So much is happening in the quality and related world. ISO 9001:2026 is on the way, and the mid-September update this year changes look superficial but go deeper than a checklist update. The implementation is being more closely looked at then just cosmetic lip service. Leadership accountability, use of risk inputs to drive opportunity, and then the emphasis on effective root cause analysis is all being redefined. This will be then followed with updates to other standards in the harmonized structure (HS) and the aerospace standards.
In this article against this changing background, I want to look at the focus of aerospace suppliers. For commercial or defense suppliers preparing to bid on tier-1 or prime contractor awards, technical capability and competitive pricing are only half the equation. Prime contractors operate under stringent regulatory oversight, where a single non-conforming part or untraced engineering change can ground an aircraft, void a defense contract, or jeopardize mission safety. Therefore, before submitting a bid, suppliers must understand that a Quality Management System (QMS) built to AS9100 lead auditor certification is not just an operational advantage-it is a mandatory license to compete. Then why AS9100 is a prerequisite, and not a differentiator, in Aerospace, is a valid question.
In commercial manufacturing, ISO 9001 certification often serves as a competitive differentiator that signals product reliability. In aerospace, defense, and space supply chains, AS9100 certification is table stakes. Prime contractors (such as Boeing, Lockheed Martin, Northrop Grumman, and Airbus) maintain strict, approved vendor lists (AVLs). To gain initial consideration for a request for proposal (RFP), suppliers must show evidence of AS9100 compliance and maintain an active profile in the online aerospace supplier information system (OASIS) database. Having AS9100 does not win you the bid, it simply earns you a place at the table. Lacking it automatically disqualifies your bid during pre-qualification screening, regardless of your technical prowess or low-cost structure.
Therefore, it is important to consider how prime contractors vet supplier quality systems. Achieving AS9100 certification gets a company listed on the AVL, but prime contractors conduct their own rigorous supplier evaluation before awarding contracts. Tier-1 buyers do not rely solely on third-party audit certificates. They perform deep-dive supplier quality assessments to evaluate operational capability including checking OASIS database audit history. Primes inspect past third-party audit results, minor/major Non-Conformance Reports (NCRs), and corrective action (CA) performance recorded in OASIS.
Primes conduct on-site pre-award audits. Quality engineers evaluate physical shop-floor controls, calibration records, tool storage, material handling, and overall culture. Then there is the sub-tier supplier control. OEM auditors inspect how effectively you flow down technical and quality requirements to your sub-tier suppliers. On-time delivery (OTD) and quality metrics are looked at including historical performance data on parts per million (PPM) defect rates and delivery performance. Looking at the AS9100 (IA9100) and ISO 9001 changes for aerospace suppliers we see that the AS9100 Rev D encompasses the full text of ISO 9001:2015, layering over 100 aerospace-specific additions. Transitioning from ISO 9001 to AS9100 requires shifting from general process controls to strict risk prevention and traceability.
| Area | ISO 9001:2015 | AS9100 Rev D (Aerospace Addition) |
| Risk Management | High-level consideration of organizational risks and opportunities. | Formal operational risk assessment integrated into production planning and design. |
| Product Safety | Implicit within customer satisfaction and product quality. | Explicit mandatory requirements to identify safety-critical characteristics and lifecycle risks. |
| Counterfeit Parts | Basic vendor oversight and purchasing controls. | Strict policies for counterfeit part prevention, source verification, and segregation. |
| Configuration | Basic control of documented changes and revisions. | Formal Configuration Management across design, manufacturing baselines, and engineering changes. |
| Supplier Control | General evaluation and selection of external providers. | Mandatory requirement flow-down (e.g., test reports, NADCAP ((National Aerospace and Defense Contractors Accreditation Program)) requirements, retention periods). |
For organizations building or upgrading an aerospace QMS prior to bidding on contracts, implementation should follow a structured approach including perform a gap analysis. Benchmark existing processes against AS9100 Rev D clauses to pinpoint missing controls (e.g., risk matrices, counterfeit mitigation, or design verification tools). Formalize Operational Risk Management by establishing systematic methods (such as FMEA or risk registers) to assess operational risks prior to taking on new job orders. Additionally, to establish requirement flow-down mechanics by building controls ensuring customer purchase order requirements, engineering drawings, and quality clauses are automatically flowed down to sub-tier suppliers and shop-floor traveler routes. Then there is the need to train key personnel by educating leadership, process owners, and shop-floor staff on aerospace quality imperatives, emphasizing individual contributions to product safety and ethical behavior. Finally, to execute internal audits & management reviews by conducting full internal audit cycles to verify process effectiveness before inviting an accredited registrar / certification Body (CB).
There are of course the configuration management and traceability requirements. The aerospace documentation burden is significantly higher than in general manufacturing, largely centered around configuration management and full material/process traceability. For configuration management (AS 9100 clause 8.1.2) organizations must control the design and manufacturing baseline. Every engineering change order (ECO) must evaluate impact on form, fit, function, and test procedures before implementation. Traceability & identification (AS 9100 clause 8.5.2): Suppliers must maintain bidirectional traceability from raw material heat numbers and special process certs to individual batch or serial numbers. Acceptance media control requires use of physical inspection stamps, electronic signatures, or system authorizations must be strictly controlled to prevent unauthorized signoffs.
Looking ahead auditing as emphasized in the revised ISO 19011:2026 and anticipated changes in ISO 9001:2026 (coming in September) the lead auditor and internal auditor training will require the team needs of the audit team to build internal competency as an essential for both initial certification and ongoing audit survival. When for example evaluating QMII training tracks for staff, matching the course depth to internal roles ensures both compliance and resource efficiency.
- Internal Auditor Training (2 to 3 Days):
- Target Audience: Quality managers, process owners, manufacturing engineers, and internal audit team members.
- Focus: Understanding AS9100 Rev D requirements, ISO 19011 auditing principles, preparing checklists, gathering evidence, and writing clear non-conformance reports.
- Objective: Conduct periodic internal audits to keep the QMS healthy and compliant.
- Lead Auditor Training (4 to 5 Days):
- Target Audience: Quality Directors, Chief Auditors, lead consultants, or staff managing complex multi-site QMS programs.
- Focus: Deep mastery of standard intent, lead-auditor protocols, managing audit teams, lead-closing meetings, and assessing root-cause corrective actions (RCCA).
- Objective: Drive strategic management system improvement and interface effectively with third-party certification bodies and prime contractor oversight teams.
Certification must be maintained through supplier audits. Achieving your initial certificate is only the baseline; maintaining it requires continuous readiness. Prime contractors and certification bodies conduct recurring surveillance audits to ensure systems do not degrade over time.
- Maintain Robust Root Cause Corrective Action (RCCA): Move beyond surface-level fixes. Utilize structured methodologies like 5-Why Analysis or Fishbone (Ishikawa) Diagrams to resolve internal and customer-reported issues permanently.
- Monitor Key Performance Indicators (KPIs): Track metrics continuously across process effectiveness, product conformity, and on-time delivery.
- Conduct Continuous Process Audits: Audit high-risk shop floor operations, special processes, and sub-tier supplier handling throughout the year, rather than rushing preparation right before the third-party surveillance audit.
—
About the Author:
Inderjit (IJ) Arora, Ph.D., is the Chairman of QMII. He serves as a team leader for consulting, advising, auditing, and training regarding management systems. He has conducted many courses for the United States Coast Guard and is a popular speaker at several universities and forums on management systems. Arora is a Master Mariner who holds a Ph.D., a master’s degree, an MBA, and has a 35-year record of achievement in the military, mercantile marine, and civilian industry.
