JPR_1281.17.pdf

Johnson Space Center Procedural Requirements

JPR No.: 1281.17A

Effective Date: 11/24/2010

Expiration Date: 11/24/2025

Formerly SLP 4.17

Verify correct version before use at: https://cdms.nasa.gov/ JSC Form JF2420B (Revised January 21, 2020) (MS Word August 28, 2006)

VERIFY CORRECT VERSION BEFORE USE

Compliance Is Mandatory

JSC AUDITS

Revalidation, September 2020

Responsible Office: Safety and Mission Assurance Directorate

JSC Audits (Formerly SLP 4.17)

JPR No.: 1281.17A

Effective Date: 11/24/2010

TABLE OF CONTENTS

Preface

P.1 PURPOSE

P.2 APPLICABILITY

P.3 AUTHORITY

P.4 APPLICABLE DOCUMENTS and FORMS

P.5 MEASUREMENT VERIFICATION

P.6 CANCELLATION/RECISSION

CHAPTER 1: RESPONSIBILITIES

1.1 All Directorate Level Organization

1.2 Directorate Level Organization performing audits

1.3 Office of Primary Responsibility

1.4 Manager of the Office of Knowledge and Quality Management Systems

1.5 Audit Manager

1.6 Lead Auditor

1.7 Auditors

1.8 Escort

1.9 Technical Expert

CHAPTER 2: PROCEDURE

2.1 Prepare Individual Audit Plan

2.2 Select Auditors

2.3 Conduct Audit

2.4 Complete Audit

2.5 Audit Follow On Activities

2.6 Inputs to Management Reviews

CHAPTER 3: FLOW DIAGRAMS

CHAPTER 4: RECORDS AND FORMS

APPENDIX A – TERMS and DEFINITIONS

APPENDIX B - ACRONYMS

APPENDIX C - SLP CHANGE LOG

JPR No.: 1281.17A

Effective Date: 11/24/2010

Change History Log

Revision Date Originator Description of Changes

Baseline 3/2008 NA/Walter Marker/ 483 0117

Reformat from System Level Procedure (SLP) to JPR.

Change references from ISO 9000 Office to Management Integration Office.

Added Three Year Audit Plan, Charts and Attendance List from Opening and Closing meeting as Records.

Added signature by DLO rep on ANR for audit findings outside of interviews.

Revision A 11/2010

NA/Walter Marker/ 483 0117

Change Management Integration Office (MIO) to Office of Knowledge and Quality Management Systems (OKQMS) Update references to new numbering convention.

Include changes to audit process caused by Major Non-Conformance.

Remove requirement to report results of all audits to Office of Knowledge and Quality Management.

Page Change

8/2012 NA/Walter Marker/ 483 0117

Section 1.1.2.b - Changed calendar days for taking appropriate actions in response to audit findings from 30 calendar days to 45 calendar days.

Corrected titles of applicable documents.

Update responsible office and approval signatory.

Administrative Change 1

6/2013 NA/Walter Marker/ 483 0117

Administrative Change to update the following obsolete references:

P.4

1. Changed (k) from ANSI/ISO/ASQ Q9001:2008, Quality Management Systems, November 15, 2008 to ISO 9001.

2. Replaced AK-UWI-002, Conducting and Participating in Internal ISO 9001 and AS9100 Audits with NA-AUD-001.

https://cdms.nasa.gov/

JPR No.: 1281.17A

Effective Date: 11/24/2010

P.1.c and 4.s Replaced AK-UWI-002 with NA-AUD- 001.

Revalidation 8/2015 NA/Walter Marker/ 483 0117

Reformatted into the current JPR template JF 2420B.

P.4.g: Changed title of JWI 8553.2.

Page Change

2/2016 NA/Walter Marker/ 483 0117

P.2.a: Added General Accounting Office.

2.3.1: Added statement for Safety and Mission Assurance Audit Management Office responsibility.

Page Change

3/2017 NA/Walter Marker/ 483 0117

P1: Added (d) Purpose to include registrar audits.

P.4.h: Eliminated reference to specific edition of CMMI.

1.5.1: Added Clarification that the Audit Manager responsibilities are to maintain Internal Audit Program conformant to Standards.

Added 2.5.1 which documents appeal process for audit nonconformances

Added 2.5.3 which adds requirement to re-verify effectiveness of CAPs

Chapter 4: Updated record section with common audits retention chart

Page Change

8/2017 NA/Walter Marker/ 483 0117

Section 1.2.3 (c): added wording “and competence”

Revised 1.4, 1.5.1(a), and (b)

Added last sentence in 1.5.4

1.5.6 added wording “and the Management Representative”

Revised 1.5.7, 1.5.9, and 1.5.11

Updated Table of Contents page numbers

Page Change

10/2018 NA/Walter Marker/ 483 0117

Added paragraphs 1.5.13 to 1.5.19 to document the interactions of the Audit Manager with the Registrar auditors that

JPR No.: 1281.17A

Effective Date: 11/24/2010 are driven by new requirements from

AS9101.

Revalidation 9/2020 NA/Walter Marker 483-0117

• Changed signatory from William S.

McArthur to William R. DeLoach.

• P4 Added title for ISO9001, Corrected title for AS9100

• 1.1.2 Increased time to complete corrective action to 60 calendar days

• 1.5.4 Clarified sections of the Standards that must be covered in 3-year period

• Appendix A A10 Documents changes is usage of the word “Observation”

JPR No.: 1281.17A

Effective Date: 11/24/2010

PREFACE

P.1 PURPOSE

a. This JPR standardizes requirements for audits at JSC. The goal of this standardization is to enable leveraging of audit activities to avoid duplication whenever possible. This shall be accomplished by Establishing the requirements and procedures for organizing, planning, conducting, reporting, and managing the response to the results of first party (internal) audits at Johnson Space Center (JSC).

b. This procedure is applicable to all non-statutory audits perform by the JSC on itself (first-party audits). For the purpose of this document, audits of JSC by external entities such as registrars, NASA HQ, other governmental agencies, etc., are considered Third Party audits. (Note: This JPR does not apply to statutory audits (e.g. audits by OIG or GAO) or financial audits.) Where conflicts exist between documents, this JPR shall have primacy over all other JSC Procedure and Process documents involving non-statutory audits.

c. The following diagram shows some of the types of audits performed.

d. This JPR also specifies the processes followed and interfaces for JSC audits from registrars for ISO9001 and AS9100.

JPR 1281.17

ISO 9001

Audit

AS9100

Audit

EMS Audit

Safety Audit

CMMI

Audit

NA-AUD-001

NA-AUD-001

JWI 8553.2

JPR 1700.1

CMMI: for Development:

Guidelines for Process Integration and Product Improvement

YES

YES

YES

YES

NO

NO

NO

NO

Contractor Surveillance

Audit NT-ADM-011 or NT -AMO-001

YES

NO

YES

Party Audits

Second Party Audits

Data Input for Management Review per JPR 1280.2

First

JPR No.: 1281.17A

Effective Date: 11/24/2010

P.2 APPLICABILITY

a. This JPR is applicable to all JSC NASA organizations, including Ellington Field, and the Sonny Carter Training Facility except for the following:

(1) White Sands Test Facility

(2) Office of Inspector General

(3) General Accounting Office

(4) NASA Engineering and Safety Center

b. This language applies to contractors, grant recipients, or parties to agreements only to the extent specified or referenced in the appropriate contracts, grants, or agreements.

c. In this directive, all mandatory actions (i.e., requirements) are denoted by statements containing the term “shall.” The terms: “may” or “can” denote discretionary privilege or permission, “should” denotes a good practice and is recommended, but not required, “will” denotes expected outcome, and “are/is” denotes descriptive material.

d. In this directive, all document citations are assumed to be the latest version unless otherwise noted.

P.3 AUTHORITY

JPD 1280.1, Quality Policy

P.4 APPLICABLE DOCUMENTS and FORMS

a. JPR 1280.2, Quality Manual

b. JPR 1281.9, Process Control

c. JPR 1281.14, Corrective and Preventive Actions, and Continual Improvement

d. JPR 1700.1, JSC Safety and Health Requirements

e. JWI 8553.2, Environmental Management Systems Internal Evaluations

f. JSC Form 1300, Audit Nonconformance Record (ANR) Log

g. JSC Form 1306, Audit Nonconformance Record

h. ISO 9001, Quality Management Systems - Requirements

i. SAE AS9100, Quality Management Systems – Requirements for Aviation, Aerospace and Defense Organizations

j. CMMI for Development: Guidelines for Process Integration and Product Improvement

JPR No.: 1281.17A

Effective Date: 11/24/2010

k. NA-AUD-001, Conducting Internal ISO 9001 and AS9100 Audits

l. NT-ADM-011, Process for Contract Surveillance

m. NT-AMO- 001, Quality and Flight Equipment Audit Management Office (AMO) Audit Process

P.5 MEASUREMENT VERIFICATION

a. Processes and procedures shall be measured and monitored as prescribed by JPR 1281.9.

b. Audits, as prescribed in JPR 1281.17, shall be used to verify conformance with requirements.

c. Results shall be reviewed by Directorates and the Center as prescribed by JPR 1280.2.

P.6 CANCELLATION/RECISSION

This JPR replaces JPR 1281.17 effective November 24, 2010, which is cancelled upon issuance of this JPR.

Original Signed By:

Nigel Packham for William R. DeLoach Director, Safety and Mission Assurance

Distribution:

JDMS

JPR No.: 1281.17A

Effective Date: 11/24/2010

Expiration Date: 11/24/2015

CHAPTER 1: RESPONSIBILITIES

1.1 All Directorate Level Organization

1.1.1 Each Directorate Level Organization (DLO) appoints a Point of Contact to the Office of Knowledge and Quality Management Systems (OKQMS) who shall:

a. Notify the OKQMS when any audit (first, second or third-party audit), inspection, HQ review, environmental inspection, safety inspections, etc. is scheduled.

b. Invite the OKQMS to the in-brief and out-brief of these audits, inspections, etc.

c. Inform the OKQMS of the results of the audit (first, second, and third party), inspection, etc., along with any actions that resulted from the audit.

1.1.2 Each DLO shall ensure that:

a. During the audit, access is provided to the facilities and evidential material as requested.

b. Appropriate actions are taken in response to audit findings, as defined in JPR 1281.14, within the time period specified during the audit closing meeting, nominally 60 calendar days.

c. Their representatives attend the opening and closing meeting of Centerwide first- and third-party audits, as appropriate.

d. Follow-up activities to audit findings shall include the verifications of the effectiveness of the actions taken.

1.1.3 Each DLO shall maintain a pool of trained auditors to participate in the audit process for their self-assessments and for ISO 9001, AS9100, and EMS first-party audits.

1.1.4 If the existing pool of auditors is determined by the JSC Audit Manager to be too small to support the Centerwide internal audit program, the DLO shall train auditors in response to requests from Manager OKQMS to contribute a specified percentage of their civil service workforce as auditors.

1.1.5 Each DLO shall provide resources to work with teams established by the Quality System Panel (QSP) to resolve actions resulting from audits.

1.1.6 Each DLO shall provide an escort for auditors, when requested. For ISO 9001 and AS9100 audits, this escort shall be the DLO Corrective Action Manager, or designee.

1.2 Directorate Level Organization performing audits

1.2.1 All organizations at JSC performing first or second-party audits shall have a documented procedure that specifies:

a. Responsibilities and requirements for planning and conducting the audit.

b. How results of the audit are reported, including the mechanism by which audit results are used as inputs to management reviews.

JPR No.: 1281.17A

Effective Date: 11/24/2010

c. How records for audits will be maintained.

d. The criteria, scope, frequency of audits, and methods of auditing.

1.2.2 Organizations shall develop their own procedures or adopt the procedures of the OKQMS. The criteria for determining the type of an audit are specified in the Purpose section of this JPR.

1.2.3 All organizations at JSC performing first or second-party audits shall ensure that:

a. The audits are planned to take into consideration the status and importance of the process and the area to be audited, as well as results of previous audits.

b. The objectivity of audits and impartiality of the audit process is maintained by their selection of auditors and by the conduct of their audits. In particular, auditors will not audit their own work.

c. The auditors from their organization satisfy the training, certification and competence requirements for the standard to which they are auditing.

d. Detailed tools and techniques are developed, as appropriate, for the standard being audited. Such tools as checklists, process flow charts or similar tools will be maintained as part of the records of the audit. The acceptability of the selected tools will be measured against effectiveness of the internal audit process and the overall organization effectiveness.

e. Appropriate actions are taken in response to audit findings, as defined in JPR 1281.14, without undue delay to eliminate any detected nonconformance and their causes.

1.2.4 All organizations performing first party audits shall submit the results of their audits, along with any actions that resulted from the audit, to the Audit Manager so that the results can be included in the planning of audits by the OKQMS.

1.3 Office of Primary Responsibility

The OKQMS shall be the Office of Primary Responsibility for:

a. Organizing, planning, conducting, reporting to upper management and responding to first party (internal) ISO 9001 and AS9100 audits.

b. Reporting to upper management and managing Centerwide response to third-party (external) ISO 9001 and AS9100 audits.

1.4 Manager of the Office of Knowledge and Quality Management Systems

The manager of the OKQMS shall be responsible for appointing the Centerwide Audit Manager and the Centerwide Corrective Action Manager.

JPR No.: 1281.17A

Effective Date: 11/24/2010

1.5 Audit Manager

1.5.1 The Audit Manager (AM) has responsibility for all ISO 9001 and AS9100 audits conducted by the OKQMS and for interfacing with the External Auditors for maintaining Certification of the Internal Audit Program to these Standards. The AM shall:

a. Plan, establish, implement and maintain an audit program for ISO9001 and AS9100 including frequency, methods, responsibilities, planning requirements, and reporting which shall take into consideration the importance of the process concerned, changes affecting the organization and the results of previous audits.

b. Ensure that audits conducted by the OKQMS For ISO9001 and AS9100 shall verify that the quality management system conforms to

(1) JSC’s requirement documents,

(2) The requirements of ISO9001 and AS9100,

(3) All statutory and regulatory requirements, and

(4) Is effectively implemented and maintained. (Performance indicators can be evaluated to determine if the Quality management System is effectively implemented and maintained.)

1.5.2 The AM shall schedule Internal ISO 9001 and AS9100 audits on the basis of the status and importance of the activity being audited and on the results of previous audits.

1.5.3 The AM shall include the results of all DLO conducted self-initiated assessments or audits (Section 1.2) in planning the coverage of OKQMS Centerwide ISO 9001 and AS 9100 audits provided that:

a. The DLO audits and auditors satisfy all requirements for Centerwide ISO 9001 and AS9100 audits specified in this JPR.

b. A written audit plan has been submitted to the OKQMS that specifies the criteria, scope, and methodology of the audit.

c. Appropriate actions are taken in response to audit findings, as defined in JPR 1281.14, without undue delay to eliminate detected nonconformances and their causes.

Note: The goal of this section is to avoid duplication of audit activity. If a DLO has conducted a self-initiated audit that satisfies all the requirements of the JPR, the results of this audit may be accepted by the AM and incorporated into the Centerwide audit coverage that is required by the standard. No additional audits of the area audited by the DLO along the same line of inquiry would be required.

1.5.4 The AM shall maintain a schedule for each overall audit cycle. This schedule will be updated in response to the result of audits and other incidents. In all cases, the schedule for first party (internal) audits will cover all aspects of an audited standard at least at the frequency specified in the standard. For ISO 9001 and AS9100, this requires coverage of all major sections of the standard every 3 years. However, this schedule will be reset when a Recertification to an update of AS9100 occurs.

JPR No.: 1281.17A

Effective Date: 11/24/2010

1.5.5 The AM shall verify the flow-down of requirements from this JPR to procedures in the OKQMS work instructions. This work instruction will specify the audit criteria, scope, and methods as well as all detailed tools and techniques that are developed, including checklists, process flow charts or any similar method to support audit of the procedural requirements.

1.5.6 The AM shall evaluate the acceptability of the selected tools by measuring the effectiveness of the internal audit process against overall organization performance. The results of this evaluation shall be reported to the Manager of the OKQMS and the Management Representative.

1.5.7 The AM shall ensure that audits conducted by OKQMS are carried out by personnel having satisfied the appropriate training and competence requirements, as specified by the appropriate standard, and ensure objectivity and impartiality by selecting auditors independent of those having direct responsibility for the activity being audited. In particular, auditors may not audit their own work or any work within their Division.

1.5.8 In the case of follow-the-trail audits, if an auditor follows a trail into an area in which they do not have this independence, (interpreted as their own Division), the AM shall appoint another auditor to perform this part of the audit to ensure objectivity and impartiality of the audit process.

1.5.9 The AM shall ensure that for ISO 9001 and AS9100 audits:

a. Documented information of the implementation of the audit program be maintained as records specified in Chapter 4 of this document.

b. Audit nonconformances are submitted to the Quality Process Improvement Database

(QPID).

c. The actions taken follow the procedures specified in JPR1281.14.

d. Personnel who are assigned responsibility for the corrective actions take timely corrective action. In particular, the corrective and preventive action plans are submitted during the time period specified in JPR1281.14, Appendix B. Waivers to the specified time may be granted by the AM or Centerwide Corrective Action Manager, with the concurrence of the Management Representative. The AM shall report any failure of an organization to take timely corrective action to the Management Representative.

e. The corrective and preventive actions taken are tracked through closure.

f. The status, performance, and results of the audit are reviewed by the organization (per JPR 1280.2) and reported to the Management Representative.

1.5.10 The AM shall lead follow-up audit activities that verify the implementation and effectiveness of the corrective action plan. However, verification of the effectiveness of corrective actions may be delegated.

JPR No.: 1281.17A

Effective Date: 11/24/2010

1.5.11 The AM shall report the results of all Audits to the Management Representative, the Quality System Panel, Manager of the OKQMS and to other forums that the Management Representative or Manager of OKQMS designates.

1.5.12 The AM may appoint a lead auditor for each audit or may serve as the lead auditor.

1.5.13 The AM shall serve as liaison for Registrar audits of Johnson Space Center for ISO9001 and AS9100 Certification.

1.5.14 The AM shall work with the Registrar Lead Auditor to develop the audit plan for each audit.

1.5.15 The AM shall schedule audits of JSC personnel in response to the audit plan of the Registrar auditors.

1.5.16 The AM shall provide escorts for the Registrar Auditors.

1.5.17 The AM or JSC Center wide Corrective Action Manager shall enter any non-conformances resulting from Registrar audits of AS9100 into the IAQG (International Aerospace Quality Group) OASIS database.

1.5.18 The AM or JSC Center wide Corrective Action Manager shall enter information in each step of IAGQ AS9101 Form 4, as the Corrective Action is completed by the responsible JSC organization.

1.5.19 The AM or JSC Center wide Corrective Action Manager shall submit completed Non- Conformance Corrective Actions (IAQG AS9101 Form 4) for Closure by entering the name of the organization Representative and date on IAQG AS9101 Form 4.

1.6 Lead Auditor

The Lead Auditor (LA) is responsible for a specific audit. The LA has authority to make decisions regarding the conduct of the audit and any audit findings. In the case of disputes, the decisions of the LA can be appealed to the AM for final resolution. The LA shall be assigned to the audit task for the duration of the audit and related activities. The Audit Manager may serve as Lead Auditor.

1.7 Auditors

1.7.1 Auditors conduct the audit under the supervision of the LA. An auditor conducts an audit interview to sample conformance and identify any nonconformances. Each auditor shall discuss all nonconforming conditions and observations with the appropriate escort (Section 1.8). Following this discussion, the auditor will obtain the signature/initials of the escort on the Audit Nonconformance Record (ANR) form (JSC Form 1306). This signature represents objective evidence that this discussion has taken place. It does not represent an evaluation of the validity of the finding.

1.7.2 At the conclusion of the audit, each auditor shall prepare an individual audit report and send it in a timely manner to the AM.

1.7.3 Each individual audit report shall specify the details of the audit they performed including:

JPR No.: 1281.17A

Effective Date: 11/24/2010

a. The location of the audit.

b. The DLO audited.

c. The individual audited and their position within the DLO. (Note: the AM will remove any references to specific individuals in the Audit Final report).

d. The line of inquiry used which includes specifying the standard audited to (ISO 9001 or

AS9100).

e. Any tools used such as checklist, questionnaires, etc.

f. Any Non-conformances or Observations that resulted from the audit.

1.8 Escort

1.8.1 The organization being audited is responsible for providing an escort(s). For ISO 9001 and AS9100 audits, the escort shall be the DLO Corrective Action Manager, or their designee. The escort accompanies the auditor(s) during the audit and shall:

a. Provide access to the organization personnel, data records, and physical areas.

b. Interpret the audited organization’s documents (if required).

c. Interface with other audited organization personnel.

d. Be a witness to any findings.

1.8.2 If any findings are identified during the audit interview, the escort is responsible for signing the ANR to acknowledge that the written details of the finding are accurate. This signature represents objective evidence that this discussion has taken place. It does not represent an evaluation of the validity of the finding. The escort shall not make an assessment on the validity of the finding. Additionally, the escort should not be an active participant in the audit interview nor interfere with the audit interview unless there is indication that some minor clarification will advance the progress of the audit. If any findings are identified outside of an audit interview (e.g. a document review), a DLO representative may sign the ANR as the escort.

1.9 Technical Expert

The AM or LA may designate technical experts to assist the audit team when specific specialized knowledge in some aspect of an audit is required. Technical experts act as advisors to auditors and need not be qualified auditors themselves. However, technical experts who are not qualified auditors shall not generate audit findings.

JPR No.: 1281.17A

Effective Date: 11/24/2010

CHAPTER 2: PROCEDURE

2.1 Prepare Individual Audit Plan

All JSC first party (internal) audits shall have a written audit plan. This plan will define the audit criteria, scope, and method and the approximate dates of the audit. The results of previous audits will be considered in developing the audit plan. A copy of any checklists used in the audit will be contained in the audit plan. The audit plan represents the starting point for the audit. However, auditors may still generate findings outside the scope of the audit plan if they come across any nonconformance or observations while conducting the audit.

2.2 Select Auditors

2.2.1 Auditors for all JSC first-party audits shall be selected to be independent of the area they are auditing.

2.2.2 Auditors shall satisfy the criteria for auditors of the standard they are auditing. The requirement for additional training for the planned audit will be assessed considering the auditor’s background and experience.

2.3 Conduct Audit

2.3.1 All JSC first party (internal) audits shall begin with an opening meeting and conclude with a closing meeting. Attendance at these meetings aligns with the scope of the audit.

Meetings for ISO 9001 and AS9100 are usually held as part of the QSP. Additional members from the QSP are encouraged to attend these meetings. However, a formal quorum of the QSP is not required for these meetings to be conducted. Daily debriefs, that summarize the results of auditing for that day, are recommended, but not required. Alternatively, the summary of the audits may be posted on a webpage. If the audit plan involves JSC offsite contractors or if “follow-the-trail” activities leads to an offsite contractor, the Audit Manager shall contact the Safety and Mission Assurance, Audit Management Office (AMO), and co-ordinate any audit of the contractor facilities for which the AMO has audit responsibility.

2.3.2 The Opening Meeting shall specify:

a. The Scope of the audit.

b. The Criteria of the audit.

c. Organizations or positions scheduled to be audited.

d. The schedule for the audit.

e. The auditors for the audit.

2.3.3 The Closing meeting shall specify:

a. All findings from the audit (both nonconformances and observations), summarized on JSC Form 1300.

b. The tracking system (per JPR 1281.14) that findings from the audit have been entered into.

JPR No.: 1281.17A

Effective Date: 11/24/2010

c. The time period within which Corrective Action Plans (CAPs) must be submitted.

2.4 Complete Audit

The AM shall ensure that for audits conducted by OKQMS that:

a. Individual written audit reports are received from auditors which specify the organization audited, the location of the audit, the individual audited and their position within the organization, the Line of Inquiry of the audit and any Non-conformances or Observations.

b. A final report of the audit is completed and distributed to the client of the audit and to the distribution list specified by the client of the audit.

c. All records from the audit are filed appropriately. (Note: Retention and filing location of the records are specified in the document that specifies each specific type of audit.)

2.5 Audit Follow on Activities

2.5.1 Process for Challenging Audit Nonconformances

The following process shall be followed if a Directorate wishes to challenge an Audit Non-conformance from an ISO9001 or AS9100 Registrar audit.

a. The Directorate shall notify in writing (email acceptable) the JSC Audit Manager of their intent to protest the audit non-conformance within 4 calendar days of the Closing Meeting.

b. The Audit Manager shall notify the JSC Associate Director of the intent of the Directorate to protest the audit nonconformance.

c. A meeting will be held between the JSC Associate Director, the JSC Audit Manager, the Manager of the Office of Knowledge and Quality Management and representatives from the protesting Directorate. Representatives from the protesting Directorate will present the basis for their protest within 14 calendar days of the Closing Meeting. The JSC Audit Manager will present any insight which was obtained from having accompanied the Registrar auditor during the audit.

d. The JSC Associate Director shall determine the validity of the protest.

e. Protests that have been deemed to be valid shall result in a memo from the JSC Associate Director to the Registrar for the applicable Standard (prior to 20 calendar days from the Closing Meeting) which:

(1) Identifies the specific audit non-conformance being protested;

(2) States the specific basis for the protest;

(3) Provides additional Objective Evidence supporting the protest.

2.5.2 The Center-wide Corrective Action Manager shall ensure that for audits performed or reported to the OKQMS that:

a. CAPs have been entered into the appropriate tracking system in the time frame specified at the closing meeting.

b. CAPs have been completed on the schedule specified in the CA/PA plan.

JPR No.: 1281.17A

Effective Date: 11/24/2010

c. All aspects of the CAP have been completed.

d. The completed CAP has been effectively implemented.

2.5.3 Verification of Effectiveness of CAPs

The JSC Audit Manager and/or the JSC Corrective Action Manager shall verify the continued effectiveness of Corrective Action Plans by re-auditing the CAPs either as part of Internal Audits or as individual CAP verification activity. This will be done approximately 6 months after CAP closure or when circumstances suggest revisit is appropriate.

2.6 Inputs to Management Reviews

2.6.1 The DLO Corrective Action Manager shall ensure that the results of audits have been included in their management reviews per JPR 1280.2.

2.6.2 The Center-wide Corrective Action Manager shall ensure that the results of audits have been included in the Quality Systems Management Review.

JPR No.: 1281.17A

Effective Date: 11/24/2010

CHAPTER 3: FLOW DIAGRAMS

Detailed flow diagrams on conducting a specific type of audit are provided in the work instruction for that type of audit. All first party (internal) audits shall follow the flow shown below.

Prepare Individual Audit

Plan

Select and Train Auditors

Conduct Audit

Complete Audit Report and enter findings into CA/PA system

Audit Follow up Activity

Input to Management Review per

JPR 1280.2

JPR No.: 1281.17A

Effective Date: 11/24/2010

CHAPTER 4: RECORDS AND FORMS

Records and forms produced by each type of audit shall be specified in the document that specifies how that particular type of audit is conducted.

a. For ISO9001 and AS9100 audits, these records are specified in NA-AUD-001.

b. For contract surveillance audits, these records are specified in NT-ADM-011 or NT-

AMO-001.

c. For environmental audits, these records are specified in JWI 8553.2

Common audit records shall be retained as specified, in accordance with JPR 1440.3:

Record Who Maintains Retention Schedule

4.1 Audit report products

including attachments that document reportable Program/Project non-conforming flight hardware findings, actions including support analyses, oversight, CA/PA/CI performance metrics.

Support files of additional analyses related to QPIDs not included as attachments

JSC Corrective Action Manager; Office of Knowledge and Quality Management Systems

DLO CAM

8/114 – Permanent. Cut off records at close of last applicable program/project or in 3-year blocks for long term programs/projects. Transfer to records center storage.

Transfer to National Archives 7 years after cutoff.

8/107 – temporary.

Destroy/delete between 0 and 30 years after program/project termination

4.2 Audit report products

including attachments relating to the status, external / third party audit communications and overall effectiveness of the Management Systems, at the NASA installations.

JSC Corrective Action Manager; Office of Knowledge and Quality Management Systems

1/26.5A – Temporary. Destroy when 7 years old.

4.3 Products relating to the

internal status and improvement of the management and CA/PA/CI/ activities, performance metrics at the NASA installations.

JSC Corrective Action Manager; Office of Knowledge and Quality Management Systems

1/26.5B Destroy when 5 years old.

JPR No.: 1281.17A

Effective Date: 11/24/2010

APPENDIX A – TERMS and DEFINITIONS

A.1 Audit is a systematic, independent, and documented process for objectively obtaining and evaluating evidence to determine whether an organization is conforming to requirements.

A.2 Audit cycle is the time period specified in the standard, nominally three years, during which:

a. The entire organization must be audited.

b. All sections of the standard must be audited.

A.3 Auditee is individual being interviewed during the audit.

A.4 Combined audit is when an organization is being audited by one audit team for more than one type of audit. For example, combining a quality system audit and an environmental management system audit into one audit.

A.5 First-party audit, also known as internal audit, is an audit that is conducted by, or on behalf of, the organization itself for management review and other internal purposes, and may form the basis for an organization’s self-declaration of conformity to a standard.

A.6 Independence of auditors means that the auditors have no direct relationship with the organization being audited. To ensure independence of auditors, auditors shall not audit their own organization. At JSC, this means within their own division. In the case of a follow-the-trail audit that leads an auditor back to their own division, the audit manager shall appoint another auditor to follow this portion of the trail.

A.7 Joint audit is when two or more auditing organizations cooperate to audit jointly a single auditee. For example, if two organizations were to both do an ISO 9001 audit on a given DLO.

A.8 Nonconformance is non-fulfillment of a specified requirement.

A.9 Objective evidence is information which can be proved true, based on facts obtained through observation, measurement, test, or other means.

A.10 ISO19011, Guidelines for Auditing Management Systems, has dropped using the word “Observation” and now uses the phrase “audit evidence”. In the past, Observation was used to describe a condition for which no objective evidence of a nonconformance has been found but which, in the opinion of the auditor, either:

a. Deviates from accepted practices.

b. Warrants clarification. Clarification may be desired because the auditor believes further investigation would discover objective evidence of a nonconformance. This condition usually occurs for items uncovered when insufficient time remains for a full discovery process to be performed. While the Centerwide tracking system QPID maintains

JPR No.: 1281.17A

Effective Date: 11/24/2010 a state call “Observation”, this type of audit finding is no longer used at JSC for ISO9001 and AS9100 audits.

A.11 Statutory audit is an audit that is required by federal statue (i.e., law). Examples are Government Accountability Office (GAO), Inspector General (IG), etc.

A.12 Second-party audit is an audit conducted by JSC (or by other persons on behalf of JSC) on its contractors or suppliers.

A.13 Self-assessment is when an organization assesses itself for conformance with a standard outside of the required first-party audit program.

A.14 Third-party audit, also known as external audit, is an audit conducted by an independent organization external to JSC. External organizations could be registrars, NASA HQ, other governmental bodies and state regulatory boards. Often this independent organization is accredited by a registrar to provide certification of conformity with requirements of a standard, such as ISO 9001 or AS9100.

JPR No.: 1281.17A

Effective Date: 11/24/2010

APPENDIX B - ACRONYMS

ALR – Audit Liaison Representative

AM – Audit Manger

ANR – Audit Nonconformance Record (JSC Form 1306)

CAP – Corrective Action Plan

DLO – Directorate Level Organization

EMS – Environmental Management System

GAO – Government Accounting Office

IG – Inspector General

JPR - Johnson Space Center Procedural Requirements

LA – Lead Auditor

OKQMS - Office of Knowledge and Quality Management Systems

QSP – Quality Systems Panel

JPR No.: 1281.17A

Effective Date: 11/24/2010

APPENDIX C - SLP CHANGE LOG

(This Appendix preserves the change log of the previous, SLP, version of this document)

Revision Effective Date Description of Changes

Basic 03/06/97 Initial Release as SLP

A 06/23/97 Initial Release

5.3.1 & 5.3.2, Delete.

5.4 Change “Observed concern” to “Observation”.

6.1, change to read, “… within the MANAGEMENT INTEGRATION Office.”

7.1.1, last sentence, should read “audited” vs.

“auditing”.

7.2.1 & 7.2.7, change last sentence to read, “Attendees will include the lead auditor and audited area’s management, and may also include the internal audit team and escort personnel, as determined appropriate by the lead auditor and audited area’s management.”

7.2.4 Delete “see Attachment 2,” Delete Attachment 2

7.2.5 Delete last sentence.

B 06/01/98 Para. 1 - Clarify purpose of the SLP.

Para 3 - Reference AQ-UWI-001 as the procedure which governs how the audit team conducts internal audits.

Para 5 - Add CAP to list

Para 6.3 - Reorganize responsibilities of Audit Manager. Move responsibilities from Procedure to appropriate area. Add reference to auditor selection criteria.

Para. 6.5 - Move responsibilities for discussion with the escort from procedure to this section.

Para. 6.7 - Document Organizational responsibilities for responses to audit findings.

Para 7.1 - Deleted: Redundant to AQ-CWI-001.

JPR No.: 1281.17A

Effective Date: 11/24/2010

Para 8 - Clarify that the flow-chart is for information only.

C 4/1/99 Editorial clarifications

Attachment 1: add information on OJT requirements

D 6/1/99 Modifications to reflect 18 month audit cycle.

Addition of definition and responsibilities for FOCUS

LEAD

E 4/15/06 Add requirements for AS9100

Broaden scope to define responsibilities for all audits

Remove concept of FOCUS LEAD