AS9100 Internal Audit: Plan, Run and Close It Right

An AS9100 internal audit is a planned, independent, documented check that your quality management system conforms to the standard, works in practice and keeps improving. You run it yourself, before a certification body does. The strongest audits follow real jobs through the shop, not the clause list. They produce findings tied to a requirement and end with verified corrective action. This guide walks through each step, with a process-based checklist you can adapt.

TL;DR

• AS9100 requires internal audits at planned intervals. A risk-based program that covers every process at least yearly is the common approach, with high-risk processes audited more often.
• Auditors must be trained, independent of the area they audit, and familiar with aerospace customer and regulatory requirements.
• Build the checklist around the flow of work (contract review, production, inspection), not clause order.
• Every finding needs a requirement, objective evidence and the condition observed. Closure means root cause action plus a verified effectiveness check.
• Top management must review audit results, so the output has to be clear enough to act on.

Table of Contents

• What an AS9100 internal audit verifies
• How often you need to audit
• Who can audit, and what independence means
• Planning and preparing the audit
• Building a process-based AS9100 audit checklist
• Gathering evidence during the audit
• Writing findings that stand up
• Corrective action and closure
• Our perspective: audits are only as good as the records behind them
• Make your next audit trail easier to follow
• FAQ
• Sources

What an AS9100 internal audit verifies

An audit is a systematic, independent, documented process for obtaining objective evidence and evaluating it against criteria. In an AS9100 context, the criteria are the standard, your own procedures, and customer and regulatory requirements.

Three questions sit behind every internal audit:

1. Does the system conform to AS9100 and to your own documented procedures?
2. Is it effectively implemented on the floor, not only on paper?
3. Does it drive continuous improvement?

That is the purpose described for an AS9100 internal audit: a review of the quality management system for conformity, effective implementation and improvement. The requirement itself sits in clause 9.2, and the text of Section 9.2 notes that internal audits help an organization improve its system and prepare for external audits and certification.

Done well, audits also identify problems early, verify that procedures match operations and evaluate risk controls. Think of the audit as a rehearsal in which nothing is at stake except your own learning. A nonconformity found by your own auditor costs a corrective action. The same nonconformity found by a customer or registrar can cost far more.

If you are still sorting out where AS9100 adds to the base standard, our comparison of AS9100 and ISO 9001 for aerospace suppliers covers the differences. Many of the audit mechanics also overlap with an ISO 9001 internal audit built around risk.

How often you need to audit

The standard says audits happen at planned intervals. It does not set a fixed number. A full set of internal audits each year is the recommended practice, and one practical reading is that the program should be risk-based and generally cover every process at least yearly, with high-risk processes audited more often.

What counts as high risk? Aerospace guidance points to new product introductions, poor-performing processes and first-time suppliers as priorities. In a machine shop that usually translates to:

• First article inspection and release of new part numbers
• Special processes and outsourced operations
• Processes with rising scrap, rework or customer returns
• Any process that changed since the last audit cycle

Unscheduled audits

The annual plan is a baseline, not a ceiling. Common triggers for an extra audit include significant process changes, customer or regulatory findings, supplier performance issues and persistent scrap or rework trends. A program aligned with ISO 19011 can also adjust through the year for performance, complaints, risk and change management.

A simple way to keep the program honest is a one-page matrix: processes down the side, months across the top, and a risk rating that decides how many audit slots each process gets. Revisit it after every management review.

Who can audit, and what independence means

An internal auditor can be an employee or an outside consultant. Either way, the person must be qualified. Auditors should be trained, knowledgeable in process-based auditing, independent of the area being audited and familiar with aerospace regulatory and customer requirements.

The standard also requires that auditors be selected and audits administered so that results are equitable. In practice:

• The inspection supervisor does not audit the inspection process.
• A programmer does not audit the programming release step they wrote.
• In a small shop with few people, rotate auditors across departments or bring in an outside auditor for the processes you cannot cover independently.

Keep training records, competence evidence and the audit assignments in your documented information. They are the first thing a registrar checks when asking whether your program is credible.

Planning and preparing the audit

Preparation is where most audits are won. The usual steps are scheduling and notifying participants, then reviewing the standard, customer and regulatory requirements, company processes and procedures, and previous results.

A workable sequence:

1. Define scope, criteria and objective for each audit: which process, which standard clauses, which customer flow-downs.
2. Pull the last audit report, open corrective actions, customer complaints and recent scrap or rework data for that process.
3. Notify the process owner and agree the date, location and who will be available for interviews.
4. Select a sample of real jobs: a recent first article, a running production lot, a rejected lot and a closed corrective action.
5. Write the checklist from the process flow (see the next section).
6. Confirm the auditor has no stake in the process being audited.

The sampling step matters more than it looks. A sample that includes a rejected lot shows how the system behaves under stress, not only when everything goes right.

Building a process-based AS9100 audit checklist

A checklist that walks clause by clause tells you whether documents exist. A checklist that follows the work tells you whether the system functions. Good checklists are process-based, following the operational flow of tasks like contract review, production and inspection rather than clause order. For each process they evaluate inputs, activities, outputs, resources, risks and KPIs.

The IAQG guidance material for AS9100 auditors suggests evaluating process-based management techniques, including quality metrics, cycle times and process capability determinations. The aim is process performance and effectiveness, not box checking, so auditors should follow a real job from order to shipment.

Sample checklist by process

Questions that go beyond yes or no

Replace closed questions with ones that demand evidence:

• Show me the last three jobs that went through this step. Where is the record for each?
• Which revision of the drawing is the operator working to, and how do you know?
• What happened the last time a measurement fell outside tolerance? Where is that documented?
• How do you decide which characteristics to inspect, and where is that decision recorded?
• Which KPI tells you this process is performing, and what did it show last quarter?

First article inspection deserves its own line item in any aerospace audit. If your auditors need a refresher on what the records should contain, see our guides to AS9102 requirements and the first article inspection process.

Gathering evidence during the audit

Auditors gather evidence through shop-floor observation, records, interviews, metrics and physical product. Training material for aviation suppliers describes the same mix: on-site observation, document review, interviews and record verification, compared against established criteria.

Practical habits that separate strong auditors from weak ones:

• Trace one job end to end. Start with the drawing, follow the route card, finish at the inspection record and shipping document. Broken traceability behaves like a broken chain: one missing link and the whole record loses its value.
• Ask operators to show, not tell. An operator demonstrating a gauge check is better evidence than a procedure on the wall.
• Record what you saw, with identifiers: part number, lot, serial, date, who you spoke to.
• Look at the physical part when the record claims a result. Verify that a ballooned characteristic on the drawing has a matching measured value and that the value was judged against the right tolerance.
• Keep opinions out of the notes. Evidence is a fact someone else could verify.

Writing findings that stand up

Findings should be clear, objective, evidence-based and linked to a requirement. They are typically classified as a major nonconformity, a minor nonconformity or an opportunity for improvement, and documented with the requirement, the objective evidence and the condition observed.

A usable finding has four parts:

1. Requirement: the clause, procedure or customer requirement.
2. Evidence: what the auditor reviewed, with identifiers.
3. Condition: what was found, stated plainly.
4. Classification: major, minor or opportunity for improvement, per your procedure.

Compare a weak statement with a strong one. Weak: inspection records are sometimes incomplete. Strong: for lot 24-117, characteristics 14 and 15 on the drawing have no recorded measured values, although the route card shows the inspection operation signed off.

You must also maintain documented information as evidence that the audit program was carried out and of the audit results. This matters beyond compliance. Certification bodies examine internal audit reports and management review minutes to judge whether an organization truly manages its system or merely maintains it. An audit report with no findings across a full year of a complex operation invites questions.

Corrective action and closure

A finding is not closed when the fix is announced. It is closed when someone verifies the fix worked. Findings need root cause corrective action rather than quick fixes: root cause analysis, action to prevent recurrence and a formal check that the action was effective.

A closure routine that holds up:

• Containment: correct the specific instance and check whether other lots or parts are affected.
• Root cause: ask why until you reach a cause in the system, not a person. Retraining alone is rarely a root cause.
• Action: assign an owner and a due date, and change the process, document or tool that allowed the problem.
• Effectiveness check: after a defined period, sample new records and confirm the problem has not returned.
• Closure: record the evidence and the person who verified it, ideally someone other than the action owner.

Then feed the results upward. Top management must review internal audit results at scheduled meetings to track performance, nonconformities and improvement status. Summarize by process, repeat findings, aging of open actions and trends, so the review is a decision meeting, not a reading exercise.

Our perspective: audits are only as good as the records behind them

We see the same pattern across aerospace, automotive and medical device suppliers. The audit itself is rarely the hard part. The hard part is finding the evidence: a measured value on one spreadsheet, a drawing revision in an email, an inspection sign-off on paper.

That is why we build QA-Report around linked records. Ballooned drawing characteristics connect to measured results, out-of-tolerance deviations are flagged as they are entered, and reports are generated as professional PDFs that are designed to support ISO 9001, AS9100 and PPAP expectations. When an auditor asks you to trace a characteristic from drawing to measurement, the trail is already there.

Our production layer adds route cards, batch and serial tracking, and rejection and recovery records, so the process-based, follow-the-job audit style described above works from one system. Role-based access and a document vault help you show who did what and when.

Our advice: audit your records the way you audit your processes. If tracing one part takes an hour, fix that first.

Michael Chen

Make your next audit trail easier to follow

If your inspection records are the slowest thing to pull during an audit, QA-Report can help. The platform links ballooned drawings to measured results, flags deviations and generates inspection reports, with batch tracking and route cards alongside. You can start on the Free plan at $0 per month, step up to Basic at $49.99 per month or PRO at $149.99 per month, and ask about On-Premise or Enterprise options for sensitive data requirements. See the plans and pricing or look at our MES for machine shops.

For teams that want to standardize first article records before the next audit cycle, the first article inspection report template is a good starting point, and audit ready inspection scheduling shows how to keep inspection work on a plan.

FAQ

How often are AS9100 internal audits required?

The standard requires audits at planned intervals rather than a fixed count. A common approach is a risk-based program covering every process at least yearly, with higher-risk processes audited more often. Process changes, customer findings or rising scrap can justify extra audits.

Who can perform an AS9100 internal audit?

An employee or an outside consultant can do it, provided the person is trained, independent of the area being audited and familiar with aerospace customer and regulatory requirements. Small shops often rotate auditors between departments to protect independence.

What should an AS9100 audit checklist include?

Build it around the flow of work: contract review, planning, production, inspection, nonconforming product, purchasing and corrective action. For each process, check inputs, activities, outputs, resources, risks and KPIs, and ask for evidence from real jobs.

What is the difference between an internal audit and a certification audit?

An internal audit is performed by or for your own organization to find and fix problems. A certification audit is run by an outside certification body. Internal audits help you prepare for external audits and certification, and registrars may review your audit reports as part of their assessment.

When is a finding considered closed?

When root cause action has been taken and someone has verified that it was effective. Announcing a fix is not enough. Record the evidence of the effectiveness check and report open and closed findings to top management.

Sources

• AS9100 - MSG Services
• Why run independent internal and supplier audits - Normwork
• Section 9.2 Internal Audit - AS9100 Store
• Section 09: AS9100 Rev D Performance Evaluation - AS9100 Store
• 7 Benefits Of AS9100 Internal Audits - Catalyst Connection
• Weekly tip: How many internal audits do I need to do?
• AS 9100: answering your frequently asked questions (2024)
• AS9100 Internal Audit Programme Planner
• Internal Auditing to AS9100: A Practical Guide for Aerospace Organizations
• Internal Auditor Training workshop (2019)
• IAQG 9100:2016 evaluation guidance material

Recommended

• ISO 9001 Internal Audits: Use Risk to Shape a One Day Agenda
• Quality Engineers: Audit Ready in 5 Minutes with AS9102 Rev C Requirements
• Pass AS9102 Audits: First Article Inspection Workflow for QA Teams
• AS9100 vs ISO 9001: What Aerospace Suppliers Need to Know