How to Prepare for an AS9100 Audit: A Readiness Checklist

To prepare for an AS9100 audit, make sure your documented system matches how you actually work, gather the records that prove it, close out your internal audit findings, and hold a genuine management review before the auditor arrives. The single biggest predictor of a smooth audit is not perfect paperwork but honest, working evidence that your quality management system runs day to day. Having sat on both sides of the table, I have put together this AS9100 audit checklist to give you a practical, ordered way to get ready and avoid the common non-conformances.

Start with the fundamentals

Before drilling into detail, confirm the basics are in place and current.

• Your quality policy and objectives are defined, communicated and being measured.
• The scope of your certification is accurate and reflects what you actually do.
• Your process map matches reality, not an idealised version drawn a year ago.
• Roles, responsibilities and authorities are clear, especially who owns product safety and quality escapes.

Auditors form an early impression from whether leadership can talk convincingly about the system. If the quality manager is the only person who understands it, that is a warning sign in itself.

Know your own scope, and never let a process hide

I learned this lesson vividly hosting an audit for a site some years ago. Partway through, it emerged that they had a chrome plating line on the premises, a special process, that had simply been missed at their internal audit. It sat in a back room, and nobody involved in preparing for the audit really understood what it did or that it needed controlling. It had quietly fallen out of the picture. The external auditor, of course, found it.

The lesson has stayed with me. You must know your own scope completely, and no process gets to hide, however tucked away or poorly understood it is. Special processes are exactly the ones that go unnoticed, because they are often done by one person in one corner and taken for granted. Walk your own site as if you had never seen it. Ask what happens in every room. If a process affects the product, it belongs in your system, in your internal audit, and in your evidence, not in a back room nobody mentions.

Get your documentation in order

You do not need mountains of paper, but what you keep must be controlled and findable. Check that:

• Documented information is version-controlled, with obsolete copies removed from use.
• Procedures describe what people genuinely do, and people can find them.
• Records are complete and retrievable for the areas the standard emphasises.

Pay particular attention to the aerospace-specific documentation: configuration management, first-article inspection reports, counterfeit-part controls, and control of external providers. These are where first-timers most often have gaps.

Assemble your evidence

An AS9100 audit is an evidence exercise. The auditor will ask to see proof that processes work, so have it ready rather than hunting during the audit. Typical evidence includes:

1. Records of production and inspection, showing traceability of parts, materials and processes.
2. Non-conformance and corrective-action records, demonstrating that problems are found, contained and genuinely resolved, not just logged.
3. Supplier control evidence, such as approved-supplier lists, monitoring and flow-down of requirements.
4. Calibration and equipment records, current and complete.
5. Competence and training records for people doing work that affects quality and safety.
6. Risk and opportunity records, showing risk-based thinking is actually applied.

A useful test: pick a recent job and try to trace it end to end from order to delivery. If you can follow the thread cleanly, so can the auditor.

Answer the auditor honestly

Something I see again and again is the instinct to say "yes" to an auditor even when the honest answer is "no". People want to look capable and in control, so a question like "and do you record that every time?" gets a confident yes when the truth is "usually". It is human, but it is the worst thing you can do. Auditors ask to see the evidence behind the answer, and a "yes" with nothing behind it does far more damage than an honest "no, not consistently, and here is what we are doing about it".

A truthful "no" is not a failure. It shows you understand your own system and are improving it, which is exactly what the standard is looking for. This is one reason we host our clients' first audits with them. Sitting in the room takes the fear out of it, so people do not get flustered and reach for the reassuring answer instead of the true one.

Run internal audits and act on them

Internal audits are a requirement and your best rehearsal. Before the external audit:

• Confirm you have audited every part of the system within your planned cycle, including the processes that are easy to forget.
• Check that findings were raised honestly, not softened to look tidy.
• Verify corrective actions are closed with evidence, not left open or fudged.

Weak internal auditing is one of the most common reasons certification stalls, and, as my chrome plating story shows, it is exactly how a whole process ends up missed. A tough internal audit that surfaces real issues is far more useful than a comfortable one that finds nothing, because the external auditor will find them regardless.

Hold a real management review

Management review is where leadership demonstrates ownership. Auditors look for a review that genuinely examines performance and drives decisions, covering things like:

• Quality objectives and whether you are meeting them.
• Customer feedback, complaints and on-time delivery.
• Audit results, non-conformances and corrective actions.
• Supplier performance and risks.
• Resources and any changes affecting the system.

The output that matters is decisions and actions with owners. A thin, box-ticking review signals a system that runs on autopilot, which undermines confidence in everything else.

Frequently asked questions

What documents does an AS9100 auditor want to see?

Expect requests for your quality policy and objectives, process documentation, production and inspection records, non-conformance and corrective-action records, supplier controls, calibration and training records, and evidence of internal audits and management review. The aerospace-specific items around configuration, first-article inspection and counterfeit-part control get close attention.

How long before the audit should we prepare?

Ideally you are audit-ready continuously, but practically, allow several weeks to complete an internal audit cycle, close findings and hold a management review before a certification or surveillance audit. Leaving it to the last fortnight rarely leaves time to fix what you find.

What happens if we get a non-conformance?

Non-conformances are normal and not automatically fatal to certification. You will be asked to address them within a set timeframe, with major findings needing evidence of correction before a certificate is issued or maintained. Handle them with genuine root-cause action rather than a quick patch.

Walking in ready

Audit readiness is really operational maturity made visible. ProgressXL (coming soon) helps you assess where your quality system stands against standards like AS9100 and work a prioritised plan to close the gaps before an auditor finds them. Explore ProgressXL to see how the Assess, Plan, Improve model supports audit readiness, or email the team if you would like us alongside you for that first audit.