AS9100 Internal Auditor Training: Building a Team That Finds Real Problems

Most of the internal audit programmes I see in smaller aerospace suppliers are honest, diligent and nearly useless. Someone walks the shop floor with a printed checklist of clauses, ticks that a procedure exists, and writes a report that finds one minor observation about a calibration label. The programme runs on time, the records are complete, and it tells the business nothing it did not already know.

Then the certification body arrives and raises three majors on processes the internal audits passed twelve months running.

The gap is almost never diligence. It is training. Auditing is a distinct skill, and knowing the standard is only half of it.

Why good engineers are not automatically good auditors

A competent engineer knows how the process should work. That is exactly what makes auditing hard for them.

They walk into an area, see something familiar, and their instinct is to solve it rather than examine it. They accept an explanation that sounds technically reasonable without asking for the record that proves it happened. They audit the person rather than the process, which makes everyone defensive and produces nothing. And when they do find something, they write it up in a way that reads as criticism of a colleague rather than evidence about a system.

None of that is a character flaw. It is an untrained skill, and it is trainable.

What internal auditor training actually needs to cover

Four things, in roughly this order.

The process approach. An audit is not a march through clauses. It follows a process from its inputs to its outputs, asking what it needs, what it produces, who is accountable, what could go wrong and how the organisation knows it is working. Clause-by-clause auditing finds missing documents. Process auditing finds the places where the business is actually exposed.

Planning and sampling. Where to look, how much to look at, and why. A trainee needs to understand that three well-chosen jobs traced end to end tell you more than forty signature checks. They also need to plan backwards from risk — the processes where a failure reaches the customer or the aircraft get audited more often and more deeply than the ones that do not.

Evidence and interviewing. How to ask an open question, how to stay quiet long enough to get an answer, how to follow a thread without leading the witness, and how to record what was seen rather than what was concluded. "Job card 4471 showed the heat treat operation signed off before the furnace chart was attached" is evidence. "Heat treatment is not well controlled" is an opinion.

Writing findings. A finding needs the requirement, the evidence and the gap between them, in that order, in language that will still make sense to someone reading it in six months. If the person receiving it has to ask what you actually saw, it will not drive a corrective action worth having.

The aerospace-specific content

AS9100 asks for things a generic ISO 9001 auditor course will not cover, and your auditors need them:

• Product safety and counterfeit parts — both explicit requirements, both regularly weak in practice.
• First article inspection — what a complete FAI package looks like and when a partial or re-FAI is triggered.
• Configuration management and control of externally provided processes — where special process approvals and customer-approved sources live, and how often they are out of date.
• Risk, and the difference between a risk register that is maintained and one that was written for the last audit.
• Process effectiveness — auditors should understand that certification body auditors assess effectiveness against planned results, not just conformity. An internal programme that only tests conformity leaves you blind to exactly what the external audit will probe.

Our post on how to prepare for an AS9100 audit covers the external side; the point of internal auditor training is that nothing in that external audit should be a surprise.

Train them on your own records

I teach internal auditor courses using the company's own quality manual, job cards, nonconformance reports, FAIRs and calibration records. There is no good reason to practise on a fictional company.

When a trainee traces a real job from order to despatch, two things happen at once. They learn the method, and they find genuine gaps in your system — usually within the first afternoon. I have run courses where the practical exercise produced findings serious enough that the business acted on them that week. That does not happen with a case study about a bicycle factory.

It also makes your competence evidence considerably stronger. An auditor reviewing training records would rather see that your internal auditors were trained and assessed on your own processes than see a generic attendance certificate.

Independence in a small team

The common objection from a 40-person supplier is that everyone audits their own area because there is nobody else.

In practice you can usually solve this. Train auditors across functions and have them audit each other's areas — a production supervisor auditing purchasing, a planner auditing production. It is uncomfortable for a week and then it becomes one of the more useful things the business does, because people learn how the rest of the company works. Where a genuine gap remains, a second-party auditor from outside can cover the areas you cannot audit independently.

What you should not do is have the person who wrote the procedure audit their own compliance with it and call it independent. An auditor will find that immediately.

Judging whether the training worked

Attendance and a certificate prove nothing. After two audit cycles, ask:

• Are findings being raised against processes, not just paperwork?
• Has an internal audit found something before a customer or the certification body did?
• Are the reports specific enough that corrective actions address causes rather than symptoms?
• Is anyone other than the quality manager completing audits properly and on time?

If the answer to all four is yes, the programme is doing its job. Our post on getting value from internal audits goes further into using the output.

Frequently asked questions

Do our internal auditors need a lead auditor qualification?

Almost never. Lead auditor training is designed for people leading third-party certification audits. An internal auditor course, delivered properly, is the right level for most suppliers — and the saving is substantial. Our post on what AS9100 training your team actually needs sets out the four levels.

How many internal auditors does a smaller supplier need?

For a business of 30 to 200 people, three to five trained auditors is usually right. Enough to cover the programme and maintain independence, few enough that each gets sufficient practice to stay competent.

How often should internal auditors be retrained?

Competence is maintained by doing audits, not by repeating the course. A refresher when the standard changes, when someone has not audited for a long period, or when the quality of findings drops. An observed audit once a year is a better check than a certificate.

Can you audit our system for us?

We carry out internal audits on our clients' behalf and second-party audits of their suppliers. We are not a certification body and do not perform third-party certification audits — that must come from an accredited CB.

We deliver AS9100 internal auditor training built on your own procedures and records, taught by a practising Aerospace Experienced Auditor and BS EN 9100 Lead Auditor. See our training services or get in touch.