EN 9223-103:2018

SLOVENSKI STANDARD
01-maj-2018
Vodenje programov - Vodenje konfiguracije - 103. del: Preverjanje konfiguracije,
pregledi in revizije
Programme Management - Configuration Management - Part 103: Configuration
Verifications, Reviews and Audits
Programm-Management - Konfigurationsmanagement - Teil 103: Überprüfungen,
Reviews und Audits der Konfiguration
Management de Programme - Gestion de la Configuration - Partie 103 : Vérifications,
revues et audits de la configuration
Ta slovenski standard je istoveten z: EN 9223-103:2018
ICS:
03.100.70 Sistemi vodenja Management systems
49.020 Letala in vesoljska vozila na Aircraft and space vehicles in
splošno general
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

EN 9223-103
EUROPEAN STANDARD
NORME EUROPÉENNE
March 2018
EUROPÄISCHE NORM
ICS 35.080; 49.020
English Version
Programme Management - Configuration Management -
Part 103: Configuration Verifications, Reviews and Audits
Management de Programme - Gestion de la Programm-Management - Konfigurationsmanagement
Configuration - Partie 103 : Vérifications, revues et - Teil 103: Überprüfungen, Reviews und Audits der
audits de la configuration Konfiguration
This European Standard was approved by CEN on 25 September 2017.

CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this
European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references
concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to any CEN
member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN member into its own language and notified to the CEN-CENELEC Management
Centre has the same status as the official versions.

CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia,
Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania,
Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland,
Turkey and United Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION

EUROPÄISCHES KOMITEE FÜR NORMUNG

CEN-CENELEC Management Centre: Rue de la Science 23, B-1040 Brussels
© 2018 CEN All rights of exploitation in any form and by any means reserved Ref. No. EN 9223-103:2018 E
worldwide for CEN national Members.

Contents Page
European foreword . 3
Introduction . 4
1 Scope . 5
2 Normative references . 5
3 Terms and definitions . 5
4 The configuration verification, review and audit processes and their place in the
overall programme Configuration Management . 6
4.1 Configuration verification and audit process overview . 6
4.2 Nature of the configuration verification and audit process . 6
4.3 Configuration audits: ending activity and starting point. 7
4.4 Configuration verification activities preliminary to the audits . 8
5 Configuration verification, review and audit activities . 9
5.1 Configuration verification, review and audit activities overview . 9
5.2 Verifications during programme reviews (or equivalent milestones) . 9
5.3 Configuration audits . 11
5.4 Relationship between FCA, PCA, configuration baselines and qualification . 16
6 Specific cases. 17
6.1 Configuration audits resumption during the product life . 17
6.2 COTS, Components Off The Shelf. 18
6.3 Configuration item common to several programmes . 18
6.4 Coherence between the product and specific means . 19
(informative) Verification methods that can be used to prepare a configuration
audit . 20
(informative) Examples for configuration audit procedures . 21
B.1 General . 21
B.2 Example of activities to be included in a configuration audit procedure . 21
B.3 List of points to verify for a FCA . 22
B.4 List of points to verify for a PCA . 23
Bibliography . 25

European foreword
This document (EN 9223-103:2018) has been prepared by the Aerospace and Defence Industries
Association of Europe - Standardization (ASD-STAN).
After enquiries and votes carried out in accordance with the rules of this Association, this Standard has
received the approval of the National Associations and the Official Services of the member countries of
ASD, prior to its presentation to CEN.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by September 2018, and conflicting national standards
shall be withdrawn at the latest by September 2018.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN shall not be held responsible for identifying any or all such patent rights.
According to the CEN-CENELEC Internal Regulations, the national standards organisations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia,
France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta,
Netherlands, Norway, Poland, Portugal, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland,
Turkey and the United Kingdom.
Introduction
The finality of Configuration Management is to assure during the whole product lifecycle :
 consistency and commonality of the technical information among all actors;
 traceability of this technical information.
For that purpose, Configuration Management organizes and implements the following activities:
 selection of items and technical information that shall be submitted to Configuration Management,
under clearly established responsibility (configuration identification);
 capture, keeping this information and making it available (configuration status accounting);
 verification and validation of the coherence of this information at defined steps of the product
lifecycle (configuration verifications, reviews and audits);
 technical changes and gaps processing in order to keep the consistency of this information
(configuration control).
See EN ISO 9000:2015.
1 Scope
The present document:
 is based on internationally-recognized concepts;
 proposes organisational principles and implementation processes for Configuration Management
from both viewpoints: “programme” and “company”, with emphasis on the “programme”
viewpoint;
 deals with verifications, reviews and audits tending towards the validation of the configuration
information consistency. It details the principles described in EN 9223-100.
It is up to each programme responsible person to define the necessary details of application and
tailoring in the Configuration Management plan.
Important remark:
Configuration audit doesn’t be confused with quality audit (for detailed information, see 4.1).
This document does not deal with configuration system audits (quality audit) deployed within the
scope of a programme. These audits stem from quality audits as defined in EN ISO 9001 (process
conformity or efficiency audits).
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced document (including any amendments) applies.
EN 9100, Quality Management Systems — Requirements for Aviation, Space and Defence Organizations
EN 9223-100, Programme Management — Configuration Management — Part 100: A guide for the
application of the principles of configuration management
EN 9223-101, Programme Management — Configuration Management — Part 101: Configuration
identification
EN 9223-105, Programme Management — Configuration Management — Part 105: Glossary
EN ISO 9000, Quality management systems — Fundamentals and vocabulary
EN ISO 9001, Quality management systems — Requirements
3 Terms and definitions
For the purposes of this document, the terms and definitions given in EN ISO 9000, ISO 10007 and
EN 9200 apply.
ISO and IEC maintain terminological databases for use in standardization at the following addresses:

Published as ASD-STAN Prestandard at the date of publication of this standard http://www.asd-stan.org/.
• IEC Electropedia: available at http://www.electropedia.org/
• ISO Online browsing platform: available at http://www.iso.org/obp
The specific terms needed to understand and to use the document are the object of definitions
appearing in EN 9223-105.
4 The configuration verification, review and audit processes and their place in
the overall programme Configuration Management
4.1 Configuration verification and audit process overview

Figure 1 — Place of the configuration verification, review and audit process in Configuration
Management processes
Important remarks:
Configuration audits shall in no case be performed by third party auditors (organisms
accredited to deliver audits certificates on quality systems) because of the risk of losing
restricted know-how. They are normally performed by a first party auditor (belonging to the
company) and up to a point by a second-party auditor (customer).
4.2 Nature of the configuration verification and audit process
Configuration verification occurs at determined milestones during the system or product lifecycle,
essentially linked to establishing and approval of configuration baselines and to verification of the
conformity of a specific unit of the product or achieved configuration item to these configuration
baselines.
The configuration verification shall:
 assure that the design of the product guarantees the fulfilment of the specified requirements;
 validate the completeness and the accuracy of the product configuration information;
 assure the consistency between a product and its product configuration information;
 guarantee that the configuration control process shall be able to maintain the fulfilment of the
requirements and the consistency between the product and its configuration information during
the remaining of the lifecycle;
 guarantee that controlled configuration information is the basis for operational use, support,
training, spare parts and repairs.
Configuration verification uses the configuration audit technique, which consists in:
 comparing defined characteristics in a configuration baseline to those presented by a realized and
representative of to-be-delivered system, product or configuration item;
 identifying and highlighting gaps;
 obtaining an approved decision for each of them (concession or setting in conformity).
As the programme flows however, a certain amount of data belonging to configuration information and
some Configuration Management activities linked to the phase of programme flow down can be subject
to verifications. These verifications are achieved during configuration audits and reviews that sequence
the lifecycle.
4.3 Configuration audits: e
...