AS9100D - Aerospace Quality Management System

Determine and select opportunities for improvement

• CAPA register with root cause and verification
• Improvement programme tracker
• Process owner attestation
• Tooling configuration export
• Meeting minutes referencing the control
• Training material referencing the control

• Root cause analysis is symptomatic only
• Effectiveness checks not performed
• Evidence is point in time rather than ongoing
• Control owner unclear or vacant
• No metric tracks control effectiveness

Continually improve the suitability, adequacy, and effectiveness of the QMS

• CAPA register with root cause and verification
• Improvement programme tracker
• Process owner attestation
• Tooling configuration export
• Meeting minutes referencing the control
• Training material referencing the control

• Root cause analysis is symptomatic only
• Effectiveness checks not performed
• Evidence is point in time rather than ongoing
• Control owner unclear or vacant
• No metric tracks control effectiveness

Determine external and internal issues relevant to the aerospace QMS purpose and strategic direction.

• SWOT/PESTLE analysis
• Stakeholder register
• Strategic plan extract
• Context review minutes

• No periodic refresh
• Aerospace regulatory context missing

Determine interested parties and their requirements relevant to the QMS

• Scope statement signed by management
• Stakeholder and interested party register
• Process owner attestation
• Tooling configuration export
• Meeting minutes referencing the control
• Training material referencing the control

• Scope boundaries unclear for cloud services
• Stakeholder needs not refreshed annually
• Evidence is point in time rather than ongoing
• Control owner unclear or vacant
• No metric tracks control effectiveness

Define QMS boundaries and applicability including aerospace products, sites, and processes.

• QMS scope statement
• Site/process inclusion matrix
• Justification for any exclusions

• Outdated scope after acquisitions
• Vague site boundaries

Establish, implement, maintain, and continually improve the QMS and its processes

• Scope statement signed by management
• Stakeholder and interested party register
• Process owner attestation
• Tooling configuration export
• Meeting minutes referencing the control
• Training material referencing the control

• Scope boundaries unclear for cloud services
• Stakeholder needs not refreshed annually
• Evidence is point in time rather than ongoing
• Control owner unclear or vacant
• No metric tracks control effectiveness

Top management demonstrates leadership and commitment to the QMS including product safety

• Board or executive committee charter with security or risk remit
• RACI matrix for accountable owners
• Process owner attestation
• Tooling configuration export
• Meeting minutes referencing the control
• Training material referencing the control

• Board reporting cadence not formalised
• Roles overlap without clear accountable owner
• Evidence is point in time rather than ongoing
• Control owner unclear or vacant
• No metric tracks control effectiveness

Establish, implement, and maintain a quality policy appropriate to the organization

• Board or executive committee charter with security or risk remit
• RACI matrix for accountable owners
• Signed and dated policy set with version history
• Annual review and approval records
• Process owner attestation
• Tooling configuration export

• Board reporting cadence not formalised
• Roles overlap without clear accountable owner
• Policies past their review date
• No evidence policies were communicated to staff
• Evidence is point in time rather than ongoing

Assign roles and authorities for quality including management representative

• Board or executive committee charter with security or risk remit
• RACI matrix for accountable owners
• Process owner attestation
• Tooling configuration export
• Meeting minutes referencing the control
• Training material referencing the control

• Board reporting cadence not formalised
• Roles overlap without clear accountable owner
• Evidence is point in time rather than ongoing
• Control owner unclear or vacant
• No metric tracks control effectiveness

Establish measurable quality objectives at relevant functions and levels

• Consent capture and withdrawal logs
• Data subject request workflow and SLA tracker
• Scope statement signed by management
• Stakeholder and interested party register
• Process owner attestation
• Tooling configuration export

• Consent records lack timestamp or version
• DSR responses miss statutory deadline
• Scope boundaries unclear for cloud services
• Stakeholder needs not refreshed annually
• Evidence is point in time rather than ongoing

Plan changes to the QMS in a systematic manner

• Scope statement signed by management
• Stakeholder and interested party register
• Process owner attestation
• Tooling configuration export
• Meeting minutes referencing the control
• Training material referencing the control

• Scope boundaries unclear for cloud services
• Stakeholder needs not refreshed annually
• Evidence is point in time rather than ongoing
• Control owner unclear or vacant
• No metric tracks control effectiveness

Determine and provide resources including infrastructure, environment, monitoring equipment, and organizational knowledge

• Control narrative tied to evidence
• Sample of operating evidence over the period
• Process owner attestation
• Tooling configuration export
• Meeting minutes referencing the control
• Training material referencing the control

• Evidence sampling not representative
• Operating effectiveness not demonstrated
• Evidence is point in time rather than ongoing
• Control owner unclear or vacant
• No metric tracks control effectiveness

Ensure awareness of quality policy, objectives, and contribution to QMS effectiveness

• Training completion records by role
• Phishing simulation results
• Process owner attestation
• Tooling configuration export
• Meeting minutes referencing the control
• Training material referencing the control

• Role based training not delivered to high risk teams
• Training metrics not reported to leadership
• Evidence is point in time rather than ongoing
• Control owner unclear or vacant
• No metric tracks control effectiveness

Control documented information required by the QMS including creation, updating, and retention

• Signed and dated policy set with version history
• Annual review and approval records
• Process owner attestation
• Tooling configuration export
• Meeting minutes referencing the control
• Training material referencing the control

• Policies past their review date
• No evidence policies were communicated to staff
• Evidence is point in time rather than ongoing
• Control owner unclear or vacant
• No metric tracks control effectiveness

Plan, implement, and control processes including operational risk management and configuration management

• Scope statement signed by management
• Stakeholder and interested party register
• Process maps with defined controls and owners
• Change control records
• Process owner attestation
• Tooling configuration export

• Scope boundaries unclear for cloud services
• Stakeholder needs not refreshed annually
• Operational controls not linked to risks
• Change records missing rollback evidence
• Evidence is point in time rather than ongoing

Control production including special processes, FOD prevention, and product safety

• Process maps with defined controls and owners
• Change control records
• Process owner attestation
• Tooling configuration export
• Meeting minutes referencing the control
• Training material referencing the control

• Operational controls not linked to risks
• Change records missing rollback evidence
• Evidence is point in time rather than ongoing
• Control owner unclear or vacant
• No metric tracks control effectiveness

React to nonconformities, evaluate need for action to eliminate causes, prevent recurrence.

• CAR records
• Root cause analysis (5-Why/Fishbone)
• Effectiveness checks
• Customer/regulatory submissions

• Shallow root cause
• No effectiveness verification

Top management ensures customer and applicable statutory requirements including product safety are met.

• Product safety policy
• Hazard analysis records
• Management review minutes
• Safety KPI dashboards

• Product safety not formally documented
• No safety reporting channel

Plan, implement, and control risk management processes within operational planning.

• Process FMEA
• Mitigation plans
• Project risk logs
• Residual risk acceptance

• Static FMEAs
• No link to nonconformities

Plan, implement, and control processes for product safety throughout lifecycle.

• Safety hazard assessments
• Safety critical item list
• Reporting/escalation procedure
• Safety lessons learned

• No SCI marking
• Field safety reports not captured

Plan and implement processes to prevent counterfeit or suspect counterfeit parts and their inclusion in product.

• Counterfeit parts plan
• Approved distributor list
• Inspection/test records
• GIDEP reporting evidence
• Disposition records

• Brokers used without controls
• No quarantine area

Review customer requirements before commitment to supply, ensuring capability.

• Contract review records
• Capability assessments
• Change records
• Risk acceptance evidence

• Verbal changes not captured
• No flow-down evidence

Implement controlled conditions for production including work instructions and process validation.

• Work instructions
• Process validation records
• First article inspection
• Travelers/routers
• Equipment maintenance logs

• Uncontrolled red-lines on floor
• No FAI per AS9102

Use representative production samples to validate that production processes meet requirements (FAI).

• AS9102 FAI report
• FAI sample retention
• Re-FAI triggers and records

• No re-FAI after process change
• Delta FAI missing

Preserve outputs to maintain conformity and prevent Foreign Object Damage during all stages.

• FOD program
• FOD walkdown logs
• Tool control records
• Cleanliness inspections
• Shelf life controls

• No tool accountability
• FOD found in shipped product

Review and control changes for production or service provision to ensure continuing conformity.

• Change request records
• Impact analysis
• Customer/regulatory approval
• Re-qualification records

• No customer approval for key characteristic changes
• Undocumented temp changes

Release product only when planned arrangements are completed; maintain evidence of conformity.

• Inspection records
• Certificate of Conformity
• Authorized signatory list
• DDP/8130-3/EASA Form 1

• Concession not documented
• Signatory authority unclear

Establish, implement, maintain design and development process appropriate for aerospace products.

• Design plans
• Inputs/outputs records
• Design reviews
• V&V records
• Design changes

• No verification vs validation distinction
• Late changes uncontrolled

Ensure suppliers meet requirements; manage supplier selection, monitoring, and flowdown.

• AVL/ASL
• Supplier audits
• Performance scorecards
• Flowdown PO clauses
• Source inspection records

• No flowdown of customer reqs
• Supplier de-listing not executed

Identify and control nonconforming outputs to prevent unintended use, including dispositions.

• NCR log
• MRB minutes
• Quarantine evidence
• Customer concession requests
• Scrap controls

• No MRB for use-as-is
• Scrap not physically destroyed

Determine what needs to be monitored, methods, and analyze data including OTD, quality escapes.

• KPI dashboards
• Trend analysis
• Customer scorecards
• On-time delivery reports

• No data analysis for improvement
• Metrics not reviewed by leadership

Conduct internal audits at planned intervals against QMS and AS9100D requirements.

• Audit program
• Audit reports
• Auditor competence records
• Finding closure evidence

• Auditor not independent
• Findings overdue

Top management reviews QMS at planned intervals to ensure suitability and effectiveness.

• Review agenda/minutes
• Action items
• KPI deck
• Customer feedback summary

• Not all inputs addressed
• No actions tracked to closure

Identify risks and opportunities affecting QMS conformity and product/service safety.

• Operational risk register
• Risk treatment plans
• Risk review records
• FMEA outputs

• Generic risks not aerospace specific
• No closure tracking

Provide and maintain suitable monitoring and measuring resources including calibration.

• Calibration register
• Cert of calibration
• Recall procedure for out-of-tolerance
• Traceability to national standards

• Missed calibration intervals
• No impact analysis when out of tolerance

Determine knowledge needed to operate processes and achieve product conformity.

• Knowledge inventory
• Lessons learned database
• Training matrix
• Succession plans

• Tribal knowledge undocumented
• No capture from retiring staff

Ensure persons doing work affecting performance are competent based on education, training, or experience.

• Training records
• Competence matrices
• Certifications (NDT/welding)
• Effectiveness evaluations

• No re-qualification cadence
• Special process operator gaps