SIST EN 9223-103:2018
(Main)Programme Management - Configuration Management - Part 103: Configuration Verifications, Reviews and Audits
Programme Management - Configuration Management - Part 103: Configuration Verifications, Reviews and Audits
The present document:
is based on internationally-recognized concepts;
proposes organisational principles and implementation processes for Configuration Management
from both viewpoints: “programme” and “company”, with emphasis on the “programme”
viewpoint;
deals with verifications, reviews and audits tending towards the validation of the configuration
information consistency. It details the principles described in EN 9223-100.
It is up to each programme responsible person to define the necessary details of application and
tailoring in the Configuration Management plan.
Programm-Management - Konfigurationsmanagement - Teil 103: Überprüfungen, Reviews und Audits der Konfiguration
Das vorliegende Dokument
basiert auf international anerkannten Konzepten,
schlägt organisatorische Grundsätze und Umsetzungsprozesse für das Konfigurationsmanagement aus den beiden Perspektiven „Programm“ und „Unternehmen“ mit dem Schwerpunkt auf der Perspektive „Programm“ vor,
behandelt Verifizierungen, Überprüfungen und Audits zur Validierung der Konsistenz der Konfigura-tionsangaben. Es führt die in EN 9223-100 beschriebenen Grundsätze im Detail aus.
Es obliegt jeder für ein Programm verantwortlichen Person, die notwendigen Einzelheiten der Anwendung und Anpassung im Plan des Konfigurationsmanagements zu definieren.
Wichtige Anmerkung:
Ein Konfigurationsaudit darf nicht mit einem Qualitätsaudit verwechselt werden (für weitere Einzel-heiten, siehe 4.1).
Dieses Dokument behandelt keine Systemaudits der Konfiguration (Qualitätsaudits), die im Rahmen eines Programms eingesetzt werden. Diese Audits stammen aus den in EN ISO 9001 beschriebenen Qualitätsaudits (Audits der Prozesskonformität oder Effizienz).
Management de Programme - Gestion de la Configuration - Partie 103 : Vérifications, revues et audits de la configuration
La présente recommandation :
- s’appuie sur les concepts reconnus au niveau international,
- propose des principes d’organisation et de mise en oeuvre de la gestion de la configuration suivant les dimensions « programme » et « entreprise », tout en privilégiant la dimension « programme »,
- traite de la vérification, des revues et des audits tendant à la validation de la cohérence des informations de configuration. Elle précise les principes décrits dans l’EN 9223-100.
Il revient à chaque responsable de programme de définir dans le plan gestion de la configuration les modalités d’application et d’ajustement nécessaires.
Remarque importante :
L’audit de la configuration ne doit pas être confondu avec l’audit qualité (pour plus d’informations, voir 4.1).
Ce document ne traite pas des audits du système de gestion de la configuration (audit qualité) mis en place dans le cadre d’un programme. Ces audits relèvent directement des audits qualité tels que définis dans l’EN ISO 9001 (audits de conformité ou d’efficacité de processus).
Vodenje programov - Vodenje konfiguracije - 103. del: Preverjanje konfiguracije, pregledi in revizije
Ta dokument:
temelji na mednarodno priznanih konceptih;
predlaga organizacijska načela in izvedbene postopke za vodenje konfiguracije
z obeh vidikov: »programa« in »podjetja«, s poudarkom na vidiku »programa«;
obravnava preverjanja, preglede in revizije, ki se nagibajo k preverjanju skladnosti informacij o konfiguraciji. Podrobno opredeljuje načela, opisana v standardu EN 9223-100.
Vsaka oseba, odgovorna za program, določi potrebne podrobnosti uporabe in prilagajanja načrta vodenja konfiguracije.
General Information
Standards Content (Sample)
SLOVENSKI STANDARD
SIST EN 9223-103:2018
01-maj-2018
Vodenje programov - Vodenje konfiguracije - 103. del: Preverjanje konfiguracije,
pregledi in revizije
Programme Management - Configuration Management - Part 103: Configuration
Verifications, Reviews and Audits
Programm-Management - Konfigurationsmanagement - Teil 103: Überprüfungen,
Reviews und Audits der Konfiguration
Management de Programme - Gestion de la Configuration - Partie 103 : Vérifications,
revues et audits de la configuration
Ta slovenski standard je istoveten z: EN 9223-103:2018
ICS:
03.100.70 Sistemi vodenja Management systems
49.020 Letala in vesoljska vozila na Aircraft and space vehicles in
splošno general
SIST EN 9223-103:2018 en,fr,de
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
---------------------- Page: 1 ----------------------
SIST EN 9223-103:2018
---------------------- Page: 2 ----------------------
SIST EN 9223-103:2018
EN 9223-103
EUROPEAN STANDARD
NORME EUROPÉENNE
March 2018
EUROPÄISCHE NORM
ICS 35.080; 49.020
English Version
Programme Management - Configuration Management -
Part 103: Configuration Verifications, Reviews and Audits
Management de Programme - Gestion de la Programm-Management - Konfigurationsmanagement
Configuration - Partie 103 : Vérifications, revues et - Teil 103: Überprüfungen, Reviews und Audits der
audits de la configuration Konfiguration
This European Standard was approved by CEN on 25 September 2017.
CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this
European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references
concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to any CEN
member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN member into its own language and notified to the CEN-CENELEC Management
Centre has the same status as the official versions.
CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia,
Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania,
Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland,
Turkey and United Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION
EUROPÄISCHES KOMITEE FÜR NORMUNG
CEN-CENELEC Management Centre: Rue de la Science 23, B-1040 Brussels
© 2018 CEN All rights of exploitation in any form and by any means reserved Ref. No. EN 9223-103:2018 E
worldwide for CEN national Members.
---------------------- Page: 3 ----------------------
SIST EN 9223-103:2018
EN 9223-103:2018 (E)
Contents Page
European foreword . 3
Introduction . 4
1 Scope . 5
2 Normative references . 5
3 Terms and definitions . 5
4 The configuration verification, review and audit processes and their place in the
overall programme Configuration Management . 6
4.1 Configuration verification and audit process overview . 6
4.2 Nature of the configuration verification and audit process . 6
4.3 Configuration audits: ending activity and starting point. 7
4.4 Configuration verification activities preliminary to the audits . 8
5 Configuration verification, review and audit activities . 9
5.1 Configuration verification, review and audit activities overview . 9
5.2 Verifications during programme reviews (or equivalent milestones) . 9
5.3 Configuration audits . 11
5.4 Relationship between FCA, PCA, configuration baselines and qualification . 16
6 Specific cases. 17
6.1 Configuration audits resumption during the product life . 17
6.2 COTS, Components Off The Shelf. 18
6.3 Configuration item common to several programmes . 18
6.4 Coherence between the product and specific means . 19
(informative) Verification methods that can be used to prepare a configuration
audit . 20
(informative) Examples for configuration audit procedures . 21
B.1 General . 21
B.2 Example of activities to be included in a configuration audit procedure . 21
B.3 List of points to verify for a FCA . 22
B.4 List of points to verify for a PCA . 23
Bibliography . 25
2
---------------------- Page: 4 ----------------------
SIST EN 9223-103:2018
EN 9223-103:2018 (E)
European foreword
This document (EN 9223-103:2018) has been prepared by the Aerospace and Defence Industries
Association of Europe - Standardization (ASD-STAN).
After enquiries and votes carried out in accordance with the rules of this Association, this Standard has
received the approval of the National Associations and the Official Services of the member countries of
ASD, prior to its presentation to CEN.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by September 2018, and conflicting national standards
shall be withdrawn at the latest by September 2018.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN shall not be held responsible for identifying any or all such patent rights.
According to the CEN-CENELEC Internal Regulations, the national standards organisations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia,
France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta,
Netherlands, Norway, Poland, Portugal, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland,
Turkey and the United Kingdom.
3
---------------------- Page: 5 ----------------------
SIST EN 9223-103:2018
EN 9223-103:2018 (E)
Introduction
1
The finality of Configuration Management is to assure during the whole product lifecycle :
consistency and commonality of the technical information among all actors;
traceability of this technical information.
For that purpose, Configuration Management organizes and implements the following activities:
selection of items and technical information that shall be submitted to Configuration Management,
under clearly established responsibility (configuration identification);
capture, keeping this information and making it available (configuration status accounting);
verification and validation of the coherence of this information at defined steps of the product
lifecycle (configuration verifications, reviews and audits);
technical changes and gaps processing in order to keep the consistency of this information
(configuration control).
1
See EN ISO 9000:2015.
4
---------------------- Page: 6 ----------------------
SIST EN 9223-103:2018
EN 9223-103:2018 (E)
1 Scope
The present document:
is based on internationally-recognized concepts;
proposes organisational principles and implementation processes for Configuration Management
from both viewpoints: “programme” and “company”, with emphasis on the “programme”
viewpoint;
deals with verifications, reviews and audits tending towards the validation of the configuration
information consistency. It details the principles described in EN 9223-100.
It is up to each programme responsible person to define the necessary details of application and
tailoring in the Configuration Management plan.
Important remark:
Configuration audit doesn’t be confused with quality audit (for detailed information, see 4.1).
This document does not deal with configuration system audits (quality audit) deployed within the
scope of a programme. These audits stem from quality audits as defined in EN ISO 9001 (process
conformity or efficiency audits).
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced document (including any amendments) applies.
EN 9100, Quality Management Systems — Requirements for Aviation, Space and Defence Organizations
EN 9223-100, Programme Management — Configuration Management — Part 100: A guide for the
2
application of the principles of configuration management
EN 9223-101, Programme Management — Configuration Management — Part 101: Configuration
2
identification
2
EN 9223-105, Programme Management — Configuration Management — Part 105: Glossary
EN ISO 9000, Quality management systems — Fundamentals and vocabulary
EN ISO 9001, Quality management systems — Requirements
3 Terms and definitions
For the purposes of this document, the terms and definitions given in EN ISO 9000, ISO 10007 and
EN 9200 apply.
ISO and IEC maintain terminological databases for use in standardization at the following addresses:
2
Published as ASD-STAN Prestandard at the date of publication of this standard http://www.asd-stan.org/.
5
---------------------- Page: 7 ----------------------
SIST EN 9223-103:2018
EN 9223-103:2018 (E)
• IEC Electropedia: available at http://www.electropedia.org/
• ISO Online browsing platform: available at http://www.iso.org/obp
The specific terms needed to understand and to use the document are the object of definitions
appearing in EN 9223-105.
4 The configuration verification, review and audit processes and their place in
the overall programme Configuration Management
4.1 Configuration verification and audit process overview
Figure 1 — Place of the configuration verification, review and audit process in Configuration
Management processes
Important remarks:
Configuration audits shall in no case be performed by third party auditors (organisms
accredited to deliver audits certificates on quality systems) because of the risk of losing
restricted know-how. They are normally performed by a first party auditor (belonging to the
company) and up to a point by a second-party auditor (customer).
4.2 Nature of the configuration verification and audit process
Configuration verification occurs at determined milestones during the system or product lifecycle,
essentially linked to establishing and approval of configuration baselines and to verification of the
6
---------------------- Page: 8 ----------------------
SIST EN 9223-103:2018
EN 9223-103:2018 (E)
conformity of a specific unit of the product or achieved configuration item to these configuration
baselines.
The configuration verification shall:
assure that the design of the product guarantees the fulfilment of the specified requirements;
validate the completeness and the accuracy of the product configuration information;
assure the consistency between a product and its product configuration information;
guarantee that the configuration control process shall be able to maintain the fulfilment of the
requirements and the consistency between the product and its configuration information during
the remaining of the lifecycle;
guarantee that controlled configuration information is the basis for operational use, support,
training, spare parts and repairs.
Configuration verification uses the configuration audit technique, which consists in:
comparing defined characteristics in a configuration baseline to those presented by a realized and
representative of to-be-delivered system, product or configuration item;
identifying and highlighting gaps;
obtaining an approved decision for each of them (concession or setting in conformity).
As the programme flows however, a certain amount of data belonging to configuration information and
some Configuration Management activities linked to the phase of programme flow down can be subject
to verifications. These verifications are achieved during configuration audits and reviews that sequence
the lifecycle.
4.3 Configuration audits: ending activity and starting point
the configuration audit is carried on a configuration item. That means it can exist at three levels: at
system level, at product level and at configuration item lower level. It is a bottom-up approach:
configuration audits for a system rely on the consolidation of the configuration audits for the
products that make it up and themselves rely on configuration audits of the configuration items
that make up these products;
in the scope of a product design, configuration audits will end the implemented Configuration
Management activities and thus will contribute to the qualification process. Indeed, if configuration
information is described in documentation, it must also be achieved in the physical product. At the
end of the development of an item, the audit aims at assuring that there is no gap (or at least they
are under control) between the actual product and its representation in documentation. So this
audit guarantees that the performances and the physical characteristics can be reproduced all along
the operational life of this product;
configuration audits are heavy-duty activities that should not be repeated. This does not mean that
Configuration Management activities will end at this level. Particularly, control and status
accounting activities will go on during the remaining of the lifecycle. These audits are meant to
finalize the achievement of consistency between all the configuration baselines (FBL, ABL and PBL)
at the end of the development phase and to show that the control process implemented allows
7
---------------------- Page: 9 ----------------------
SIST EN 9223-103:2018
EN 9223-103:2018 (E)
maintaining this consistency without necessity for systematically redo complete configuration
audits;
the configuration audit finalizes the identification activity through approval of configuration
baselines. It becomes the starting point for configuration control activities;
in case of important changes in specifications and/or product design, there may be additional or
new audit, especially for the following cases:
long life products;
obsolescence processing;
requirement for modernizing.
4.4 Configuration verification activities preliminary to the audits
Before performing verifications, a procedure shall be established. It describes:
conditions;
methods;
means;
additional resources;
the associated organization;
the scheduling of verifications and of the audit.
Configuration verification activities have to be planned making clear at which moment they occur,
according to which process, and who will participate. Particularly for configuration audits, it is
worth to make clear how they are embedded in the qualification process, at which level and up to
which degree of sharpness they have to be performed;
Before audits, it has to be checked that:
the configuration information used as baseline for configuration audits exists beforehand:
configuration baselines;
as-designed configurations;
status of technical changes that have to be implemented in the product before verification;
accepted deviations.
the systems, products or configuration items achieved are:
in a stable status;
representative of the end product (case of mass-produced product) including realization
(methods and tools);
8
---------------------- Page: 10 ----------------------
SIST EN 9223-103:2018
EN 9223-103:2018 (E)
identified in compliance with specified arrangements.
the whole documentation supporting the audit:
is identified in compliance with specified arrangements;
has been approved and recorded as required.
5 Configuration verification, review and audit activities
5.1 Configuration verification, review and audit activities overview
Configuration verifications are mainly associated with configuration reviews and audits. These
verifications focus on completeness and consistency of documents that have to be used for reviews and
audits. Some more specific verification is described in the following paragraphs.
5.2 Verifications during programme reviews (or equivalent milestones)
The reviews SSR/SR, PDR, CDR, TRR, QR, PRR, FAI have to be carried on at programme level and also at
configuration items level. They are milestones on which Configuration Management can rely to perform
a certain number of verifications that will facilitate the implementation of configuration audits.
The verifications proposals below concern the product configuration (physical and functional
characteristics). Beyond these verifications, additional verifications about the process are needed that
are outside the scope of this recommendation. Besides, some verifications about product configuration
are also process verification (e. g. breakdown into configuration items).
SSR: System Specification Review (at system level):
verify that all the approved documents that define the technical requirements applicable to the
system have been set in baseline (FBL);
verify that the traceability of the documented and approved requirements with the stated needs
has been demonstrated at the time of approval of these documents;
if physical units for demonstration purpose (model, mock-up, feasibility prototypes, etc.) have been
achieved to validate feasibility of all or part of technical requirements, verify that the configuration
of units and all the evidences for feasibility have been recorded. As needed, this verification may be
a sort of configuration pre-audit.
NOTE At a given level of authority, it may be as well no longer a matter of system but that of a configuration
item said “header”. Above verifications are nevertheless still in force in this case.
SR: Specification Review (at configuration item level):
verify that all the approved documents that define the technical requirements applicable to the
configuration item have been set in baseline (ABL);
verify that the traceability of the documented and approved requirements applicable to the
configuration items with the Functional Baseline of upper level has been demonstrated at the time
of approval of these documents;
if physical units for demonstration purpose have been achieved (model, mock-up, feasibility
prototypes, etc.) to validate feasibility of all or part of technical requirements, verify that the
9
---------------------- Page: 11 ----------------------
SIST EN 9223-103:2018
EN 9223-103:2018 (E)
configuration of units and all the evidences for feasibility have been recorded. As needed, this
verification may be a sort of configuration pre-audit.
PDR: Preliminary Design Review:
verify that main configuration items are identified (partially documented);
verify that for a single authority the configuration audits are planned:
for the system (or header item);
for all configuration items that build it up.
verify that all technical requirements allocated in the ABL cover all technical requirements defined
in FBL.
CDR: Critical Design Review:
verify that all configuration items under responsibility of concerned authority are identified and
that links between them are defined;
verify that all technical requirements set in the ABLs are traceable in detailed design of
configuration items;
verify that all technical requirements allocated in the detailed design cover all technical
requirements defined in ABL and, as needed, in FBL.
TRR: Test Readiness Review:
verify that functional and allocated baselines are updated and approved;
verify that all data describing physical characteristics of the product are documented, formalized
and available;
verify the implementation of approved deviations in the product configuration baseline submitted
for qualification;
verify the implementation of approved technical changes in the product configuration baseline
submitted for qualification;
verify and identify whether gaps exist between as-built configurations for product units when
several units will be used for qualification;
verify that these units are in a stable status and as much as possible representative for future mass
production;
verify that the configuration characteristics of producing and testing means having an impact on
the system configuration are available.
QR: Qualification Review:
verify that corrective actions and concessions - deviations or concessions - (or their closing) have
been taken in account following configuration audits;
10
---------------------- Page: 12 ----------------------
SIST EN 9223-103:2018
EN 9223-103:2018 (E)
there are no more verifications strictly speaking: the qualification process includes FCA and PCA at
the appropriate moment and level. This review uses (among others) the conclusion of the
configuration audits and of actions that follow them to pronounce qualification or not.
PRR: Production Readiness Review:
verify that the configuration of industrial realization means does not jeopardize the system or item
configuration;
verify that all technical changes approved since configuration audits occur at the level of PRR
achievement are embedded and that all gaps are subject to approved concessions (an as-designed
configuration exists).
FAI: First Article Inspection:
verify as-designed and as-built configurations;
verify implementation of approved concessions and technical changes.
ELR: End of Life Review:
verify the accuracy of as-built configuration;
verify identification of items or material subject to specific risk useful for dismantling.
5.3 Configuration audits
5.3.1 Configuration audits overview
Functional and physical configuration audits consist in evaluating objective evidences that the
technical requirements in FBL and ABL are met; they do not consist in performing verification of
these requirements.
The PBL is definitively approved only after the achievement of both configuration audits.
5.3.2 Preliminary operations
Before any configuration audit FCA and PCA, it is suitable to verify that the audit support is in a stable
status (documentation and equipment).
Some preparing operations for these audits have to be carried on to ensure their good progress. These
operations must have been planned (what, who, how, where and when) in details.
gather all the documentation that will be used as support for the audits, and imperatively the
configuration documentation candidate to become configuration Production Baseline. That
documentation must be complete and shall include reports of previous configuration audits at the
same level.
The various necessary documents are resumed in details in the following paragraphs:
make the realized unit (or several) available that will be used for physical configuration audits;
assure that necessary means for achieving audits are available (particularly human resources);
11
---------------------- Page: 13 ----------------------
SIST EN 9223-103:2018
EN 9223-103:2018 (E)
issue the convocation on required schedule.
5.3.3 Audit committee
3
The Audit committee is the working group that will examine the evidences displayed during each audit
to verify the consistency between the product and its configuration information. It is set up with various
functions some are systematically concerned and others depend on audit perimeter (concerned
configuration item, contractual requirements, etc.).
The Audit committee shall include:
4
a chairman who takes over the final decision-making and rules in last resort;
a session report secretary in charge of taking notes and writing report;
perhaps an organizer in charge of conducting the configuration audit according to the planned
procedure;
experts who assist the chairman.
According to the importance of the audit, these roles may be merged or not.
The audit chairman is the function that takes over the decisional authority. Contractually, the Customer
may also jointly chair (the notion of “co-chairman” implies that the final decision shall be a common
decision of both co-chairmen) the audit committee or participates to the group (directly or by
delegating to a representative duly appointed) according to the contract terms.
The main functions appearing in an audit committee may be (indicative, but not limited to):
the management responsible person(s) for the configuration item development;
the technical responsible person(s) involved in the configuration item development and realization;
the subcontractor(s) involved in the configuration item design;
the person responsible for the Configuration Management system in the organisation;
the quality assurance representative involved in the configuration item development;
the responsible person(s) for verification activities performed on the configuration item, so as
those for test resources used;
etc.
If it is about an audit performed on an important or complex system or subsystem, the audit committee
may decide to define working groups with specific objectives.
3
The term “audit committee” can be replaced by “audit group” or any other word according to the company and the
programme culture.
4
The term “chairman” of the audit committee can be replaced by “manager” of the audit committees or any other term,
according to the company culture.
12
---------------------- Page: 14 ----------------------
SIST EN 9223-103:2018
EN 9223-103:2018 (E)
5.3.4 Performing the audits
Unless the audited product is of medium complexity, the audit process could rely on various successive
(and planned) examinations that may be separated by particulars operations changing the
configuration information of the product or system.
In that case, each step of an audit shall take into account the results of the previous steps, so as
configuration control activities for the product between these steps. The final conclusion of the audit
shall rely on a synthesis of the conclusions for the various steps.
As a general rule, a configuration audit starts with a reminder of the objectives of the audit, its
perimeter and the decision criteria included those which define if a problem is a major or a minor one.
Then the examination of evidences produced takes place, with recording of the debates.
The chairman of the audit concludes by pronouncing the final decision (successfully passed, passed
with restriction, rejected) and by recalling the possible action list when there are reservations.
The audit report is then written and approved by all the participants.
5.3.5 Functional configuration audit (FCA)
The functional configuration audit of a configuration item (system, product or item) at its level consists
in verification that the performances specified in the configuration information included in the previous
configuration baseline are integrally satisfied by the
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.