services at temporary sites, such sites shall be incorporated into the audit programme. Temporary sites could range from major project management sites to minor service/installation sites. The need to visit such sites and the extent of sampling should be based on an evaluation of the risks of the failure of the Management System to control product or service output. The sample of the sites selected should represent the range of the client s competency needs and service variations having given consideration to sizes and types of activities, and the various stages of projects in progress and associated impacts and risks. Organisations are asked about their temporary sites during their application process and shall be monitored during each assessment for changes. Justification for visiting sites shall be documented during the contract review stage within the relevant Form 2. Typically on-site audits of temporary sites would be performed. However, the following methods could be considered as alternatives to replace some on-site audits: Interviews or progress meetings with the client and/or its customer in person or by teleconference; Document review of temporary site activities; Remote access to electronic site(s) that contains records or other information that is relevant to the assessment of the management system and the temporary site(s); Use of video and teleconference and other technology that enables effective auditing to be conducted remotely. 5 Multisite Organisations Please note that any audits under the AS 9100, AS 9120 or AS 9110 scheme do not follow the below requirements for time allocation. For the number of sites to be audited under these schemes, please see the individual scheme document (Doc 16) for multisite procedures under those standards. The below guidance can be used to establish if conditions for multi-site can be met by the organisation. Multisite organisations are defined as organisations that have an identified central function (head/central office) at which certain activities are planned, controlled or managed and a network of local or branch offices at which such activities are fully or partially carried out. This can also include associated storage of raw materials, by-products, intermediate products, end products and waste material, and any equipment or infrastructure involved in the activities, whether or not fixed. Proc 03 / Issue 18 Page 7 of 12

Temporary sites are generally not considered multisite but may be subjected to auditing on a sample basis (such as construction). They may, however be included within the scope of registration but shall be identified as a temporary site within the certification documentation. Examples of possible multi-site organisations are: Organisations operating with franchises Manufacturing companies with a network of sales offices Service companies The processes at each site have to be substantially of the same kind and operating to similar methods and procedures. Where some sites conduct fewer processes than others, they may be eligible for inclusion providing that the sites conducting the most processes or critical processes are subject to a full audit. Organisations which conduct their business through linked processes in different locations are also eligible for sampling providing all other provisions are met. The sampling plan shall include at least one example of each process conducted by the organisation (e.g. fabrication of electronic components in one location, assembly of the same components-by the same company in several other locations). The organisation s management system shall be under a centrally controlled and administered plan and be subject to central management review. All additional sites shall be subject to internal audits and shall have been audited prior to IMS conducting the assessment. The organisation must be able to demonstrate its ability to collect and analyse data from all sites including the central office. Any client wishing to apply under the multisite scheme shall be reviewed using the contract review form (Form 2 s) and details of each location recorded including the scope of activities at each site, size of each site, variations and number of temporary sites as applicable. The time required at each site no matter what standard (AS9100, 9001, 14001 etc) will be calculated individually. The time allocation will be based on individual site employees and not the overall number of employees. For example if the organisation has four sites, Head office with 40, site 1 with 10, site 2 with 20 and site 3 with 15. The audit time allocated to each site for 9001 would be as follows: Head office - 4 days, Site 1-2 days, Site 2-3 days and Site 3-2.5 days. You can then apply the multisite requirements, completing the allotted days for each site. 5.1 Audit Times The number of mandays per site will be calculated utilising Doc 9, 14, 16, 26, 36 and/or 44 as applicable. Reductions can be applied to take into account the clauses that are not relevant to the central office and/or local sites. Reasons for the justification shall be recorded on the contract review form (Form 2 s). Proc 03 / Issue 18 Page 8 of 12

The total time expended on initial assessment and surveillance visits is the total sum of the time spent on each site plus the central office and shouldn t be less than that which would have been calculated for the size and complexity of the operation if all the work had been undertaken at a single site. 5.2 Calculating Sample Sizes At least 25% of the sample size shall be taken at random. Site selection may include the following aspects: Results of internal audits and management reviews Results of previous external audits Records of complaints Significant variations, variations in shift patterns Complexity of the management system and processes Modifications since the last certification audit Maturity of the management system Environmental issues and extent of aspects and associated impacts Differences in culture, language or regulatory requirements Geographical dispersion The selection process does not need to be carried out at the start of the audit process and may be done after the central office has been completed. The central office shall be audited during the initial assessment and reassessment and at least annually as part of the surveillance cycle. Initial Assessment: The size of the sample should be the square root of the number of remote sites rounded to the upper whole number (Y= X). Surveillance visit: The size of the annual sample should be the square root of the number of remote sites with 0.6 as a coefficient rounded to the upper whole number (Y=0.6 X) Reassessment: The size of the sample should be the same as for an initial assessment. However, where the management system has proved to be effective over a period of three years, the size of the sample could be reduced by a factor of 0.8 rounded to the upper whole number (Y=0.8 X). Y=Required number of remote sites to be audited. X=Number of remote sites. If felt necessary due to the performance of the organisation the sample size should be increased. All justifications and calculations will be recorded on the contract review form (Form 2 s). 5.3 Adding New Sites Any new site added to an already existing network of multi-site organisation shall be considered independent for the determination of the sample size (if multiple new sites). An Proc 03 / Issue 18 Page 9 of 12

audit questionnaire (form 1, 1A, 1B, 1C, 1D, 1E as applicable) shall be completed by the multisite organisation and a contract review (Form 2 s) carried out to determine the time required to include the new site. After inclusion, the new sites should be cumulated to the previous ones for determining the sample size for future surveillance and recertification audits. 6 Combined/Integrated Systems If an organisation applies for a combined system certification scheme (for example, IS0 9001 and ISO 14001), the time required to perform the audit can be reduced depending on the level of integration and the ability of the auditors to perform a combined systems audit. The Combined Audit Contract Evaluation (Form 64) shall be used in conjunction with the Contract Review Form (Form 2 s) and Table 1 below. Calculation for Reduction due to Integration Table 1 100 5 5 10 15 20 80 5 5 10 15 15 60 0 5 10 10 10 Level of Integration % 40 0 5 5 5 5 20 0 0 0 0 0 0 20 40 60 80 100 Ability to Perform Combined Audit % To determine the audit time required for a combined audit covering two or more management system standards, e.g. ISO 9001 + ISO 14001 + OHSAS 18001, the contract review personnel shall calculate the required audit time for each management system standard separately (applying all relevant factors provided as per the contract review form (Form 2 s). The starting point for the duration of the combined audit shall be calculated utilising the combined audit contract evaluation (Form 64) and recorded in the top section of the form. Proc 03 / Issue 18 Page 10 of 12

The combined day allocation can be adjusted taking into account factors that may increase ore reduce the time required for the audit. Factors for reduction shall include but are not limited to: The extent to which the organisations management system is integrated; The ability of the organisations personnel to respond to questions concerning more than one management systems standard; The availability of auditor(s) competent to audit more than one management system standard/specification Factors for increases include but are not limited to: The complexity of the audit of an IMS compared with single management system audits. The client shall be contacted to determine the level of integration applicable to the organisation and section 2 of form 64 shall be completed. After Form 64 has been completed, the contract review form can be finalised with the allowable reductions stated. It is unlikely that the sum of all adjustments made for a given organisation, considering all factors, would reduce the time required for a combined audit by more than 20% from the starting point figure. For ISMS assessments that are combined with other standards, the ISMS audit report shall be completed as well as the standard audit report. During a stage 1 audit, the audit team shall confirm the level of integration of the IMS. The Certification Body shall review and modify, as necessary, the audit duration that was based on information provided in the application stage. The level of integration shall be reviewed during each assessment and reported upon within the relevant audit report. Should there be a level of integration change, a contract review shall be performed to ascertain any impact on the day allocations. 6.1 Suspension, reduction, Withdrawal If certification to one or more management system standard(s)/specification(s) is subject to suspension, reduction or withdrawal, a review shall be performed to investigate the impact of this on the certification to other management system standard(s)/specification(s). This shall be performed as per procedure 9. 7 Amended Quotations If an organisation chooses part of a quotation and not all the items quoted then a contract review is required to take place prior to commencing any certification activities. A new quotation may be required if the contract review process has an effect on the resources allocated. An example of this situation may be that IMS have quoted for the transfer of an organisations ISO 9001 certification and then to include ISO 14001, OHSAS 18001 or AS9100 as a new certification. The client may decide to not transfer their 9001 and just have ISO 14001, OHSAS Proc 03 / Issue 18 Page 11 of 12

18001 or AS9100 with IMS. The original contract review may have taken into consideration their ISO 9001 certification as justification for reducing the allocated time for ISO 14001, OHSAS 18001 or AS9100. Therefore a new contract review will need to be completed to ensure that sufficient resources have been allocated to the ISO 14001, OHSAS 18001 or AS9100 certification audits. If the change has affected the resources, a new quotation shall be issued to the client for acceptance. If the change has not affected the allocated resources; the contract review form shall show this decision. 8 Document Revision History Date Amendment Revision 18 th June 2014 Added this revision Box 17 Removed reference to TickIT Included requirements for ISMS Added the Addition and reduction factors information Amended the responsibilities within process flowcharts to be in line with current organizational structure (Operations Manager instead of Assessment Manager) Updated combined audits process to include ISMS requirements Introduced Cover Page from IMS standard Template Included Definitions Revised the requirements in line with IAF MD5:2013 19 th May 2015 Included reference to Form 1E which is used by SIMS and also HSPM applications Made reference to Doc 44-HSPM scheme document Removed reference to Form 6 for transfers and form 1A and 1C as not used anymore, form 1 been modified to accommodate the same information Removed reference to quote log in flowchart as not used anymore Allowed contracts to be in place instead of quotations, mainly for the purpose of operating in China Changed responsibility for quotes from General Manager to Business Development Manager 18 Proc 03 / Issue 18 Page 12 of 12