Your First Customer Audit Will Arrive Before You Are Ready

Founders of engineering and hardware businesses consistently underestimate how early this happens. The assumption is that customer audits are something you deal with once you are established. In practice a prime or a tier-one will want to look at you before they place anything meaningful — often before there is revenue worth defending, and almost always before you feel ready.

The good news is that these audits are far less about sophistication than people fear. I have been audited running operations, and I have sat on the other side auditing suppliers. The questions are nearly always the same four.

What they are actually testing

Can you show what you did? Not describe it. Show it. Which material, which operator, which machine, checked by whom, against which drawing revision. A company that can produce that from a handful of records passes this comfortably. A company with excellent engineering and no retrievable records does not, however good the parts are.

What happens when something goes wrong? Everyone has nonconformances. What is being assessed is whether you find them, contain them, understand the cause and stop them recurring — and whether you tell the customer promptly rather than quietly. An auditor who finds no nonconformance records in a young business does not conclude you are perfect. They conclude you are not recording them.

Who decides? Who can accept a deviation, release a shipment, approve a supplier, authorise a change. In a small company the honest answer is often "the founder" — which is fine, provided it is written down and consistently applied. What fails is when nobody can say.

Can you do it again? Repeatability. Is the process defined well enough that the next one comes out the same when the person who made the first one is on holiday?

What actually fails small companies

Almost never the engineering. These, in order:

Records that exist but cannot be found. The information is in someone's inbox, on a phone, in a spreadsheet on a laptop. An auditor asks for the traveller on a specific serial number and the room goes quiet. Retrievability is part of the requirement, not an administrative nicety.

Drawings without revision control. Two versions in circulation, no way to tell which was used. This is the single most common finding I see in young businesses and the most damaging, because it undermines every other record you produce.

"We just fixed it." A real problem was found and solved properly, and no record exists. From the outside that is indistinguishable from not having found it.

Calibration lapsed. Unglamorous and entirely avoidable. If your measurement equipment is out of calibration, every measurement you have taken since is open to question.

Approval that happens informally. The founder said yes in a conversation. There is no defined authority and no record. Our article on investor-ready governance and controls covers the same problem from the funding side, because it is the same problem.

If you have two weeks

Not ideal, but workable. In this order:

Fix revision control first. Get one controlled set of drawings, remove every other copy from circulation, and be able to say which revision each shipped unit was built to. If you do nothing else, do this.

Assemble the records you already have into something retrievable. You do not need a system. You need to be able to answer "show me serial 014" in under two minutes.

Write down who can approve what. One page. Who signs off a deviation, a supplier, a change, a shipment. Then actually follow it for the fortnight, because an auditor will test it against recent evidence.

Get the calibration current. Book it today; it has a lead time.

Run one honest nonconformance through end to end — find, contain, cause, action, verify — so you have a worked example rather than a blank procedure.

What you cannot do in two weeks is invent history. Do not try. An auditor who finds fabricated records will stop the audit, and that is a far worse outcome than a few findings.

On the day

Answer the question asked. Not the one you wish had been asked, and not three further questions nobody raised. Volunteering tends to open doors you would rather keep closed, and it reads as nervousness.

Show, do not tell. "Let me get the record" beats a confident explanation every time.

"I don't know — let me find out" is a perfectly good answer. Guessing is not. An auditor will check, and a wrong confident answer costs you more than an honest gap.

Have the right people in the room. The person who does the work, not just the person who manages it. Auditors ask operators questions, and an operator who can explain their own process is the strongest evidence you own.

Do not argue findings on the day. Understand them, ask for the evidence and the requirement, and take them away. If something is genuinely wrong you can challenge it afterwards, in writing, calmly.

It does not end when they leave

The corrective action response is assessed as carefully as the audit. A thin response — retrain the operator, remind the team — tells a customer you have not understood the finding. A response that identifies why the system allowed it tells them something useful about how you will behave when a real problem happens on their part.

That is ultimately what the whole exercise is for. Our AS9100 in four months case study is a worked example of a business getting to that standard quickly from a standing start.

Frequently asked questions

How early will a customer actually audit us?

Earlier than expected — frequently during supplier approval, before any significant order. Treat an approval questionnaire as the beginning of the process rather than paperwork.

Do we need AS9100 before our first audit?

Not always. Some primes will work with a capable supplier on a path to certification. What they will not accept is an inability to evidence control. Our comparison of ISO 9001 and AS9100 sets out where the bar sits.

Should we have someone external with us?

For a first audit it usually pays for itself — not to answer for you, but because knowing what is coming changes how you prepare and how you respond to findings.

What is the worst thing we can do?

Fabricate a record. Everything else is recoverable.

We help early-stage engineering and hardware businesses put in the controls customers and investors expect, at a weight the business can actually carry. See our startup structures work or get in touch.