AS9100 is the quality management standard for the aerospace industry. If you are a contract manufacturer making parts for aerospace primes, you either have it, are working toward it, or your customers are asking when you will.
The standard is comprehensive — it builds on ISO 9001 and adds aerospace-specific requirements around configuration management, risk, special processes, and traceability. For a shop with 10 to 50 employees, the challenge is not understanding what AS9100 requires. It is implementing it without drowning in paperwork or hiring a full-time quality manager.
This checklist covers the twelve areas auditors focus on most. For each, we describe what they are looking for, what "good" looks like at a small shop, and what triggers a finding.
1. Document control
What auditors look for: controlled documents (SOPs, work instructions, specs) with revision history, approval records, and a process for distributing updates. What triggers a finding: operators working from outdated prints, no record of who approved the current revision, or uncontrolled copies floating around the shop floor.
2. Record retention
What auditors look for: quality records (inspection reports, material certs, test results) stored in a retrievable system with defined retention periods. What triggers a finding: records that cannot be located within a reasonable time, no defined retention policy, or records stored in personal email inboxes.
3. Configuration management
What auditors look for: a process for managing product configuration — part numbers, revisions, and effectivity. When a design changes, there must be a documented change process. What triggers a finding: parts shipped against the wrong revision, no formal change request process, or build plans that do not reference a specific revision.
4. Risk management
What auditors look for: evidence that you identify and mitigate risks to product quality and delivery. This does not require a formal FMEA for every product — but there should be documented consideration of risk. What triggers a finding: no risk assessment records, or risk identified but no evidence of mitigation.
5. Purchasing and supplier control
What auditors look for: an approved supplier list, incoming inspection procedures, and evidence that you verify purchased material meets spec. What triggers a finding: no incoming inspection records, purchasing from unapproved suppliers, or material certs that do not match the PO.
6. Production planning and control
What auditors look for: documented work orders or travelers that define what to make, how to make it, and what materials to use. Each job should reference the correct revision of the build plan. What triggers a finding: jobs running without a work order, work instructions that do not match the current revision, or no record of which build plan was used.
7. First article inspection
What auditors look for: a formal FAI process that verifies the first unit of a new part (or new revision) meets all drawing requirements. Results must be documented and approved. What triggers a finding: FAI not performed on new parts, incomplete measurement records, or FAI done but not formally approved before production continued.
8. Traceability
What auditors look for: the ability to trace a shipped part back to its raw materials, work order, inspection records, and operator. For serialized parts, this must be per-unit. For batch items, per-lot is acceptable. What triggers a finding: gaps in the traceability chain — for example, a work order that consumed material but no record of which lot was used.
9. Nonconformance and corrective action
What auditors look for: a documented process for handling nonconforming product (quarantine, disposition, root cause analysis) and a corrective action system that tracks issues to closure. What triggers a finding: nonconforming product not segregated, no root cause analysis, or corrective actions opened but never closed.
10. Calibration
What auditors look for: measuring equipment (calipers, micrometers, CMMs) calibrated on schedule with traceable standards. Calibration records must include dates, results, and the next due date. What triggers a finding: overdue calibrations, no calibration records, or measurement equipment in use without a calibration sticker.
11. Internal audit
What auditors look for: evidence that you audit your own quality system at planned intervals. Internal audits should cover all clauses of AS9100 over a defined cycle. What triggers a finding: no internal audit schedule, audits not performed, or findings from internal audits not addressed.
12. Management review
What auditors look for: periodic management review meetings where leadership reviews quality system performance, customer feedback, audit results, and corrective action status. Meeting minutes must be documented. What triggers a finding: no management review records, or reviews that do not cover the required inputs (audit results, customer complaints, process performance).
Staying audit-ready year-round
The shops that struggle with AS9100 audits are the ones that prepare for audits. The shops that pass easily are the ones that run their quality system every day, not just when the auditor is coming.
The difference is not effort — it is infrastructure. When your work orders, material records, inspection results, and document control all live in one system, compliance is a byproduct of doing your normal work. You do not prepare for the audit; you just pull the records.
When those records live in spreadsheets, paper files, email threads, and someone's desk drawer, every audit becomes a frantic two-week data-gathering exercise. The information exists — it is just scattered.
Practical next steps
- Pick the three weakest areas from the checklist above. Be honest about where your gaps are.
- Fix the infrastructure first. Most findings are not about missing processes — they are about missing records. If the process happens but no one documents it, the auditor sees a gap.
- Automate what you can. Audit trails, revision control, and material traceability should be system-generated, not manually maintained. Manual records are only as reliable as the person updating them.
- Do a mock audit. Walk through the twelve items above with someone from your team playing the auditor. If you cannot produce a record within two minutes, that is a finding waiting to happen.
AS9100 is achievable for small shops. The standard does not require enterprise-grade complexity — it requires consistent, documented processes. The right system makes that consistency automatic instead of heroic.