Author: Anjalika Singh

AS 9100 is applicable to any organization as a choice but is often a business demand. Aerospace is a vast field and has major and minor players. Does it therefore imply that tier 2 and tier 3 suppliers should go through the same documentation burden as a primary aerospace organization? This is a dilemma faced by tier 2/3 suppliers. I have often thought about this. This short article based on QMII experience is specifically written for AS9100 Tier-2/3 Suppliers and how they can maintain the balance between control and still maintain agility and meet the requirements of the standard.

Tier-2 and Tier-3 aerospace suppliers face a unique dilemma, the need to meet AS9100’s rigorous expectations while working with limited resources and tight delivery schedules. Customer flow-downs, documentation demands, and special-process scrutiny can quickly overwhelm small teams. The key challenge is achieving effective control without unnecessary bureaucracy, preserving the agility that keeps smaller suppliers competitive. This special article is aimed at this need of the tier 2/3 suppliers.

The supplier’s challenge in aerospace quality comes from the aerospace customers bringing layers of requirement complexity, unique quality clauses, FAIR specifics (First Article Inspection Report, and the broader process called First Article Inspection (FAI), special-process certifications, customer portals, and documentation formats. These customer-specific expectations often exceed the base AS9100 standard and force Tier-2/3 suppliers to interpret, prioritize, and integrate a landscape of varied demands. Without a structured approach, they risk creating bloated systems that satisfy auditors on paper but hinder production flow.

Understanding AS9100 Clause 8 – operational controls is therefore essential. Clause 8 is the operational heart of AS9100, setting expectations for planning, process control, risk mitigation, and configuration management. It emphasizes that conformity comes from effective planning and controlled execution, not from sheer volume of documents. Suppliers must ensure that personnel have the right information at the right time, that processes are validated where outcomes cannot be fully verified after the fact, and that changes are managed with discipline. For small suppliers, the goal is implementing these controls proportionally to risk, not copying OEM (original equipment manufacturers)-level tier 1 systems.

Minimum-Viable Risk (MVR) must be considered as a pragmatic interpretation of AS9100. AS9100 demands risk-based thinking, but many small suppliers interpret this as “more forms” instead of “better decisions.” MVR provides a method to match controls to actual consequences. It prevents systems from becoming document-heavy while maintaining the safeguards needed for aerospace.

Basic MVR principles include:

1. Identifying what can truly go wrong (escape, defect, missed requirement).
2. Assessing the severity of consequence.
3. Matching control strength to risk severity—not habit or tradition.
4. Eliminating duplicate or ritualistic checks.
5. Documenting the rationale for proportional controls.

MVR (monitoring, verification, and reporting) is simplicity with discipline and is the heart of AS9100 done well. It includes applying MVR to special processes without gridlock. Special processes, like welding, heat treat, coatings, NDT (nondestructive testing), bonding pose inherently higher risks because results cannot be fully verified after production. However, small suppliers can maintain strong control without drowning in paperwork. They should control inputs, not layers of signatures. Validate equipment capability, freeze key parameters, ensure personnel competency, and maintain controlled settings. Excess signatures do not improve quality, controlled inputs do.

The tier 2 and 3 suppliers should build process ownership. Escapes in special processes usually stem from incorrect settings, outdated drawings, or tribal knowledge. An escape is a defect that leaves your organization and reaches the customer. A single-point accountability model, owned by the welding lead, NDT supervisor, or coating tech reduces error pathways better than multiple inspectors. Also, use of one-page critical parameter sheets condenses travelers into one-page sheets listing key variables, limits, and required verifications. This approach focuses on what actually matters to conformity.

Another important organizational priority of tier 2/3 suppliers (AS 9100 clause 4.4.1) is to right size the QMS to their risk level. AS9100 allows flexibility, and small suppliers should embrace it. Not every process requires the same level of documentation, inspection, or validation.

• Low-risk machining or simple assembly can rely on straightforward checks.
• High-risk special processes need tighter controls, but not excessive forms.
• Different supplier tiers have different expectations; Tier-3 machining houses need far less documentation than Tier-1 system integrators. 
• A right-sized QMS is efficient, compliant, and scalable.

Then there is the use of practical supplier evaluation methods. Supplier oversight does not have to involve 12-page questionnaires or annual onsite audits. AS9100 encourages objective, data-driven oversight:

• On-Time Delivery (OTD).
• NCR (non-conformity report) and escape trends.
• Responsiveness to containment.
• Corrective action effectiveness.

This approach is more reliable than generic forms and lets purchasing focus on high-risk, high-impact suppliers.

Then there are the common audit weaknesses in tier suppliers. QMII’s audit experience reveals recurring issues across Tier-2/3 organizations:

• Manuals copied from templates that do not match actual practice.
• Weak configuration control, especially in revision management.
• Inconsistent traceability in special processes and outsourced steps.
• Internal audits that check boxes instead of evaluating system effectiveness.
• Training records that prove attendance but not competency.
• Excessive documentation without actual operational control.

These weaknesses stem not from lack of effort, but from systems that were built to “pass audits” rather than ensure reliability.

Using MVR to reduce escapes and customer returns. Most escapes involve incorrect flow-downs, poor configuration management, or over-reliance on manual documentation. MVR shifts focus from detection to prevention, reducing escapes by simplifying controls and strengthening process discipline. Early requirement clarification, targeted training, and controlled process inputs all contribute to fewer customer complaints and more predictable performance.

As an example, perhaps a recommendatory timeline from QMII for consideration could be for a Tier-2/3 implementation blueprint (90 Days) would be three phased. Phase 1 – Diagnose (Weeks 1–3).  Map critical processes, identify friction points, and assess risk using MVR. In Phase 2 simplify (Weeks 4–8), streamline travelers, create one-page control sheets, and combine competency and training logs. Finally in Phase 3 – reinforce (Weeks 9–12), clarify process ownership, audit for effectiveness, and pilot new controls. This, I think, builds a lean, compliant AS9100 system with predictable output.

In conclusion and as a call to action I would say a streamlined, risk-aligned AS9100 system allows Tier-2/3 suppliers to maintain compliance without sacrificing agility or productivity. By matching control depth to risk, strengthening special-process discipline, and using data-driven supplier monitoring, organizations can reduce escapes, satisfy customers, and maintain competitive flow.

For suppliers looking to strengthen their capability, QMII offers AS9100 auditor training that emphasizes process-based auditing, practical system improvement, and real-world risk management—equipping teams to build QMSs that are both compliant and efficient.

In some organizations QHSE functions and the associated management system are seen merely as compliance requirements and not as a value add to the system. As such, budgets allocated to QHSE programs are viewed as an overhead. Since they are viewed as not directly contributing to the bottom line.

Mature organizations realize the impact QHSE programs have on a system. A conforming service or product means lesser returns, greater customer satisfaction, better employee morale, lower operating costs and better governance. The cost of not having an effective QHSE program is much higher. 

However often it is left up to the QHSE program managers to justify their budgets and in some cases the program itself. In an organization I was supporting, the QC function tried to get rid of the QA program completely, citing it was redundant. Here is where having good metrics can justify the value add the QHSE and Internal Audit Functions provide.

Why “Audit Value” Is Under Scrutiny in 2026

When perceived as merely a compliance check box the internal audit can seem an expensive proposition. There are many other means of oversight within the organization including leadership ‘GEMBA’ walks, inspections, supervisor oversight and a plethora of other audits including customer audits. 

Attempting to go beyond the bare minimum to merely meet a requirement, increases internal audit budgets. Justifying high overhead costs to an investor or stakeholder that is taking away from the profit margins may be challenging for leadership. 

Internal audits are meant to sample the system to assess its continuing effectiveness. Note sample. Not to guarantee its effectiveness. When a regulatory audit identifies an issue that was missed by an internal auditor the board and others may question the effectiveness of such programs. They may fail to recognize that the scope and objective of the two audits may have been different. 

The Shift from Compliance Audits to Performance Audits

Internal Audit functions began in the financial world in the 16th century. They expanded to focus on quality outputs during the World Wars. At the time the focus was merely on ensuring a quality output with little focus on the process. Ever since system thinkers have been trying to change the mindset about audits with little progress.

Traditional Compliance-Driven Audit Models

Traditionally, as stated above, audits were about ensuring compliance and conformity. Little importance was given to the amount of scrap, waste or rework. Customer satisfaction was the goal and many a time with impact on the efficiency of the process. During the wars it did not matter how many products were non-conforming so long as they were identified and segregated.

Audits were merely about ensuring the requirement was met. This has since changed.

Modern Performance-Driven Audit Models

Internal audits now focus on the continuing adequacy, suitability and effectiveness of the system. The goal of management systems has changed from being a reactive tool to being a proactive approach to identifying and managing risks to the system. Standards now ask organizations to assess the context of operations, risks to meeting objectives and action taken to ensure that the objective can be met.

Audits thus use a risk based approach to this planning to ensure that the the system is performing as expected and will continue to do so.

Defining “Value” in an Internal Audit Context

So what is meant by a value-added audit? It is one that uses a risk based approach to sample the controls and resources in the system. Based on this sample, the auditor is assessing the effectiveness of the system (think people, processes and their interaction) to manage risks. 

Auditors accept that non-conformities and new risks may arise. They assess if the system will catch it timely and address it to ensure that the possibility of it impacting the system now and in the future is minimal.

Value is added by assessing process efficiency in meeting process and system objectives. In eliminating process waste. Finally audit outputs must provide insights to leadership on the state of the system. How is my system working? What are the risks? Where is it robust and where is it fragile? 

KPI Categories for Internal Audit Functions

Effective internal audit KPIs should reflect more than activity counts, grouping measures into categories that show how audits manage risk, improve processes, support compliance, and contribute to business performance.

Risk Management KPIs

Risk management KPIs evaluate how well internal audits identify, assess, and help reduce significant organizational risks before they escalate into issues.
Example: Cost of impact of high-risk audit findings if not timely identified.

Process Effectiveness KPIs

These KPIs focus on whether audit activities lead to measurable improvements in process performance, consistency, and control effectiveness over time.
Example: Reduction in repeat findings for the same process across successive audits.

Compliance Stability KPIs

Compliance stability KPIs track trends in regulatory findings and external audit results to indicate whether controls are becoming more reliable and sustainable, not just temporarily fixed.

Example: Year-over-year decrease in major nonconformities raised during external audits.

Business Impact KPIs

Business impact KPIs translate audit outcomes into tangible value, such as cost avoidance, downtime reduction, or improved decision-making, helping leadership see audits as a business enabler rather than a compliance exercise.
Example: Estimated cost savings from audit-driven corrective actions that prevent production delays or rework.

Linking Audit KPIs to Management System Performance

Organizations may find it challenging to find appropriate KPIs since you may not know the exact cost of the non-conformity unless it occurs. A general approximation can be made with assumptions outlined.

ISO 9001 – Quality Performance Indicators

Audit KPIs under ISO 9001 should demonstrate how audits contribute to consistent product and service quality, process control, and customer satisfaction.

Example: Reduction in customer complaints linked to corrective actions arising from internal audit findings.

ISO 14001 – Environmental Performance Indicators

For ISO 14001, audit KPIs should reflect how effectively audits identify environmental risks, compliance gaps, and opportunities to reduce environmental impact.

Example: Decrease in environmental incidents or permit deviations following audit-driven improvements.

ISO 45001 – Safety Performance Indicators

ISO 45001 audit KPIs should show how audits support hazard identification, risk reduction, and safer working conditions.

Example: Reduction in near-miss recurrence after audit findings addressing unsafe conditions or behaviors.

Why Most Audit Functions Fail to Demonstrate Value

As with all other processes, the internal audit function too should have a process objective that can be made measurable and should be based on the framework set in the policy. Read clause 6.2 read in conjunction with clause 5.2 of the ISO management system standards.
Often this KPI is merely the performance on an annual audit. Not even the outcome of the audit. Just that the audit was completed. This is because the audit is merely seen as an annual ritual that must be completed.
Without effective KPIs the value of the internal audit function cannot be highlighted to leadership and they cannot perceive the cost savings or rather the low investment costs for the high returns!

Building KPI-Driven Audit Programs – A System Approach

Defining Audit Objectives

Organizations must outline what it is that they want the audit program to achieve. Think beyond just compliance. An example of this may be “To provide timely insight to leadership on system risks and opportunities”

Mapping Processes

Based on this objective, now map the audit program to the processes within the system based on contextual issues impacting the system (example high turnover, supply chain issues, etc.). Use this as a basis to develop a risk based approach to performing internal audits. This would include the frequency of audits (some processes would get audited more than once a year based on risk), the selection of the audit team, the sample size and the duration of the audit.

Selecting Meaningful Indicators

With the audit objective achieved the program manager can now begin to select meaningful indicators of how the audit program has added value to the system. How it goes beyond checking for compliance and now identifies risk proactively

The Role of Auditor Competence in Measuring Value

As stated in the paragraph above the selection of the audit team is a critical step in the internal audit function. The organization must consider the competence of the auditor and select them based on the criteria outlined in ISO 19011. The auditor must then be assessed at some interval to determine their continuing competence.
Auditors must be impartial and objective and use a processes based approach to auditing. They must have the ability to perform analytical thinking, keeping their biases and prejudices at bay. Further the auditor must have the ability to frame good audit questions that seek to dive deeper and get a true picture of the functioning of the system.

How QMII Trains Auditors to Deliver Measurable Value

QMII’s auditor training focuses on developing professionals who can evaluate system effectiveness, identify real risk, and communicate insights that drive meaningful management action.

Process effectiveness auditing – Auditors are trained to assess how processes actually perform in practice, not just whether procedures exist, using evidence that links controls to outcomes.

Risk-based audit training – QMII emphasizes risk-based thinking so auditors prioritize what matters most to the organization, aligning audit focus with strategic, operational, and compliance risks.

Real-world audit case analysis – QMII training includes real audit scenarios and failures, helping auditors recognize systemic issues, weak signals, and unintended consequences that checklists often miss.

Executive-level reporting skills – Auditors learn how to translate audit findings into clear, focused insights that leadership can act on, rather than just a completed check-off list.

2026 and Beyond – The End of “Tick-Box” Auditing

Internal auditing can no longer survive as a compliance ritual measured by audit completion alone. As this article shows, audit functions that fail to quantify risk reduction, process effectiveness, compliance stability, and business impact will continue to be viewed as overhead, despite the very real cost of unmanaged risk, waste, incidents, and poor governance.

The future belongs to performance-driven, risk-based audits that provide leadership with clear insight into how well the management system is working, where it is fragile, and where it creates value. When supported by meaningful KPIs, competent auditors, and systems-aware training, internal audits move decisively beyond tick-box conformity and become a strategic tool for resilience, improvement, and sustained organizational performance.

Right-Sizing TSMS Under Subchapter M

The onset of regulatory requirements causes organizations to rush their efforts to ensure compliance within the deadline issued. Management systems while enabling compliance are not intended solely for compliance. Their primary purpose is to provide a framework for the organization to meet leadership objectives using a systemized approach. Additionally it is meant to act as a preventive tool so that organization can proactively manage risks. 

The requirements for Towing Safety Management Systems or TSMS were similarly met with organizations rushing to document (perhaps over-document) everything! Many implemented the TSMS just to pass an audit and keep records of “compliance”. The management system failed to reflect actual practices and thus created a burden of paperwork for those on board. Especially with small tow boats with limited crew this has created more problems. Further the system does nothing to improve safety in any way. 

The documentation (TSMS) now leads to further problems during audits because the written TSMS does not reflect the TSMS actually lived on board. Despite good intentions inconsistencies arise and COI deficiencies are identified. Management systems designed around the “as-is” enable organizations to develop an operationally realistic TSMS that matches how the company actually works and makes it easier to maintain. 

The Compliance Trap in Subchapter M Auditing

Subchapter M was intended to usher in a new era of safety within the towing vessel industry. This followed many years of regulatory development and was the result of an increase in accidents and incidents involving tow boats. However as with many regulatory requirements the focus has been merely compliance while work continues as normal. When a view of the management system equating compliance is taken then leadership ashore and on board tend to merely “fix” or “prepare” the system for internal and external audits.

Personnel forget that audits are merely a sampling of the system and not a comprehensive review. In some cases auditors tend to conduct the audits more like inspections than audits. They become merely a review of the paperwork then an assessment of actual practices on board. Auditors must verify the crew’s understanding of the system. However, in an effort to pass audits records are updated the day before, only the most well-versed crew members are presented to the audit team and practices are limited to the minimum so the auditors do not have much evidence.

Compliance focused audits therefore may fail to uncover the systemic causes of repeated deficiencies. 

Understanding the Audit Requirements in $138.315

One of the biggest misconceptions I see among operators is their understanding of what $138.315 actually expects during an internal audit. Many assume the regulation is asking for a paperwork confirmation exercise of “show me the TSMS manual, show me the forms,” and that’s enough to satisfy Subchapter M. But $138.315 is far more purposeful than a documentation review. It requires an internal evaluation that verifies two things: that the TSMS is implemented and that it is effective. This distinction is where operators fall short.

The regulation expects internal evaluations to be evidence-based, meaning the auditor must look beyond the binder and confirm that what is written actually reflects what happens on the vessel and in day-to-day operations. Operators often assume that if the forms are filled out and the policies exist, they are compliant. But $138.315 is explicitly tied to the idea of system performance, not paperwork completion. A beautifully formatted SMS means nothing if the crew doesn’t understand it or if the vessels operate differently from what the manual describes. This is why TSMS audits under Subchapter M must go deeper than document checks. 

Subchapter M is not trying to make life harder for operators. It is designed to ensure the TSMS reflects reality and results in safer, more reliable operations. When internal audits focus on objective evidence rather than documentation alone, they fulfill the intent of the regulation and help operators find the issues before the Coast Guard or TPO does.

Using Data to Drive Audit Priorities

As a preventive tool the management system must provide the leadership with the evidence needed to make data driven decisions. This is where well set KPIs provide the leadership with inputs needed to determine if the system is being implemented effectively as planned and to identify trends for timely action. The KPIs including near-miss trends, machinery downtime, and incident reports enable the organization to target audit areas. Not to solely focus on the problem areas but to take a deeper dive into these areas.

Internal auditors may use statistical based sampling to develop their audit plan. Such an audit plan is then a risk based plan that allows for a deeper dive in certain areas. Additionally the company may determine the need for special audits outside of the normal periodic timeframe. Operators however do not need to wait for an audit to take action on data trends. “Repeat offenders” (tasks, equipment, vessels, crew behaviors) when identified through trend analysis can be acted upon immediately. 

A key role is played here in the checklists that auditors use. Audit checklists should primarily consist of open ended questions that begin the conversation. Auditors then build on these based on the answers they receive. If auditors do not have follow on questions but merely stick to their documented checklist then the audit becomes more of an inspection. Further auditees know what to expect and prepare the system accordingly. 

The Designated Person’s Role in Effective Oversight

In a maritime management system the designated person or DP plays a critical role in the success of the system. The DP is the key interface between the shore management and the vessel management. Subchapter M requires the DP to effectively manage the TSMS on board beyond signing forms or attending audits. 

The DP has a responsibility for the safety on board and for the implementation of the TSMS. To this effect they have to monitor the safety on board. To achieve this they may get insights from  audit reports, NCRs, and trend data to inform management decisions. The DP plays a critical role in ensuring corrective actions address root causes, not generic retraining or re-documentation. Effective and timely communication can help alleviate the issues on board in a timely manner and ensure that leadership is aware of the risks on board as also those ashore. A strong DP presence is instrumental in strengthening TSMS integrity.

Common Pitfalls and How QMII Helps Fix Them

One of the most consistent problems we see across the industry is the use of overly complex, copy-paste TSMS manuals that don’t reflect how the company actually works. Templates look impressive, but they create confusion, inconsistencies, and ironically, more COI deficiencies. Add to that audits performed by untrained personnel who rely on generic compliance checklists, and the result is a system that appears documented but is barely implemented. Corrective actions often close the immediate symptom but never address the underlying cause, which is why the same issues show up year after year. Weak closeout documentation and thin evidence trails only compound the problem when a TPO or Coast Guard officer asks for proof.

QMII’s approach built on over 39 years of experience enables our team to create and deliver customized solutions to our clients. Our training equips auditors to verify systems, not just paperwork, and to ask the kinds of questions that reveal true implementation and effectiveness. We help operators right-size their TSMS so it matches their operations. This includes leaner manuals, clearer processes, and forms that crews can actually use. Through gap assessments and coaching, we strengthen corrective action practices, reinforce the importance of objective evidence, and help organizations build a TSMS they can sustain. The end result is a system that reduces COI deficiencies because it’s built on operational reality, not borrowed documentation.

Conclusion & Next Steps

Internal audits remain a critical tool for leadership to use in determining the state of their system. It further must also help reduce COI deficiencies. However, this is only possible when the audit team is skilled, people aware of the audit, the audit objective and checklists enable to auditor to determine the focus areas of the audit. Right-sizing the TSMS leads to better crew engagement and safer operations.

Operators must formally train their internal auditors and QMIIs auditor training course has been specially designed for maritime clients. The instructors too come with a varied background in the maritime industry. In conclusion operators must consider shifting from a mindset of “audit for compliance” to “audit to improve the system.

—

About the Author

Dr. Julius is a Senior Consultant at QMII with over 25 years of experience in ISO and aerospace quality systems. He has trained and guided hundreds of U.S. defense contractors on AS9100 and compliance, turning certification into a competitive advantage.

ISO 9001 internal audits are most valuable when they move beyond compliance checking to actively drive performance improvement. Properly designed and executed, internal audits validate that the quality management system (QMS) is effective, reveal systemic weaknesses, surface opportunities, and provide input for management decisions that raise process outcomes and customer value.

It is best to start with purpose and planning. Audits should be risk‑based and aligned to business objectives and scope: critical processes, high‑risk activities, recent changes, customer complaints, and past nonconformities merit higher audit frequency. Define clear objectives for each audit (e.g., verify effectiveness of corrective actions, assess process performance against KPIs, confirm readiness for certification). Use a rolling schedule that balances coverage with depth rather than mechanical clause ticking.

Adopt a process‑and‑evidence mindset. Auditors trace the process flow from inputs through controls to outputs and outcomes. Instead of focusing on whether a procedure exists for the organization, an auditor must ask whether the process delivers the intended result and how that is measured. Review objective evidence — records, performance data, trend charts, work observations and interviews — to test effectiveness. Ask probing questions such as “How do you know this control is working?” and “What evidence shows improvement over time?”

Make auditor competence and approach central. Auditors require process knowledge, risk awareness, data‑analysis skills and good interviewing techniques. Internal auditors should act as impartial investigators and constructive consultants: identifying root causes and suggesting practical corrective or improvement actions rather than assigning blame. Cross‑functional auditing helps expose interdependencies and spreads good practices across the organization.

Emphasize root‑cause analysis and corrective action effectiveness. When nonconformities are found, require structured root‑cause methods (5 Whys, fishbone) and corrective actions that target systemic causes with measurable success criteria and timelines. Verification of effectiveness is essential — closures should be evidence‑based (data, subsequent audits, or implemented controls), not merely administrative sign‑offs.

Link audit findings to performance metrics and management review. Audits should feed quantifiable insights into management review: trends in KPI performance, recurring issues, risk exposures, and results of corrective actions. Management should use this input to prioritize resources, approve improvement projects, and adjust objectives. Tracking audit‑driven improvements against business outcomes (reduced defects, faster delivery, higher customer satisfaction) demonstrates audit ROI and motivates continued engagement.

It is imperative to use data and tools to enhance impact. Data analytics, control charts, exception reporting, and audit management software increase audit efficiency and enable evidence‑based conclusions. A well-prepared checklist focuses on performance indicators—not just mere clause compliance; this is to ensure consistency while preserving investigative flexibility.

Cultivate a culture that views audits as opportunities and not as a factor to intimidate. Communicate that audits are aimed at learning and strengthening processes. Celebrate instances where audits uncover improvements or where process owners implement effective corrective actions. A no‑blame, improvement‑oriented culture increases transparency and cooperation.

Measure audit program effectiveness. Useful indicators include the decline in recurring nonconformities, the percentage of corrective actions verified effective, time to close actions, and improvement in audited process KPIs. Regularly review and refine the audit program itself based on these metrics.

To sum up, ISO 9001 internal audits that improve performance are planned around risk and business impact, executed with process focus and competent auditors, emphasize root‑cause, corrective action and measurable verification, leading to effective management decision‑making process. When integrated with data analysis and a culture of continual improvement, the internal audit becomes a strategic tool that drives sustained and measurable enhancement of quality and organizational performance.

—

About the Author

This article was written by Anjalika Singh, President at QMII. Over the years she has developed a sharp intuitive sense combined with strong operational and training management skills, making her a key asset in QMII’s consulting and training initiatives. Her work focuses on practical lead-auditor training and helping organisations adopt ISO and industry-specific management systems in a way that delivers business value.

For many U.S. factories, the first ISO 9001 audit can feel daunting. It’s like getting ready to marry someone even though you have known the person for a long time. Therefore, some preparation is necessary. Questions will come up in your mind – like “Are we ready?” or “What if we miss something?” are common. The good news is that ISO 9001 audit preparation doesn’t have to be stressful. With the right steps, your factory can approach the audit with confidence and even use it as a springboard for improvement. Afterall, the intent of an audit should be to drive continual improvement. That then becomes the secret mantra to your long last married life in effect ensuring your leadership get the inputs to improve processes and continue to produce confirming products and services. Here are a few steps to consider:

Step 1: Understand the Audit Scope

Before diving in, clarify what the certification body will be looking at. Typically, the audit will cover:

• How your Quality Management System (QMS) meets ISO 9001 requirements.
  
• Evidence of processes, records, and continual improvement.
  
• Compliance with statutory, regulatory, and customer requirements.

Step 2: Conduct a Gap Analysis

A gap analysis compares your current system against ISO 9001 requirements. It is best not to fit your system into templates. It is ideal to capture the “As-Is” of the system. This helps identify weak spots before the auditor does.

• Review clauses of ISO 9001 one by one.
  
• Document where your processes already comply.
  
• Flag areas needing corrective action.

Case Study: Mock Audits in Gap Analysis

QMII’s ISO 9001 lead auditor training highlights the importance of mock audits and case studies to simulate real audit situations. Factories that conducted mock audits before their first certification audit found gaps early and reduced findings during the real audit. Source 

Step 3: Train and Communicate

Employees are often nervous about audits. Reduce anxiety by explaining what to expect.

• Train staff on how their role connects to the QMS.
  
• Conduct mock interviews so they’re comfortable answering auditor questions.
  
• Emphasize honesty: auditors appreciate real answers, not rehearsed ones.

Step 4: Organize Documentation and Records

ISO 9001 requires evidence. That doesn’t mean mountains of paperwork, it means accessible, controlled documents.

• Review procedures, work instructions, and records.
  
• Ensure version control is in place.
  
• Archive outdated documents so they don’t cause confusion.

Step 5: Perform an Internal Audit

An internal audit is like your dress rehearsal before the wedding.

• Use internal auditors who understand ISO 9001.
  
• Treat findings seriously; corrective actions show the auditor you’re committed to improvement.
  
• Document everything, from nonconformities to follow-ups.

Case Study: Digital Tools for Internal Audits

A QMII client in manufacturing adopted a cloud-based QMS to centralize documentation and automate audit tracking. This reduced manual errors and improved version control, enabling faster retrieval of documents during internal audits. As a result, the company reported fewer audit findings and smoother external audit preparation. Source 

Case Study: CAPA Improvements

From QMII’s ISO 13485 audit trainings, one company improved its CAPA (Corrective and Preventive Action) process by introducing root cause analysis and systematic tracking. Within a year, they achieved about 30% reduction in non-conformities. While this example is from medical device audits, the lesson applies directly to ISO 9001 audit readiness. Source

Step 6: Conduct a Management Review

ISO 9001 clause 9.3 requires top management to be actively involved. A management review shows leadership commitment.

• Review audit results, customer feedback, and performance data.
• Discuss risks, opportunities, and resources.
• Document decisions and improvement plans.

Step 7: Create a Positive Audit Environment

On the audit day, set the tone.

• Greet auditors warmly and provide a clear schedule.
• Assign a guide to accompany them around the factory.
• Encourage open communication.

Final Thoughts

ISO 9001 audit preparation is not just about passing the audit. It’s about building a culture of quality. U.S. factories that approach audits with openness and preparation often find unexpected benefits: streamlined processes, engaged employees, and stronger customer confidence.

• QMII Government Services reported a 64% decrease in product processing time, 67% increase in productivity, and 89% reduction in inventory levels after optimizing their management systems.
  
• According to ISO studies, companies certified to ISO 9001 typically report 20-30% defect reduction rates, driving both cost savings and customer trust. 
  

Your first audit may feel intimidating, but with the right preparation, it can become a milestone on your factory’s journey to excellence. “You’ll be happily married for life!”

—

About the Author

This article was written by Anjalika Singh, President at QMII. Over the years she has developed a sharp intuitive sense combined with strong operational and training management skills, making her a key asset in QMII’s consulting and training initiatives. Her work focuses on practical lead-auditor training and helping organisations adopt ISO and industry-specific management systems in a way that delivers business value.

Wouldn’t it be nice if an ISO 9001 documentation templates package came wrapped up in a little box with a red bow? Ready to use and that delivered the magic of a quality product, streamlined processes resulting in efficiency, and satisfied customers.

Aside from the requirements for records the ISO 9001 standard, many find it surprising that ISO 9001 does not really require a manual or any documented procedures! So are all those companies selling you ISO 9001 documentation templates providing you value for money or is this just snake oil?

ISO 9001 has not really re-invented the wheel and most companies when they get down to implementing the standard realize that they cover most of the requirements in practice. After all it really is just business 101. In this article we will cover why to document your system, how to document your system, and how you can do so while not increasing the burden for your personnel.

Why is ISO 9001 documentation such a challenge for U.S. manufacturers?

ISO 9001 is often synonymized with documentation. Companies tend to document every little thing they do— the tiniest of detail. This approach creates a documentation burden for their users with information being duplicated in multiple records, information duplicated in multiple procedures and so on.

U.S. Manufacturers often seek ISO 9001 systems not for the benefit that a quality management system when implemented well will provide. Often the need for this is driven by a need for certification that is required by a customer or a potential customer. Time is of the essence in many of these cases and ISO 9001 documentation templates provide an easy out. While in the initial lifecycle of the system this may result in certification, over time it becomes a compliance burden. Something that is spruced up before audits. Before customer visits and that outside of those rare visits rarely see the proverbial light of day.

Most U.S. small and medium businesses further may not have the in-house expertise and/or the resources needed to invest in a consultant to support this effort.

What documents are actually required under ISO 9001?

ISO 9001 does not require any mandatory procedures. Before we dive further into this topic let us look at some definitions.

• Process – a series of actions or steps taken to achieve a particular end (the what)
  
• Procedure – an established or official way of doing something (the how)
  
• Documented procedure – A documented way of doing something

In essence, a procedure or process, as referenced in ISO 9001 does not imply a documented procedure. ISO 9001 asks organizations to determine the risk of not having something documented and as a result determine what they would like to document.

The only documented requirements, outside of required records, in ISO 9001 are the following:

• The scope of the management system including a justified non-applicability
  
• The Quality Policy
  
• The Quality Objectives

Which documentation mistakes cause audit failures?

In documenting the management system, it is of the utmost essence that companies appreciate their management system. What does this mean? It means each company has a way of doing things that have brought them this far. In aligning your system to ISO 9001 always begin by capturing how you are currently doing work. Measure it up against the requirements of ISO 9001 and determine where gaps exist.

In documenting your system take into account the competence of personnel, the structure of the organization and the complexity of the processes. DO NOT document your system to satisfy an auditor!

Common documentation mistakes that organizations make include:

• Over documentation – This often occurs when activities are documented by a person not close to the process, done to please an auditor, done in cases where there is high personnel turnover. This becomes an issue for users because there may be a conflict in the requirements for personnel, too many “shall” that become difficult to meet, and confusing to reference.
• Missing records – Where records are not located in the right location, have not been maintained or have been inadvertently deleted/destroyed.
• Uncontrolled documents – This often occurs when personnel print documents for use or take copies and then do not go back to the main repository to validate that they are using the most current version of the document. This may also occur in companies where the document control process may be non-existent.

From recent data, here are statistics that highlight how these mistakes show up in audit failures:

According to isoTracker’s “6 Top Reasons for Failing an ISO 9001 Audit,” common causes include inadequate document control, undocumented employee training, neglecting internal audits, and weak corrective & preventive action (CAPA) processes. (isoTracker)
In another study, companies certified to ISO 9001 significantly outperform non-certified ones in product quality, customer satisfaction, operational and market performance. This suggests that well-implemented documentation (among other system aspects) correlates strongly with improved business outcomes. (ResearchGate)

How can ISO 9001 documentation templates simplify compliance?

While at QMII we do not recommend ISO 9001 documentation templates, what we do recommend is using standardized formats for documentation created by the company. This means that your documents based on document type will have a standardized header and footer and overall document content structure. These standardized formats help personnel with creating new documents ensuring that relevant content is captured.

If you decide to create a risk register to meet the requirements of ISO 9001 Clause 6.1 then you can create a spreadsheet for this as also a risk criterion so that all risks are uniformly assessed using the same criteria. Over time you will create custom audit checklists for your processes that will help your auditors with a baseline of things to check for in an audit.

While templates may not provide the intended success a well-documented system can.

Real-world example: How one U.S. factory cut audit prep time using templates

QMII has helped numerous clients, over the years, set up management systems that capture how work is done at the company. This makes it easy for people to follow the process and easy to conform and comply.

A small business in the aerospace industry reached out to QMII after trying the template approach and failing. They spent the small money to buy the template and then struggled to fill in the blanks. Worse, they could not keep up with the amount of documentation provided in the template and struggled to meet customer requirements because the templates did not reflect how work at the site was actually done. Personnel struggled to follow the documented procedures and morale was low.

QMII helped set up a lean documented user-friendly system that with time help build morale, increase teamwork and resulting in time and cost savings. The company personnel were trained in QMII’s globally recognized ISO 9001 lead auditor course where they learned how to analyze and document processes and also create custom checklists for their internal audits. The improved operations set the company up for success and lead to a successful merger with a large business.

To reinforce how powerful a well-designed documentation system can be: manufacturing companies certified under ISO 9001 generally outperform non-certified peers in product quality, customer satisfaction, operational and financial performance. (ResearchGate)

What’s the easiest way to build lean documentation without overcomplicating it?

For over 39 years QMII has been helping small to large organizations implement systems that help them meet objectives and enhance customer satisfaction. Our approach sets organizations up to succeed with resilient systems that enable the company to adapt to changes. QMII consulting uses a methodology that does not include a cookie cutter approach. For each company and their system is unique. Thus, you need a unique solution that fits your needs. While ISO provides the foundation, we help build the house, customized to your product/service, that will allow you to succeed.

To learn more about our methodology visit https://www.qmii.com/developing-your-system/

—

About the Author

This article was written by Anjalika Singh, President at QMII. Over the years she has developed a sharp intuitive sense combined with strong operational and training management skills, making her a key asset in QMII’s consulting and training initiatives. Her work focuses on practical lead-auditor training and helping organisations adopt ISO and industry-specific management systems in a way that delivers business value.

Don’t we all love shortcuts! They save time and money and make it easier to get the job done. ISO 9001 and ISO 45001 integration is one such shortcut that companies can take. Yet when it comes to implementing multiple ISO standards, we choose to implement them one at a time rather than use an integrated approach.

The International Organization for Standardization (ISO) has for over a decade been publishing management system standards using the harmonized structure. This means all standard such as ISO 9001 and ISO 45001 have the same 10 clause structure. Nearly 60-70% of the standard’s requirements are aligned based on the standards selected.

Management system integration allows the organization to implement combined audits that save time and reduce the burden on the workforce. Integrating QMS+OHSMS requirements into one management system also allows for easier compliance to regulatory standards including OSHA compliance. In this article we explore the benefits to using an integrated approach to conforming to both these standards.

Why should U.S. factories consider integrating ISO 9001 and ISO 45001?

U.S. Factories can benefit from better recognition among potential clients by pursuing a path to certification to ISO 9001 and ISO 45001. ISO standards are globally recognized as the baseline for delivering a quality product consistently as also a systemic approach for creating a safe work environment.

While certification is not a requirement and the ISO standards allow you to self-declare conformity, companies can benefit from the system approach to continual improvement and enhancement of customer satisfaction. Additionally using this integrated and systemic approach allows companies to address non-conformities systemically thus reducing compliance costs. Various studies have shown how compliance costs reduced from the introduction of these standards.

For instance, the ISO Survey (2023) shows that there are over 837,978 ISO 9001 certificates and 185,166 ISO 45001 certificates worldwide, with the U.S. holding 1,687 ISO 45001 certificates. (Source: Enhesa) This demonstrates the growing recognition of these standards and the push towards dual compliance.

Additionally, personnel in the company are seeking clear guidance and direction and the leadership can provide this to them using the system thus increasing efficiency over time.

What are the key differences and overlaps between ISO 9001 and ISO 45001?

A read of the two standards will evidence that the requirements for Clause 4 – context of the organization, Clause 5 – Leadership, Clause 7 – Support, Clause 9 – Performance evaluation and Clause 10 -Improvement are for the majority quite similar. So, companies can meet the intent of the standard through a common integrated policy, integrated audits and an integrated management review. By having a common process for document and record control for both standard as also a common process for addressing non-conformities.

The key differences in the standard lie in the requirement of Clause 6 – Planning and Clause 8 – Operations. ISO 9001 here has a focus on controls required to deliver a conforming product meeting customer requirement. Companies use the requirements in the standard to build quality processes that work well time after time. ISO 45001 has a focus on identifying and addressing significant risks to employee safety.

How do you map common requirements between ISO 9001 and ISO 45001?

While someone new to the standards may find the process of mapping the requirements of the standard to the requirements of their system, QMII’s ISO 45001 Lead auditor training provides the needed coaching to overcome this challenge.

However, before you begin down this path the first step is to get leadership buy in for the process. This will be important to ensure that the project is a success. At QMII, we have experienced clients where the implementation of these standards stalled and did not progress until the buy-in from leadership was received.

A gap analysis is always a great start to see what it is that you are doing that meets the intent of the standard and what does not. Remember that it is important that you meet the intent of the standards since the ISO standards are not prescriptive in their requirements. They provide a high-level structure for achieving continual improvement.

What step-by-step process can factories use to integrate the two systems?

To integrate the two systems following the gap analysis put together a project plan and identify who will be responsible for each stage/step. Assign clear and reasonable deadlines to track project completion. The first step following buy-in is capturing the core process of the business, defining the scope of the system and defining the unified policy. Leadership plays a key role in each of these steps.

As companies begin to document their system keep in mind the following:

• Document the system for the users – Keep it simple so they understand the process and know what to do.
• Don’t over document the system – The system must be documented to the extent needed to give the leadership confidence that the processes are being carried out as planned.
• Documentation is a weak control layer – build controls into the software, the infrastructure and into the chain of command as documentation is a weak control.

Further actions to be considered are combined trainings and integrated audits.

What benefits do factories gain from dual compliance?

Dual compliance allows factories to lower audit costs, for external audits and for internal audits as well (where a consultant may be used for this). Companies that have implemented ISO 45001 have reported improved safety metrics with some reporting a decrease in reportable lost time injuries.

For example, a U.S. aluminum manufacturer implementing ISO 45001 alongside ISO 9001 reported a 50% reduction in injuries after implementation.

Companies that implement ISO 9001 also report an increase in efficiency as also better continuity of operations. Employee engagement and morale too increase as a result of streamlined processes and lesser mistakes. The system provides better requirements and objectives (goals) for them to work towards.

Recognition among the client base is also improved and there is a reduced customer oversight as a result of certification to these two standards.

Case study: How integration reduced incidents in a U.S. factory

A QMII client that implemented a safety management system (ISO 45001) was able to reduce their reportable lost time injuries year over year to zero where five years prior to the implementation of the standard this would not have been thought of as achievable. It began with an increase in near-miss reporting. Each of these incidents were investigated and the data over time of causes analyzed to determine the actions needed to improve safety awareness overall. Seeing leadership commitment and involvement, personnel started reporting risks as they perceived/observed them as also stopped unsafe acts/condition when they observed them. This led to over time a reduction in accidents.

This aligns with broader industry data where companies adopting ISO 45001 saw significant reductions in both frequency and severity of incidents. In fact, over 370,000 workplaces globally are now ISO 45001 certified, with studies showing measurable improvements in productivity and profitability due to safer, more efficient systems. (NCBI Study)

How can U.S. manufacturers get started with integration today?

Perhaps the easiest step a company can take is to educate personnel on the standards and the interpretation of the requirements. QMII lead auditor trainings are a good option to achieve this. Additionally, QMII also provides gap analysis services where our experts analyze your system and provide you with a project plan of actions to be taken to achieve conformity to the two standards.

Looking to start your integrated management system journey today? Call a solutions advisor at QMII or reach out at info@qmii.com today.

In today’s highly competitive global marketplace, U.S. exporters face more than just fluctuating exchange rates or shipping delays. For many, the real barrier to entry lies in building trust across borders and meeting international regulatory expectations.

This is where ISO certification for exporters becomes a powerful enabler. It provides a framework that helps businesses align with global best practices, reduce trade friction, and demonstrate consistent quality regardless of the destination market.

When implemented well, ISO certification goes beyond compliance. It becomes a strategic asset that enhances operational efficiency, facilitates smoother cross-border transactions, and gives potential buyers a reason to choose your product over the competition.

Why ISO Certification Is Key for U.S. Exporters to Access Global Markets

For U.S. companies looking to expand globally, having ISO certification signals professionalism, reliability, and consistency. International buyers, particularly in regulated sectors, seek assurance that suppliers follow recognized standards. ISO provides that assurance, acting as a common language in international trade.

Take ISO 9001, the most widely adopted quality manual system. Many procurement teams abroad now require ISO certification from exporters before they’ll even consider doing business. Why? Because it reduces their risk. With ISO-certified suppliers, overseas partners know they’re working with an organization that maintains standards, addresses customer requirements consistently, and regularly audits its system.

In essence, ISO certification removes doubt. And in export markets, removing doubt is often what opens the door by building trust.

Export Markets That Prioritize ISO-Certified Vendors

Certain regions place particular importance on vendors holding ISO certifications. If you’re aiming to grow exports in the EU, Asia-Pacific, or Latin America, certification may not just be a competitive edge, it may be a requirement.

Europe (EU)

The European Union has some of the strictest product safety and quality regulations in the world. In sectors like electronics, automotive, and medical devices, ISO standards are often aligned with CE marking requirements. A company certified to ISO 13485, for instance, will find it easier to meet the EU Medical Device Regulation (MDR) expectations.

Asia-Pacific (ASEAN, Japan, South Korea)

In Asia-Pacific countries, ISO is deeply integrated into government procurement programs and industry-wide quality frameworks. In markets like Singapore or Japan, ISO 9001 certification is viewed as a baseline credential for potential vendors.

Latin America

While regulatory systems vary across the region, many Latin American importers, particularly in agrifood and consumer goods, look for ISO 22000 (food safety) or ISO 14001 (environmental management) as part of their supplier due diligence.

Having ISO certification for exporters aligned to these expectations gives your organization smoother access, fewer questions, and a faster path to partnership.

Most Valuable ISO Standards for Exporters by Sector

For exporters, ISO is not one-size-fits-all. The right standard depends on the nature of your products and target market.

• ISO 9001 – Quality Management Systems: Applicable across sectors, from manufacturing to logistics, ISO 9001 ensures you have defined processes, customer feedback loops, and continual improvement mechanisms.
• ISO 22000 – Food Safety Management: For agrifood exporters, ISO 22000 supports HACCP-based systems and helps meet requirements for international food trade.
• ISO 13485 – Medical Devices: A critical requirement for exporting medical products to Europe, Canada, and several Asia-Pacific nations.
• ISO 14001 – Environmental Management: Growing in importance for companies that want to demonstrate sustainable operations to environmentally-conscious importers.
• ISO/IEC 27001 – Information Security: Increasingly relevant for exporters handling sensitive digital data or integrated tech solutions.

By aligning your certification with your sector and buyer expectations, you don’t just build credibility; you reduce the friction in your supply chain relationships.

Advantages in Customs Clearance and Partner Vetting

Beyond compliance and reputation, ISO certification also simplifies cross-border logistics. When exporters are ISO certified. While ISO certification doesn’t guarantee faster customs clearance, it promotes high-quality documentation and consistent processes that can reduce the risk of delays or shipment holds. 

Standards like ISO 28000 help organizations align with C-TPAT requirements in the US and demonstrate security within the supply chain. Think of ISO as part of your export “passport.” It does not eliminate documentation but it helps ensure what you provide is credible, consistent, and verifiable.

Building a Globally Recognized Quality Reputation

While certifications like ISO 9001 may start as internal improvement tools, over time they evolve into brand credibility markers. To global buyers, ISO branding on your marketing materials or website is more than a badge. It’s a signal that quality isn’t just a promise, there is a systemic approach behind it.

A robust ISO-certified system supports:

• Fewer complaints and returns
• Better supplier and customer audits
• Greater transparency in operations

These all contribute to a trustworthy export reputation, which in turn helps retain international clients and win long-term contracts.

Export Success Stories: U.S. Firms That Expanded with ISO

A California-based organic food exporter struggled to grow in Europe due to inconsistent packaging standards and gaps in food safety documentation. After implementing ISO 22000, the company not only gained access to German and Dutch retail chains but also secured a long-term supply contract with a multinational distributor. Their export volume doubled in under 18 months.

Another example: a medical device startup in Massachusetts seeking to sell into Canada and South Korea realized early that ISO 13485 was essential. Certification helped them shorten the timeline for product registration, pass regulatory inspections on the first try, and reduce the lead time for international orders.

These are not rare cases. They are real examples of ISO certification for exporters enabling measurable global expansion.

Conclusion

In a world where international buyers are risk-averse and standards-conscious, ISO certification gives U.S. exporters a clear advantage. Whether it’s simplifying customs processes, improving buyer trust, or meeting foreign compliance requirements, the right ISO standard strengthens both your system and your market position.

Want to explore how ISO certification can open new markets for your exports?
Speak with a QMII expert about aligning certification with your trade goals. Visit www.qmii.com or contact info@qmii.com.

—

About the Author

Dr. Julius is a Senior Consultant at QMII with over 25 years of experience in ISO and aerospace quality systems. He has trained and guided hundreds of U.S. defense contractors on AS9100 and compliance, turning certification into a competitive advantage.