ISO 9001 AND AS9100. Quality Management System Manual

Transcription

1 Quality Management System Manual CONTROLLED COPY For a certified copy of this controlled document, contact iso@craigtechinc.com. Updated 4/10/16 Certified By ISO 9001 AND AS9100 Craig Technologies

2 Quality Manual Quality Management System Manual 8550 Astronaut Blvd. Cape Canaveral, FL

3 Introduction Craig Technologies was founded in 1999 with the objective of providing quality software solutions and related computer services to the Department of Defense and commercial businesses. The company is developing and implementing a Quality Management System in order to document the company s best business practices, better satisfy the requirements and expectations of its customers, and improve the overall management of the company. The Quality Management System of Craig Technologies meets the requirements of the International Organization of Standardization. This system addresses the design, development, production, installation, and servicing of the company s products and services. The manual is divided into eight sections that correlate to the Quality Management System sections of. Each section begins with a policy statement expressing the Craig Technologies obligation to implement the basic requirements of the referenced Quality Management System section. Each policy statement is followed by specific information pertaining to the procedures that describe the methods used to implement the necessary requirements. This manual describes the Quality Management System and delineates authorities, interrelationships, and responsibilities of the personnel responsible for performing within the system. The manual also provides procedures or references for all activities comprised in the Quality Management System to ensure compliance with the necessary requirements of the standard. This manual is used internally to guide the company s employees through the various requirements of the ISO/AS standards that must be met and maintained in order to ensure customer satisfaction and continual improvement and to provide the necessary instructions that create an empowered work force. This manual is used externally to introduce our Quality Management System to our customers and other external organizations or individuals. The manual is used to familiarize them with the controls that have been implemented and to assure them that the integrity of the Quality Management System is maintained and focused on customer satisfaction and continual improvement. Chief Executive Officer 3

4 Quality Policy Craig Technologies is committed to providing the highest quality products and services that meet or exceed the requirements and expectations of our customers. We will actively pursue opportunities for continual improvement of service quality. Chief Executive Officer The CEO of Craig Technologies has formulated the quality policy. The policy is explained and discussed at the general orientation training given to all new employees and has been reviewed with all current employees. All employees are expected to know what the quality policy means to them as it affects their job or position within the company. The policy is posted in prominent locations throughout the facility. 4

5 Quality Manual Distribution A controlled electronic copy of the Quality Manual is notated CONTROLLED COPY in red ink on the cover page and is located on the corporate SharePoint site and is password protected. All other electronic and printed copies of this document are copies of a controlled document and must be certified before use. 5

6 Contents Quality Manual Distribution Scope General Corporate Overview Introduction Application Regulation Control Distribution Revisions Section 2: Normative Reference Quality Management System References Section 3: Terms and Definitions Quality Management System Definitions Section 4: Quality Management System Quality Management System General Requirements Documentation Requirements General Quality Manual Control of Documents Control of Quality Records Related Procedures and Documents Management Responsibility Management Commitment Customer Focus Quality Policy Planning Quality Objectives Quality Management System Planning Responsibility, Authority, and Communication Responsibility and Authority QMS Management Representative Internal Communication Organizational Structure... Error! Bookmark not defined. 5.6 Management Review General Review Input Review Output Related Procedures: Resource Management

7 Craig Technologies Quality Manual 6.1 Provision of Resources Human Resources General Competence, Awareness, and Training Infrastructure Work Environment Related Documents Product Realization Planning of Product Realization Project Management Risk Management Configuration Management Control of Work Transfers Customer-Related Processes Determination of Requirements Related to the Product Review of Requirements Related to the Product Customer Communication Design and Development Design and Development Planning Design and Development Inputs Design and Development Outputs Design and Development Review Design and Development Verification Design and Development Validation Design and Development Verification and Validation Testing Design and Development Verification and Validation Documentation Control of Design and Development Changes Purchasing Purchasing Process Purchasing Information Verification of Purchased Product Production and Service Provision Control of Production and Service Provision Production Process Verification Control of Production Process Changes Control of Production Equipment, Tools and Software Programs Post-Delivery Support Validation of Processes for Production and Service Provision

8 Craig Technologies Quality Manual Identification and Traceability Customer Property Preservation of Product Control of Monitoring and Measuring Devices Related Documents Measurement, Analysis, and Improvement General Monitoring and Measurement Customer Satisfaction Internal Audit Monitoring and Measurement of Processes Monitoring and Measurement of Product Control of Nonconforming Product Analysis of Data Improvement Continual Improvement Corrective Action Preventive Action Related Documents

9 Craig Technologies Quality Manual Section 1: Scope 9

10 1. Scope 1.1. General This Quality Manual addresses the requirements of the International Organization of Standardization ISO 9001 Standard and the SAE Aerospace Standard AS9100. The Quality Manual defines the Quality Management System (QMS) as it applies to Craig Technologies locations in Cape Canaveral, FL along with various on-site and remote locations. The QMS addresses the design, development, production, implementation, maintenance, and support of software for Craig Technologies based on specific customer requirements and the provision of quality software solutions and related Information Technology (IT) services to the Department of Defense (DoD) and commercial businesses. The Software Certificate oversees the Software Development, as well as activities associated with the provision of full-life cycle systems development, systems engineering, requirements analysis, training, modeling and simulation, software engineering, and IT support services. The QMS also addresses the Aerospace & Defense Manufacturing Center (ADMC), which handles the manufacture and assembly of precision components. Equipment that is not activated and does not contribute to the manufacturing and assembly is not within the scope of the AS certificate Corporate Overview Craig Technologies was formed in 1999 under the laws of the State of Delaware and maintains its headquarters at 8550 Astronaut Blvd, Cape Canaveral, FL. Craig Technologies provides engineering, IT, and technical support services including project management, systems engineering, infrastructure installation, software development, Research and Development (R&D), Modeling and Simulation (M&S), training, and many other custom IT services. Serving defense, government, aerospace, and corporate organizations for over 12 years, our services offer our customers quality solutions and a cost-effective price Introduction This manual contains three introductory sections numbered 1 to 3, and five process definition sections numbered 4 to 8. All eight sections correspond to the Standard. Supporting documentation is identified and referenced within the corresponding section of this manual. Unless otherwise defined, the definition of terms used within this manual are described in the Standard. Other definitions are contained within the Terms and Definitions section of this manual Application The Craig Technologies ADMC claims exclusion for Clause 7.3. The justification for this exclusion is 10

11 that the ADMC does not perform any product design. Craig Technologies Headquarters claims exclusion for Clauses 7.1.4, 7.5.1, , , , , 7.5.2, 7.5.5, and 7.6. The justification for these exclusions is that the Craig Technologies Headquarters not perform any production operations for hardware and there are no products for preservation. As such, no calibration is required and inspection, measuring, and test equipment is not utilized. No work transfers are used to meet customer requirements Regulation Control Any changes and/or distribution of this Quality Manual are controlled and approved by the CEO and the QMS Management Representative Distribution Distribution is addressed on page 4, Quality Manual Distribution, of this Manual. This Quality Manual has two options for distribution as stated below: [ X ] This manual is provided under controlled distribution. A Part Number and Revision Level have been assigned and controlled updates are provided as they occur. [ ] This manual is not on a controlled distribution and is not updated as changes occur Revisions Requests for changes to this Quality Manual may be submitted by any employee of Craig Technologies. Each Request for Change must be submitted to the QMS Management Representative of Craig Technologies. Revisions to the Quality Manual are at the discretion of the CEO and QMS Management Representative. 11

12 Section 2: Normative Reference 12

13 2. Quality Management System References The following documents were used as reference during the preparation of the QMS: American National Standard ANSI/AS 9001/ASQ Q , Quality Management Systems - Vocabulary American National Standard ANSI/AS 9001/ASQ Q , Quality Management Systems Requirements American National Standard ANSI/AS9001/ASQ Q , Quality Management Systems Guidelines for performance Improvements Society of Automotive Engineers SAE AS9100 Rev C (2009) - Quality Management Systems Requirements Society of Automotive Engineers SAE AS9101 Rev D (2010) - Quality Management Systems Audit Requirements for Aviation, Space and Defense Organizations 13

14 Section 3: Terms and Definitions 14

15 3. Quality Management System Definitions This section is for definitions unique to Craig Technologies. Customer-owned property Any type of equipment, accessories, or manuals that are owned and controlled by a customer Customer-supplied product Any type of service or material supplied to be utilized in the manufacture, modification, or repair of customer-owned property Product The end-item result of meeting all contractual terms and conditions. (e.g. Software) Service The end-item result of meeting all contractual terms and conditions (e.g. nonpersonal support services) Quality Records Documentation or records which provide evidence of conformity to QMS procedural requirements. 15

16 Section 4: Quality Management System 16

17 4. Quality Management System 4.1 General Requirements Craig Technologies has established, documented, and implemented a QMS in accordance with the requirements of. The system is maintained and continually improved through the use of the quality policy, quality objectives, audit results, analysis of data, corrective and preventive action, and management review. Craig Technologies' quality management system also addresses customer and applicable statutory and regulatory quality management system requirements. To design and implement the QMS, Craig Technologies has: Determined the processes needed for the QMS and their application throughout the organization according to the ISO/AS Process-Based Model (Figure 1) and documented the processes in the A Key Processes Flow Diagram (Figure 2) Determined the sequence and interaction of these processes according to the ISO/AS Process-Based Model (Figure 1) and documented the processes in the A Craig Technologies Key Processes Flow Diagram (Figure 2) and A ADMC Key Processes Flow Diagram (Figure 3) Determined criteria and methods needed to ensure both the operation and control of the processes are effective according to the ISO Process-Based Model (Figure 1) and referenced these criteria and methods in quality plans, procedures, work instructions and records, and the Measuring, Monitoring and Analysis Table (F ) Ensured the continuing availability of resources and information necessary to support the operation and monitoring of these processes Monitored, measured where applicable, and analyzed these processes Implemented actions necessary to achieve planned results and continual improvement of these processes. Figure 1 ISO Process-Based Model 17

18 Figure 2 Craig Technologies Key Processes Flow Diagram (A ) Figure 3 ADMC Key Processes Flow Diagram (A ) 18

19 4.2 Documentation Requirements General The QMS documentation includes: Documented Quality Policy and Quality Objectives (Section 5.4.1) This Quality Management System Manual Documented Procedures and Forms required by Documents determined to be necessary to ensure the effective planning, operation, and control of our processes including Records. A documentation system has been established by Craig Technologies consisting of the Quality Manual, supporting documentation, and records that are required to support effective planning, operation, and control of the organization s processes. The Craig Technologies QMS Manual has been reviewed by management and is approved by the CEO as indicated by her signature affixed to this manual. A quality policy has been created to lead the organization toward continual improvement of its performance. The quality policy is continually reviewed at Management Review meetings for its continuing suitability (Reference Section 5.3, Quality Policy). Craig Technologies top management establishes corporate quality objectives in line with the strategy of the company. Corporate quality objectives are measurable and consistent with the corporate Quality Policy. Additional Quality Objectives are established at relevant levels within the company (Reference Section 5.4, Planning). The QMS is comprised of five levels of documentation that are organized hierarchically to include the Quality Manual, Procedures, Processes, Work Instructions, and Quality System Forms and Databases (records) as shown in Figure 4. Craig Technologies ensures that personnel have access to, and are aware of, relevant quality management system (QMS) documentation and changes. 19

20 Figure Quality Manual This Quality Manual has been prepared to describe the Craig Technologies QMS and defines the eight requirements of the standard as it pertains to Craig Technologies. The scope and permissible exclusions of the QMS are described in Section 1. of this manual. Each section of the manual references documented QMS procedures relating to the requirements outlined in that Section Control of Documents All QMS documents are controlled according to the Document Control Procedure (P-423). This procedure defines the process for: Approving documents for adequacy prior to issue Reviewing, updating, and re-approving documents as necessary Ensuring that changes and current revision status of documents are identified Ensuring that relevant versions of applicable documents are available at points of use Ensuring that documents remain legible, readily identifiable, and retrievable Ensuring that external origin documents are identified and their distribution controlled Preventing the unintended use of obsolete documents and applying suitable identification to them if they are retained for any purpose. 20

21 Note: Any typographical errors and minor editorial changes are not considered as a document revision for the purpose of this quality manual Control of Quality Records Quality records are maintained to provide evidence of conformity to requirements and of the effective operation of the QMS. The records are maintained according to the Control of Quality Records Procedure (P-424). This procedure requires that quality records remain legible, readily identifiable, and retrievable. The procedure defines the controls needed for identification, storage, protection, retrieval, retention, and disposition of quality records. The procedure also defines the method for controlling records that are created by and/or retained by suppliers Related Procedures and Documents Document Control P-423 Control of Quality Records P

22 Section 5: Management Responsibility 22

23 5. Management Responsibility 5.1 Management Commitment The Craig Technologies CEO has been actively involved in implementing the QMS. She has provided the vision and strategic direction for the growth of the QMS and established quality objectives and the quality policy. To continue to provide leadership and show commitment to the improvement of the QMS, the CEO will: Communicate the importance of meeting customer, statutory, and regulatory requirements Establish quality objectives Establish the quality policy Conduct management reviews Ensure the availability of resources. 5.2 Customer Focus Craig Technologies strives to identify current and future customer needs and to not only meet but to exceed customer requirements and expectations. Top management also ensures that product/service conformity and on-time delivery performance are measured and that appropriate action is taken if planned results are not, or will not be, achieved. The CEO ensures that customer requirements are understood and met by requiring compliance with documented customer communication procedures. Customer requirements are determined and converted into internal requirements and communicated to the appropriate people in our organization (Customer Related Processes, P-720). 5.3 Quality Policy The CEO ensures that the Quality Policy is communicated to all employees. It is included in new employee training and QMS training. It is posted in prominent places throughout our facilities to maintain high standards within our organization. Training is performed using the on-line training module at Acknowledgement of completed training is to be submitted by employees to the People Department for upload to the Training Database. Management reviews the Quality Policy at each Management Review to determine the policy s continuing suitability for our organization. The Quality Policy is documented on page Planning Quality Objectives Quality objectives are established to support our organization s efforts in achieving our Quality Policy and all are reviewed annually for suitability. Quality objectives are measurable 23

24 and reviewed against performance goals at each Management Review meeting. Quality Objectives are as follows: Provide exceptional Human Resources services that support operations and promote employee satisfaction. Ensure customer satisfaction through continual customer feedback. Deliver quality products on time and in accordance with customer requirements. Maintain an IT infrastructure that provides minimal system downtime and supports operations in a 24/7 environment. Require superior performance by suppliers and subcontractors. Continually improve the Quality Management System Quality Management System Planning The QMS has been planned and implemented to meet our quality objectives and the requirements of 4.1 of the Standard. Quality planning takes place as changes that affect the QMS are planned and implemented. The Craig Technologies QMS planning is within the framework of Management Review meetings. Data presented at the Management Review meetings is used to provide input for quality planning and continual improvement. Quality planning may include, but is not limited to: Quality objectives QMS Process Resources needed Continual improvement of the QMS. 5.5 Responsibility, Authority, and Communication Responsibility and Authority An organizational chart has been established to show the interrelation of personnel in the organization. Job descriptions define the responsibilities and authorities of each of the positions on the organizational chart. Job descriptions and the organizational chart are reviewed and approved by the CEO for adequacy. These documents are available throughout the organization to help employees understand responsibilities and authorities. An Organizational Chart is located on the corporate document repository QMS Management Representative The CEO appointed the Director of Internal Support as the QMS Management Representative. The QMS Management Representative has the following responsibility and authority: Ensure that processes needed to support the QMS are established and implemented Report to the CEO on the performance of the QMS and identify needed improvements Promote awareness of customer requirements throughout the organization Resolve Quality Management issues with organizational freedom and unrestricted access to top management 24

25 Act as liaison with external parties including customers or auditors on matters relating to the QMS Internal Communication Processes are established for communication within the organization. Methods of communicating the effectiveness of the QMS include department, Management, and Management Review meetings, results of Management Review and External/Internal Audit results are communicated as applicable. Craig Technologies maintains a corporate-wide electronic network supplying multiple means of electronic communication including: Regular Staff Meetings Craig s Corner (Employee Intranet) CT ELEMENT (Internal Newsletter) Corporate Website SharePoint Site Databases o Gen4 Active Employee Qualifications o Taleo Position Requirements The Craig Technologies organizational structure located on the corporate document repository. 5.6 Management Review General The CEO and/or QMS Management Representative schedules and reviews the QMS is reviewed annually at Management Review meetings. This review assesses the continuing QMS suitability, adequacy, and effectiveness and identifies opportunities for improvement and needed changes. Records are maintained for each Management Review meeting (F ) Review Input Assessment of the QMS is based on a review of information inputs provided for management review. These inputs include the following: Results of Internal Audits (P-822) Customer feedback (P-720) Process performance and product conformity (P-824) Company level quality data Status of preventive and corrective actions (P-852, P-853) Follow-up actions from previous management reviews 25

26 Director feedback (P-560) Employee satisfaction results (P-623) Planned changes that could affect the QMS Recommendations for improvement Review Output During these review meetings, management will identify appropriate actions to be taken regarding the following issues: Improvement of the effectiveness of the QMS and its processes Improvement of products and services related to customer requirements Resource needs. Responsibilities for required actions are assigned to members of the Management Review team. Any decisions made during the meeting, assigned actions, and their due dates are recorded in the minutes of Management Review meetings Related Procedures: Management Responsibility P-500 Director Feedback P-560 Employee Satisfaction P-623 Customer Related Processes P-720 Design and Development P-730 Internal Audits P-822 Corrective Actions P-852 Preventive Actions P

27 Section 6: Resource Management 27

28 6. Resource Management 6.1 Provision of Resources Craig Technologies has implemented a QMS that complies with the Standard. This implementation was achieved with management commitment and with sufficient resources. To effectively maintain, and continually improve the system, management determines and provides the necessary resources to meet customer needs. 6.2 Human Resources General Traditional industry-standard human resource tasks are performed by our People Department. Job descriptions have been prepared identifying the qualifications required for each position that affects and service quality to ensure competence of our personnel. Qualifications include requirements for education, skills, and experience. Appropriate qualifications and required training provide the competence required for each position Competence, Awareness, and Training Competence and requirements for the job are determined following the determination of a job opening. Qualifications are reviewed prior to hire, when an employee changes positions, or when the requirements for a position change. Human Resources maintain records of both employee qualifications and the requirements of the job. If any differences between the employee s qualifications and the requirements for the job are found, training or other action is taken to provide the employee with the necessary competence for the job. The results are evaluated to determine if they were effective. These records are recorded and stored according to the Control of Quality Records Procedure (P-424). Training and evaluation are conducted according to the Competence, Awareness, and Training Procedure (P-622). All employees are trained on the relevance and importance of their activities and how they contribute to the achievement of the quality objectives. All security training is recorded and maintained by the People Department utilizing a web based training platform Employee Satisfaction The People Department is responsible for assessing employee satisfaction. Through formal assessment or informal contact, differences between the employee s desires and the status quo are attained. Methods of conducting formal assessments are outlined in the Employee Satisfaction Procedures (P-623). Feedback is communicated to the CEO as outlined in the Management Responsibility Procedures (P-500) and the results are evaluated to determine their effectiveness in reducing annual turnover rates. 28

29 6.3 Infrastructure The current Craig Technologies infrastructure includes a Corporate Headquarters office with many employees working from home or remote offices and at customer sites. New infrastructure requirements will be documented in quality plans. All corporate documentation is stored on the company SharePoint site which is backed up daily. Working documentation is the responsibility of the employee. It is recommended that employees backup their working documentation weekly. Employees use a combination of Carbonite and CrashPlan. All corporate computers have virus protection software installed with up-to-date virus definitions. All personal computers used for corporate work (e.g. remote access, travel) are also required to have up-to-date virus protection software (See Section Preservation of Product). Craig Technologies Preventive Maintenance procedure (P-630) outlines the process for ensuring all equipment is maintained to the corporate quality standard. This procedure identifies the recurring maintenance times for each of the machines within the manufacturing facility, under which standards they are to be maintained, and the responsible parties for performing the maintenance. 6.4 Work Environment Craig Technologies has determined, and maintains its facilities based upon, the identification and management of the human and physical factors of the work environment needed to achieve product/service conformity. These factors include but are not limited to: Lighting, temperature, and cleanliness Electrostatically controlled environment in appropriate areas Noise, humidity, and weather. 6.5 Related Documents Competence, Awareness, and Training P-622 Employee Satisfaction P

30 Section 7: Product Realization 30

31 7. Product Realization 7.1 Planning of Product Realization Quality planning is required before new products or processes are implemented. The quality planning process is defined in the Planning of Product Realization Process (P-710), and may take place as a standalone design project or service as part of the project planning stage (Design and Development, P-730). During product realization quality planning management or assigned personnel identify: Quality objectives and requirements for the product/service, including but not limited to: - product and personal safety, - reliability, availability and maintainability, - producibility and inspectability, - suitability of parts and materials used in the product, - selection and development of embedded software, and - recycling or final disposal of the product at the end of its life Processes, documentation, and resources required Verification, validation, monitoring, inspection, and test requirements Criteria for product/service acceptance Configuration management appropriate to the product/service Resources to support the use and maintenance of the product. Planning of product realization is initiated at the Design Phase of a product or at the beginning of a service contract. Objectives and requirements for the product/service are established and documented throughout the product development lifecycle. Production and test processes are developed taking into consideration the appropriate verification, validation, monitoring, inspection, and test activities. Appropriate records are created and maintained. Complete and detailed information on quality and product planning can be found in the Design and Development Procedure (P-730) Project Management Craig Technologies plans and manages product realization in a structured and controlled manner to meet requirements at acceptable risk and within resource and schedule constraints Risk Management Craig Technologies establishes, implements and maintains a process for managing risk, according to the Risk Management procedure (P-712), to the achievement of applicable requirements that includes the following to the organization and the product/service: assignment of responsibilities for risk management definition of risk criteria (e.g., likelihood, consequences, risk acceptance) identification, assessment and communication of risks throughout product realization 31

32 identification, implementation and management of actions to mitigate risks that exceed the defined risk acceptance criteria, acceptance of risks remaining after implementation of mitigating actions Configuration Management Configuration management is defined in P-713, Configuration Management. Craig Technologies establishes, implements and maintains a configuration management process that includes, as appropriate to the product/service: configuration management planning configuration identification change control configuration status accounting configuration audit. The Craig Technologies Software Configuration Management (CM) process provides a mechanism for identifying, controlling, and tracking the versions of each software item. In many cases, earlier versions still in use must also be maintained and controlled. Craig Technologies uses version control and CM to effectively manage source code and configuration changes throughout the process. Craig uses UBER SVN which enables users to work at file- and project-levels while also promoting file reuse. The UBER SVN project-oriented features increase the efficiency of managing day-to-day tasks associated with team-based software and Web content development. Craig Technologies uses VSS for all internally-produced software. Externally-produced software is controlled using the CM tools and procedures of the customer. The Craig Technologies CM system: Identifies each unique version of each software item Identifies the versions of each software item which together constitute a specific version of a complete product Identifies the build status of software products in development or delivered and installed Controls simultaneous updating of a given software item by more than one person Provides coordination for the updating of multiple products in one or more locations Identifies and tracks all actions and changes resulting from a change request from initiation to product release. Craig Technologies also uses SharePoint for versions of all corporate documentation. This software enables administrators to control access to documentation by user definition Control of Work Transfers Craig Technologies establishes, implements and maintains a process to plan and control the temporary or permanent transfer of work (e.g., from one organization facility to another, from the organization to a supplier, from one supplier to another supplier) and to verify the conformity of the work to requirements. Transfer of products internally, from one work center to another, will 32

33 be managed by use of a Job Router. This process will ensure the identification and traceability of components on the shop floor. 7.2 Customer-Related Processes Determination of Requirements Related to the Product Craig Technologies customer requirements include statutory, regulatory, and organizational requirements that are an important input to the product realization process. These requirements are defined during the early phases of product development/ contract start and include: Requirements specified by the customer including the requirements for delivery and post-delivery activities. These may be captured in a Statement of Work (SOW) or similar document format Requirements not stated by the customer but necessary for specified or intended use, where known Statutory and regulatory requirements related to the product Any additional requirements determined by Craig Technologies. Customer requirements are determined according to the Customer Related Processes Procedure. (P-720) Review of Requirements Related to the Product Craig Technologies has a Customer Related Process (P-720) in place for the review of requirements or Statements of Work (SOW) related to a product. The process ensures that: Product/service requirements are well defined Contract or task order requirements differing from those previously expressed are resolved Craig Technologies has the ability to meet the defined requirements Craig Technologies has determined any special requirements of the product/service Risks (e.g., new technology, short delivery time frame) have been identified (see 7.1.2). Records are maintained demonstrating the results and actions arising from the review Customer requirements are confirmed before acceptance in cases where a customer does not provide a documented SOW Craig Technologies communicates changes to relevant personnel, amends relevant documents, and/or creates supplemental documentation when product/service requirements are changed Customer Communication Craig Technologies has implemented an effective procedure (P-720) for communicating with customers in relation to: Product/service information Inquiries, order handling, and amendments 33

34 Customer feedback including customer complaints Operational Conflicts of Interest (OCIs) Contractual Questions In addition to traditional Customer Communication processes, Craig Technologies has registered with the International Trade and Armament Regulation (ITAR) authority to ensure that no sensitive data or defense articles are exported from Craig Technologies to foreign entities. This is established by verifying that customers and suppliers are US persons and/or corporations, and by putting in place the controls required to prevent export. These controls are outlined in the Craig Technologies ITAR Compliance Procedure Manual (P-723), and are strictly adhered to by all Craig Technologies personnel. If there is a change in facility or equipment move, ADMC will notify the customer to determine if the change requires an audit or re-qualification. ADMC customers will be notified promptly, if the results of an audit internal, customer or third party, findings could potentially have direct impact on product. 7.3 Design and Development Design and Development Planning The Design and Development Procedure (P-730) outlines the process for controlling the Design and Development Phase. The Software Engineering project team creates their Design and Development Plan according to this procedure. The plan includes: Design and development stages Required design reviews Verification and validation methods appropriate to each design and development stage Responsibilities and authorities for design and development Where appropriate, division of the design and development effort into distinct activities and, for each activity, definition of the tasks, necessary resources, responsibilities, design content, input and output data and planning constraints Design and development tasks to be carried out will be based on the safety and functional objectives of the product in accordance with customer, statutory and regulatory requirements Design and development planning considers the ability to produce, inspect, test and maintain the product Identification of the technical interfaces required for the project Updating the design plan as the project progresses. Design and Development Planning is a process followed throughout the execution of a project to provide for, but not limited to, the following: 34

35 Definition of distinct stages that a project follows through its lifecycle Definition of the processes to be followed throughout the project lifecycle including review, verification, and validation processes Control and insight into the project's status for Management Clear definition of responsibilities and authorities with regard to each aspect of the design and development process Clear definition of the interfaces (with respect to deliverables) between the various departments involved in the project Design and Development Inputs Inputs relating to product requirements are determined and documented according to the Design and Development Procedure (P-730). All inputs are reviewed for adequacy and completeness and to resolve any ambiguous inputs. Inputs include: Functional and performance requirements Applicable regulatory and legal requirements Information derived from similar designs where applicable Other requirements essential for design and development Estimated costs Design and Development Outputs Outputs of design and development are documented according to the Design and Development Procedure (P-730). They are documented in a format that enables verification against the inputs and are approved prior to release. Outputs: Meet the input requirements for design and development Provide appropriate information for purchasing, production and service provision Contain or reference product acceptance criteria Specify the characteristics of the product that are essential for its safe and proper use Specify, as applicable, any critical items, including any key characteristics, and specific actions to be taken for these items. Craig Technologies will define the data required to allow the product to be identified, manufactured, inspected, used and maintained; including: Drawings, part lists and specifications necessary to define the configuration and the design features of the product Material, process, manufacturing and assembly data needed to ensure conformity of the product Design and Development Review The design plan specifies suitable stages of the project to conduct design and development reviews. Reviews take place according to the design and development procedure with the results being recorded in minutes of the design review meetings and maintained as a quality record. Design reviews: 35

36 Evaluate the results of design and development activities and determine if they fulfill requirements Identify any problems and propose necessary corrective actions Authorize progression to the next stage Include participation by representatives of functions concerned with the design and development stage being reviewed. Formal design reviews are conducted at each iteration of the design process and documented Design and Development Verification Design and development verification is planned and performed to ensure that the design and development outputs have satisfied the design and development input requirements. Records of the results of the verification and any necessary actions are maintained according to the Design and Development Procedure (P-730) Design and Development Validation Design and development validation is performed according to the design plan to ensure that the resulting product is capable of fulfilling the requirements for the specified or known intended use or application. Validation is completed prior to implementation whenever practical. Records of the validation activities are maintained according to the Design and Development Procedure (P-730). Product validation is performed prior to wide-spread deployment of the product. Validation is typically performed as part of a Beta cycle at the customer site. The purpose of validation is to demonstrate that the product design meets the requirements stated in the Project Plan and its intended application Design and Development Verification and Validation Testing Where tests are necessary for verification and validation, these tests will be planned, controlled, reviewed and documented to ensure and prove the following: Test plans or specifications identify the product being tested and the resources being used define test objectives and conditions, parameters to be recorded and relevant acceptance criteria Test procedures describe the method of operation, the performance of the test and the recording of the results The correct configuration of the product is submitted for the test The requirements of the test plan and the test procedures are observed, and The acceptance criteria are met. 36

37 Design and Development Verification and Validation Documentation At the completion of design and/or development, Craig Technologies ensures that reports, calculations, test results, and other criteria demonstrate that the product definition meets the specification requirements for all identified operational conditions Control of Design and Development Changes The Design and Development Procedure (P-730) defines the process for identifying, recording, verifying, validating, and approving design changes. The review of design and development changes includes an evaluation of the effect of the changes on constituent parts and implemented products. Records are maintained to demonstrate the results of the review and any necessary actions identified during the review. Software design changes occurring during the design and development cycle are tracked, controlled, and documented in the Bug Tracker. Design changes on products following release either initiated by Craig Technologies or requested by the customer are reviewed and treated as new development using the iterative process described in the Design and Development Procedure (P-730). Design and development changes are controlled in accordance with the Configuration Management process (see 7.1.3). 7.4 Purchasing Purchasing Process Product or services purchased on behalf of Craig Technologies will be adequately specified in terms of technical content and commercial requirements. Suppliers are selected on the basis of their ability to meet requirements including their quality system and ability to provide services when required. Craig Technologies is responsible for the conformity of all products or services purchased from suppliers, including product or services from sources defined by the customer. Previous supplier performance or experience in supplying similar products or services is evaluated. An on-site assessment of the supplier may be performed if warranted based upon the product/service. The CEO has the authority to grant supplier conditional approval. A criterion for supplier re-evaluation is also established in the Supplier Portal Purchasing Procedure (P-741). Records on acceptable suppliers and their ongoing performance metrics are maintained. Craig Technologies will: Maintain a register of its suppliers that includes approval status (e.g., approved, conditional, disapproved) and the scope of the approval (e.g., product/service type, process family) 37

38 Periodically review supplier performance; the results of these reviews shall be used as a basis for establishing the level of controls to be implemented Define the necessary actions to take when dealing with suppliers that do not meet requirements Ensure where required that both the organization and all suppliers use customerapproved special process sources Define the process, responsibilities and authority for the approval status decision, changes of the approval status and conditions for a controlled use of suppliers depending on the supplier's approval status Determine and manage the risk when selecting and using suppliers (see 7.1.2) Purchasing Information Purchasing documents contain sufficient information for the supplier to avoid misunderstanding of specified requirements. Purchase Orders (PO) or subcontracting agreements describe the specific supplier requirements requested. The Contract Administrator (Director) and/or CEO routinely review purchasing documents prior to supplier acceptance. Purchase Orders and/or subcontracting agreements may contain but are not limited to the following: Approval/qualifications of the product/service, procedures, processes, personnel, equipments, and the supplier Quality Management System Inspection/verification instructions and other relevant technical data Requirements for design, test, inspection, verification (including production process verification), use of statistical techniques for product acceptance, and related instructions for acceptance by Craig Technologies, and as applicable critical items including key characteristics Requirements for test specimens (e.g., production method, number, storage conditions) for design approval, inspection/verification, investigation or auditing Requirements regarding the need for the supplier to notify the organization of nonconforming product/service, obtain organization approval for nonconforming product/service disposition, notify the organization of changes in product/service and/or process, changes of suppliers, changes of manufacturing facility location and, where required, obtain organization approval, and flow down to the supply chain the applicable requirements including customer requirements, Records retention requirements Right of access by the organization, their customer and regulatory authorities to the applicable areas of all facilities, at any level of the supply chain, involved in the order and to all applicable records. 38

39 7.4.3 Verification of Purchased Product When Craig Technologies stipulates on a contract that purchased product or service is subject to source inspection by Craig Technologies or a Craig Technologies customer, the details for such an inspection and subsequent release of accepted material will be stated in the PO or subcontract agreement. The Purchasing Procedure (P-740) contains further details. Customer verification activities performed at any level of the supply chain will not be used by Craig Technologies or the supplier as evidence of effective control of quality. Craig Technologies will retain the responsibility to provide acceptable product/service and comply with all requirements. Where purchased product is released for production use, pending completion of all required verification activities, it shall be identified and recorded to allow recall and replacement if it is subsequently found that the product does not meet requirements. Where Craig Technologies delegates verification activities to the supplier, the requirements for delegation will be defined and a register of delegations maintained. 7.5 Production and Service Provision Control of Production and Service Provision Craig Technologies plans and carries out production and service provision under controlled conditions. Controlled conditions include, as applicable: The availability of information that describes the characteristics of the product (including drawings, parts lists, materials and process specifications.) The availability of work instructions, as necessary The use of suitable equipment The availability and use of monitoring and measuring equipment The implementation of monitoring and measurement, the implementation of product release, delivery and post-delivery activities Accountability for all product during production (e.g., parts quantities, split orders, nonconforming product) Evidence that all production and inspection/verification operations have been completed as planned, or as otherwise documented and authorized Provision for the prevention, detection and removal of foreign objects Monitoring and control of utilities and supplies (e.g., water, compressed air, electricity, chemical products) to the extent they affect conformity to product requirements Criteria for workmanship, specified in the clearest practical way (e.g., written standards, representative samples, illustrations). 39