An AS9100 internal audit checks your quality system against AS9100, your own procedures, and your customers' and regulators' requirements, process by process. It follows the same clause 9.2 as ISO 9001. The difference is in what you audit against and how: aerospace audits start from process performance, and they include the requirements your customers flow down to you.
What AS9100 adds to the ISO 9001 internal audit
The structure of clause 9.2 is the one you know from ISO 9001: a program, criteria and scope, impartial auditors, reports to management, corrective action and records.
AS9100D adds two notes. The first says that the requirements you audit against should include customer requirements and applicable statutory and regulatory requirements for the quality system. The second says that performance indicators can be evaluated to judge whether the quality system is effectively implemented and maintained.
Everything else that is specific to aerospace sits in the other clauses, and the internal audit has to reach it: operational risk, configuration management, product safety, counterfeit part prevention, first article inspection, special processes and supplier flow-down.
Audit by process, starting with the numbers
Certification bodies audit AS9100 with the method in the 9101 standard. For each product realization process, their auditor records whether the process is reaching its planned results in a process effectiveness assessment report (PEAR). You are not required to use the 9101 forms internally. Following the same logic means your own audits find what the certification audit will find.
For each process, work in this order.
- Ask the process owner what the process is for, what its measures are and what the targets are.
- Look at the results for the last twelve months.
- Where a result missed its target, ask what was done and look for the record.
- Then go to the procedure and sample records to see whether the process runs as planned.
- Conclude whether the process is effective, and say why.
A process can follow its procedure and still be ineffective. If on-time delivery has been at 82 percent against a target of 95 for a year and nothing was done, that is a finding against the process, even if every form is filled in. The numbers here are an illustration.
What to check for each aerospace requirement
| Requirement | Clause in AS9100D | What to sample |
|---|---|---|
| Operational risk management | 8.1.1 | Risks recorded for two current orders or programs, with actions |
| Configuration management | 8.1.2 | One customer drawing change, traced to the work instruction in use |
| Product safety | 8.1.3 | How hazards are reported; training records for three people |
| Counterfeit part prevention | 8.1.4 | Two purchases from distributors: source approval, certificates, receiving check |
| Flow-down to suppliers | 8.4.3 | Five purchase orders against the customer requirements that apply |
| Special processes | 8.5.1.2 | Validation, operator qualification and equipment for one process |
| First article inspection | 8.5.1.3 | FAI reports for one new part and one part after a change |
| On-time delivery and conformity | 9.1.2 | Data for twelve months and actions on poor results |
Sample sizes in the table are a starting point. Take more where the first samples show a problem.
Download the free AS9100 audit readiness checklist (Excel)
It has 19 checks with AS9100D clause numbers and columns for evidence, actions and owners.
Bring customer requirements into the criteria
Most aerospace customers send their suppliers a quality requirements document. It sets rules on record retention, source inspection, approval of special process suppliers, notification of nonconformances and much else. These documents change, and many suppliers work from an old copy.
Before the audit, collect the current version from each main customer. Build a short list of the requirements that differ from your normal practice, and audit against that list. Record retention is a good first check: customers often ask for longer periods than your own procedure does.
Regulatory requirements belong here too. If you hold a repair station certificate or a production approval, or you handle export-controlled data, the audit program should show where those requirements are covered.
Who can run an AS9100 internal audit
Internal auditors need to be competent and independent of the work they audit. They do not need the authentication that certification body auditors hold. That scheme, set out in the 9104 series, applies to auditors who work for certification bodies.
What an internal auditor does need is knowledge of AS9100 beyond ISO 9001, an understanding of your customers' requirements, and enough technical background to follow a first article inspection report or a special process validation. An ISO 9001 internal auditor course is a start. Add training on the aerospace requirements and a few audits alongside someone experienced.
Small shops often cannot find anyone independent of quality, purchasing and production at once. Sharing auditors with another supplier or hiring an outside auditor for part of the program solves it. See how to hire an AS9100 lead auditor for what to look for.
How to plan the year
Rate each process by risk and by performance. A process that is missing its targets gets audited sooner and more often, whatever its nominal risk.
Cover every process and every AS9100 clause at least once between certification body visits. A matrix with processes down the side and clauses across the top shows quickly what has been missed. Certification auditors often ask to see one.
Audit second and third shifts if you run them. Findings on document revision and inspection status are more common there, because support staff are not on site.
Leave room in the schedule for unplanned audits. A customer escape, a failed source inspection or a new customer contract are all reasons to audit a process again before its turn comes.
What goes in the report
Keep the report short and specific. It should state the scope and criteria, the people interviewed, the records sampled by number, each finding with its evidence, and a conclusion on whether the process is effective.
Grade findings as major or minor in the way your certification body does. A major is the absence or breakdown of a required process, or a nonconformity that can result in nonconforming product reaching the customer. Using the same grading lets management see the result in the form an external audit would give it.
For each nonconformity, the process owner provides containment, root cause and corrective action. Where the cause involves people, look at human factors such as fatigue, time pressure or unclear instructions before settling on retraining. Then verify that the action worked.
Report the results to management review, with the trend over the last few audits.
Mistakes we see in AS9100 internal audits
Auditing clause by clause from a generic ISO 9001 checklist is the most common one. The aerospace requirements get one question each, and process performance is never looked at.
The second is leaving customer requirements out. The internal audit passes, and the customer's source inspector finds the gap a month later.
The third is treating the internal audit as a yearly event. One week of audits in the month before surveillance leaves no time to fix anything.
The last is closing findings on paper. A corrective action is closed when someone has gone back and seen that the problem has not returned.
Frequently Asked Questions
How often must AS9100 internal audits be done?
At planned intervals that you set. Most certified companies cover all processes and all clauses each year, and audit weak or high-risk processes more often.
Do AS9100 internal auditors need special certification?
No. They need to be competent and impartial. The authentication scheme for aerospace auditors applies to certification body auditors.
Can we use the PEAR form for internal audits?
Yes. It is not required, and many companies use it or a simpler version of it, because it makes the auditor look at whether each process reaches its targets.
Can internal audits be outsourced?
Yes. An outside auditor is common for small shops and for the processes where independence is hard. You remain responsible for the program and for corrective action.
What is the difference between an internal audit and a pre-audit?
The internal audit is a required part of the system and runs all year. A pre-audit is a rehearsal shortly before a certification audit. See AS9100 audit preparation for how to use one.
Related insights
- AS9100 Audit Preparation: What Auditors Check
- What happens in an AS9100 audit? Stages, findings and the three-year cycle
- Aerospace audits explained: the five types and who performs them
- ISO 9001 Internal Audit: Program, Plan and Checklist
Get an independent auditor
ElevateQCS matches aerospace suppliers with vetted, independent AS9100 auditors for internal audits and pre-audits. Find an AS9100 auditor
General guidance. AS9100 is a copyrighted standard; refer to your purchased copy, your customers' requirements and your certification body.
Sources
These references provide standards, regulatory text, or background context. They do not independently validate every recommendation in this article. Linking does not imply endorsement. Standards may require purchase; refer to the publisher for the current text.
