Quality Management System Assessment
Tier II QMS Audit | Internal, Supplier, and Client-Requested Assessments
Define the scope of work performed. Note any recent changes to the current scope of work or equipment requirements.
Note any changes to Standard Operating Procedures or documentation since the previous assessment. Reference previously performed assessments if applicable.
Is a QMS in place? If the organization holds API Q1/Q2 or ISO 9001 certification, record the certification and expiration date.
The Quality Policy must define the directives concerning quality for senior/top management.
Quality Objectives are clearly established and defined for all relevant functions and departments required for executing services and service-related products.
Documented method of communication and training of the workforce on the QMS objectives and system.
Documented method for communication of the QMS Policy and Objectives externally to customers.
Management commitment demonstrated by ensuring Quality Objectives and KPIs are defined.
Owner/senior leadership has designated a Quality Management Representative. Note name and title in the notes.
Personnel performing activities are competent based on appropriate education, training, skills, and experience needed to meet service requirements. Competency levels are clearly defined for the varying level of knowledge and skill relating to each specific job. Evidence provided.
The organization provides: training on the QMS; training specific to the job scope affecting execution of service; customer-specified or customer-provided training where required; training on legal and other applicable requirements. Records of education, training, skills, and experience are maintained. A documented workforce development plan defines minimum training, education, skills, and experience for each job role, and establishes a roadmap or training matrix to advance from novice to expert.
The organization provides the work environment needed to achieve conformity to applicable service and service-related product requirements: workspace, process equipment, supporting services, and conditions under which work is performed.
The QMS includes: statements of quality policy and objectives; a quality manual addressing each requirement, including scope, description of process interactions, allowable exclusions and their basis, and applicable legal requirements; documented procedures established for the QMS; and documents ensuring effective planning, operation, and control of processes and conformance to specified requirements. Required procedures are established, documented, implemented, and maintained.
A documented procedure exists for the identification, distribution, and control of documents required by the QMS, including required documents of external origin.
A documented procedure defines the controls and responsibilities for the initiation, identification, collection, storage, protection, retrieval, retention time, and disposition of records.
A documented procedure exists for the review of requirements related to the execution of services or provision of service-related products.
The organization determines requirements specified by the customer, including requirements for planning, execution, and evaluation. Where contract requirements change, relevant documents are amended and relevant personnel are made aware of the changed requirements.
The organization identifies and plans the processes and documents needed for service and service-related product realization.
A documented procedure exists to control risk throughout the execution of a service.
A documented procedure exists to plan and control the design and development of the service, including the use of service-related products, with records maintained.
Changes in the approved design are reviewed and verified by the management of change process.
A documented procedure exists for contingency planning, including incident and disruption prevention and mitigation measures. Contingency planning is integrated into services and supporting processes between the organization, its suppliers, and the customer.
A documented procedure ensures purchased or outsourced services and service-related products conform to specified requirements. The procedure addresses: determination of criticality; evaluation and selection of suppliers based on ability to supply in accordance with requirements; type and extent of control based on criticality; criteria, scope, frequency, and methods of supplier assessments; and maintenance of an approved supplier list with scope of approval. For critical services/products, initial evaluation includes assessment of the supplier facility and verification that the supplier QMS conforms to specified quality system requirements. Re-evaluation applies at least one of: assessment against purchasing requirements, QMS verification, or assessment upon delivery. Records of assessment results and actions arising are maintained.
A documented procedure describes integration of, at minimum: personnel training and competence; defined contract requirements; risk assessment and management; information describing service characteristics and ensuring design requirements are satisfied; and identification of equipment including required testing, measuring, monitoring, and detection devices.
Controls for execution of the service are documented in routings, travelers, checklists, process sheets, or other documents, including requirements for verifying conformity to quality plans, procedures, and applicable standards/codes. Control documents include or reference instructions, workmanship and acceptance criteria, and customer inspection hold or witness points.
A service quality plan controls the execution of services or use of service-related products (also referred to as a quality plan, service delivery plan, or Service Inspection and Test Plan).
The service quality plan addresses, and is updated when any content changes: required activities and documentation for compliance with customer and legal requirements; responsible functions for each activity including external parties; identification and control of subcontractors; relevant revision of each procedure or specification used; requirements to perform acceptance inspection with hold, witness, monitor, and document review points; service equipment and monitoring devices; identification and controls of risk; identification of critical services and service-related product; required deliverables; and required records.
Service quality plans and revisions are documented and approved by the organization, and communicated to the customer when applicable.
A documented procedure covers identification and traceability of service-related product, including identification controls at all stages of delivery, installation, repair, and redress, plus maintenance or replacement of identification and traceability marks and records. Critical service-related product is identified and traceable to preventive maintenance, inspection, and test program records and the original manufacturer.
A documented procedure exists for the identification of service-related product status.
The organization identifies, verifies, protects, and safeguards customer property provided for use in the service or with the service-related product. Records for control and disposition of customer-supplied property are maintained.
A documented procedure describes methods to preserve service-related product from internal processing through execution of service, including identification and traceability, transportation, handling, packaging, storage, and protection, applied to constituent parts as applicable.
Validation of service-related product is completed prior to execution of the service, with records of validation results maintained.
A documented procedure establishes a PMITP addressing record keeping, inspection, maintenance, redress, repair, make-up, testing, and acceptance criteria of service-related product. At minimum the PMITP includes: actions addressing preventive maintenance; reports documenting usage history, repairs or redress, modifications, remanufacturing, inspection, and test activities allowing direct verification for reuse; a list of critical spare parts required by the customer, technical requirements, or OEM recommendation; and controls ensuring equipment integrity to original performance requirements and design acceptance criteria. Original performance requirements that cannot be met undergo MOC for continued use.
The organization determines required equipment to evidence that services meet specified requirements, and maintains a documented procedure ensuring such equipment is calibrated and maintained, covering traceability, calibration frequency and method, acceptance criteria, and environmental conditions. Assessments and records are required when prior results are found out of conformance. Equipment is calibrated or verified at specified intervals or prior to use against standards traceable to international or national measurement standards (basis recorded where none exist); identified to determine calibration status; safeguarded from adjustments that would invalidate results; and protected from damage during handling, maintenance, and storage. Software used for specified requirements is confirmed suitable prior to initial use and reconfirmed as necessary. Externally provided equipment is verified suitable. A registry of required equipment with unambiguous identification of each piece is maintained, and calibration and verification records are retained.
A documented procedure validates execution of the service performance to confirm requirements were achieved. Records showing conformity with established acceptance criteria, KPIs, and critical success factors are maintained.
A documented procedure defines the controls, responsibilities, and authorities for addressing non-conforming service execution and service-related product. The level of response is proportionate to the severity of the non-conformity and its effect on execution of the service.
Non-conforming service execution or product is addressed by: taking action to correct the non-conformity; where correction is not possible or appropriate, taking action to preclude use of the product from its intended use or application; or, where neither applies, authorizing release or acceptance under concession by a relevant authority or the customer. For non-conforming service execution, corrective action appropriate to the effects or potential effects is taken.
When corrected, non-conforming services and service-related product are subject to verification to demonstrate conformity to requirements. All records of the non-conformance and actions taken to correct it are maintained.
Customers are notified when service execution does not conform to service design requirements, or when non-conforming service-related product has been delivered or used in the execution of the service. Records of such notifications are maintained.
A documented procedure exists for MOC. For the management of change, the organization identifies potential risks associated with the change and any required approvals prior to introduction, including changes to critical suppliers, changes arising from corrective and preventive actions, changes to OEM specifications, and design changes.
The organization plans and implements the monitoring, measurement, analysis, and improvement processes needed to ensure conformity of the QMS and to continually improve its effectiveness.
A documented procedure monitors customer satisfaction, addressing customer feedback, KPIs, and other information used to determine whether customer requirements have been met. Records of customer satisfaction information are maintained.
A documented procedure defines responsibilities for planning and conducting internal audits. Planning takes into consideration the results of previous audits and the criticality of the process.
A documented procedure covers identification and use of techniques for the analysis of data. Appropriate data is determined, collected, and analyzed to demonstrate suitability and effectiveness of the QMS and to evaluate where continual improvement can be made, including data generated from monitoring and measurement and other relevant sources.
A documented procedure identifies the methods used to monitor, evaluate, and improve the effectiveness and implementation of QMS processes for the execution of the service and use of service-related product.
A documented procedure exists to correct non-conformities and to take corrective and preventive actions, both internally and within the supply chain, to eliminate the causes of non-conformities and minimize the likelihood of recurrence.
The QMS is reviewed at least annually by management to evaluate its continuing suitability, adequacy, and effectiveness, including assessing opportunities for improvement and the need for changes, the quality policy, and quality objectives. Inputs include audit results, status of RCFA and corrective/preventive actions, customer feedback, and KPIs.
Job requirements reviewed and confirmed with customer. Personnel competency reviewed and verified. Required resources identified including critical equipment and/or SRP. Required activities identified including critical phases or steps with acceptance inspections/checks. Responsible functions, departments, and persons identified. Subcontractors identified if applicable. Risk assessment performed (HSE and operational). Risk mitigation or elimination steps identified to reduce risk to lowest possible level. Contingency plans developed to address residual risk. Deliverables to customer specified. Service Quality Plan developed documenting all requirements, referencing relevant SOPs, work instructions, inspection test procedures, and acceptance criteria.
Review the Service Quality Plan and observe preparation of tools, equipment, and SRP in the workshop, noting tasks observed. Are personnel performing preparation competent in the task? Are personnel using and referencing SQPs, work instructions, and ITPs for the work? If TMMDE is used, is the equipment calibrated and used properly? Are critical job preparation tasks being supervised appropriately? Critical equipment and SRP identified and verified as suitable for use in job execution. Critical job preparation tasks reviewed and verified by a responsible and competent person not involved with performing the task. Job preparation portion of the SQP reviewed by a member of management and verified as completed properly.
Job preparation task reviewed using the criteria stated in the Service Quality Plan job preparation standards. Note observations, the name and job role of the person(s) performing the task, and the reference documents used to guide and verify the work.
Job preparation task reviewed using the criteria stated in the Service Quality Plan job preparation standards. Note observations, the name and job role of the person(s) performing the task, and the reference documents used to guide and verify the work.
Job preparation task reviewed using the criteria stated in the Service Quality Plan job preparation standards. Note observations, the name and job role of the person(s) performing the task, and the reference documents used to guide and verify the work.
Critical SRP inspected, stored, and preserved appropriately. Critical SRP inspected by competent person(s) upon receipt from vendor, using appropriate reference documents to guide the inspection. Non-conforming critical SRP segregated and stored in a manner preventing unintended use. Critical SRP stored and preserved in accordance with OEM specifications.
Where applicable, select a service supplier performing outsourced activities and verify: records of audits conducted on the vendor providing the outsourced activities meet the requirements of the primary vendor QMS standards, with the last audit not exceeding 12 months. If the supplier provides critical equipment requiring identification, traceability, and certification, verify all records and processes are completed properly. Verify all TMMDE used in the certification and verification process is properly calibrated, serial numbered, and records maintained.
Select personnel within the organization, review individual competency records, and observe a job task being performed in the shop or field. Note the employee name, job role, and competency level. Review training and competency performed: has the individual being witnessed been trained and deemed competent in the task observed? Does the individual reference the appropriate level of document while performing the task? Can the individual explain the task being performed and the relevant inspections, tests, and verifications required to certify the task as complete and equipment ready for work?
Select personnel within the organization, review individual competency records, and observe a job task being performed in the shop or field. Note the employee name, job role, and competency level. Review training and competency performed: has the individual being witnessed been trained and deemed competent in the task observed? Does the individual reference the appropriate level of document while performing the task? Can the individual explain the task being performed and the relevant inspections, tests, and verifications required to certify the task as complete and equipment ready for work?
Select personnel within the organization, review individual competency records, and observe a job task being performed in the shop or field. Note the employee name, job role, and competency level. Review training and competency performed: has the individual being witnessed been trained and deemed competent in the task observed? Does the individual reference the appropriate level of document while performing the task? Can the individual explain the task being performed and the relevant inspections, tests, and verifications required to certify the task as complete and equipment ready for work?
Select a completed job and verify: a post-job review was conducted with the team executing the work and a member of the organization management. Were any non-conforming incidents or issues identified, and if so, were they reported utilizing the process described in the QMS? Was an RCFA performed and corrective actions identified for any non-conforming products or services? Were deliverables reviewed by a competent authority prior to delivery to the customer? Were lessons learned generated and shared with the workforce and the customer?