How OCAP affects AS9100 Companies

The revised SAE AS9104/1A requires AS 9100 CBs (Certification Bodies… AKA Registrars) to use the “Organization Certification Analysis Process (OCAP)” to determine an overall “risk rating” for each certified company. This “risk-rating” will then be used during audit planning — to provide reductions or increases (by ±10%, as per AS9104/1A, “Table 9 - Audit Duration Risk Adjustments”) in certification and surveillance audit durations from baseline audit durations found in SAE AS9104/1A, “Table 8 - Audit Duration Per Site”.

The OCAP is defined in SAE AS9104/1A as:

3.8 Organization Certification Analysis Process (OCAP)
An interactive process between the organization and CB to determine the organization’s AQMS scope and associated certification audit program, and conduct a risk assessment for certification within the ICOP scheme.

The OASIS database “should” be updated to support the new SAE AS9104/1A by July 24, 2023 (no promises). The new OCAP process is required to be fully implemented by the Certifying Bodies (CBs) no later than 3/31/24.

As per IAQG COT Supplemental Rule 004, sec. 5.3, each AS91xx Certified organization must “Provide CBs with information required for the OCAP review at least 90 days prior to the 9104-1:2022 transition audit”.

You will receive a written request (e.g., a letter or questionnaire) from your CB when they're ready for your OCAP data. If your company fails to provide this information within the required 90-day period, then the audit cannot be performed, and the CB will (as per SAE AS9104/1A, sec. 8.2.2) follow its processes for cancellation, missed surveillance audit, or expired certification.

Further, as per SAE AS9104/1A, sec. 9.1.10 states:

AQMS certified organizations shall provide data required by this standard, to their CB prior to initial, surveillance, and recertification audits for the completion of the OCAP analysis.

NOTE: Failure to provide accurate and timely data may result in the issuance of a nonconformity by the CB and/or prevent certification.

Such a nonconformity would cite a failure to comply with the requirements of an “interested party” (i.e., the CB) and reference AS91xx, sec. 4.2, “Understanding the Needs and Expectations of Interested Parties”.

The data provided will be used by the CB for determining an overall “risk rating” (High, Medium, Low) for each certified company. The overall “risk rating” is calculated using AS9104/1A, Table 7 - “Organizational Risk Determination”, shown below.

Prior to providing such data, you should read this entire article (including the hyperlinked articles below each “Risk Factor” in Table 7, for a detailed discussion of each) in order to understand how it will be used.

AS9104/1A, sec. 8.5.1.3.4 states:

“CBs shall require that organizations provide information regarding the use of additional aerospace standard(s) listed within the IAQG Standards Register during the initial Stage 1 audit and update, as needed, prior to surveillance or recertification audits (see Table 4)”.

The most commonly invoked supplemental AS91xx standards are AS9102 (Aerospace first article inspection requirement) & 9146 (Foreign object debris – FOD). If a standard is contractually imposed on the company (e.g., by a customer) then additional time may be added to each site where the related processes are performed (ref. IAF MD5 "Determination of Audit Time for QMS-EMS-OHS Audits”, sec. 8, “Factors for Adjustments of Audit Time of Management Systems (QMS, EMS, and OH&SMS)”). This new requirement is also intended to ensure that the CB assigns auditors who are competent in auditing compliance with those additional standards.