AS9100D contains all of ISO 9001 and adds roughly a hundred aviation, space, and defense requirements on top of it. Small suppliers rarely fail the ISO half. They fail on the additions — the ones nobody warned them about until the audit.
Open any one. These are the additions on top of ISO 9001, roughly in the order they cost small shops findings.
Knowing which revision is authorized, which one is on the floor, and which one shipped — and being able to prove all three were the same.
This is the one that turns a good shop into a nonconformance. The work gets done right; the record of which drawing it was done to doesn't survive the year.
A documented process for how you verify material is what the certificate says it is, and what happens when it isn't.
Most shops have a purchasing habit — a supplier they trust, a mill cert they file. The standard wants a process, with a decision rule and a record. Those are different things, and only one of them survives an audit.
Welding, heat treat, NDT, finishing — qualified, controlled, and evidenced. Operator qualification current, parameters recorded, the process itself approved.
This one I don't have to read up on. I welded for twenty years to ONET, WABO and NADCAP qualification and I hold an AWS B5.2 weld inspector certificate, so I know what a special process control has to survive on a real floor. I've been the one getting audited against it.
AS9102 forms, filled out correctly, the first time — with every characteristic accounted for and the ballooned print to match.
Rejected FAIs are rarely about bad parts. They're about paperwork that doesn't tie back to the drawing cleanly, and about nobody owning the form.
Product safety is its own requirement, not something folded into general quality. Safety-critical items get identified and handled differently, and people need a route to raise a concern.
Expect an auditor to ask how somebody on your floor flags a problem without putting their name on it. If the honest answer is "they'd tell me," that's a finding waiting to happen.
Your customer's requirements have to reach your suppliers in writing — and you have to be able to show they did.
Your subs' work becomes your work in the prime's eyes. If a requirement stopped at your purchasing desk instead of reaching the heat treater, the nonconformance is yours.
Circa 2016 — welding for an aerospace manufacturer
I hold the AS9100D Lead Auditor Probitas certification, issued by SAI Global — qualified to audit an organization against the standard and lead the audit, exactly as a registrar's auditor does. That's the same lens a registrar brings. It's considerably more useful pointed at you a few months before they arrive.
Before founding Cornett Consulting Company, I took a Cincinnati manufacturer from nothing documented to certified against ISO 9001 in ninety days. AS9100 is that work plus the additions above — which is exactly why I lead with the additions.
And I spent twenty years under a hood before any of it. A checklist has no auditor. A registrar can't consult for a company it certifies. A generalist consultant can't read a weld print.
An SB-RCOM engagementThe SB-RCOM Readiness Assessment, scoped to AS9100. Half a day on your floor. A written report inside ten business days. Same price as every other assessment I run; the scope names AS9100 instead of ISO 9001, and the gap register covers the additions rather than stopping at the ISO clauses.
You keep the report whether or not you ever hire us again. If you do go further, the $750 comes off the price.
Scope is quality management system documentation, process architecture, audit readiness and training. I don't take receipt of ITAR or EAR controlled technical data.
No drawings, no specifications, no test data, no part-level technical information. The work is your system — how it's written, whether it holds up, and whether you can prove it. None of that requires me to hold anything controlled, and every engagement letter says so.
It becomes IA9100, aligned to the ISO 9001 revision underneath it, and the IAQG has signalled a shift to frequent smaller updates rather than one revision a decade. That changes how a system should be built, not just what it has to say.
I wrote up what's changing, what's still disputed about the timing, and the one build decision that keeps the next revision from costing you a document-control project.
If a prime has asked you for something you couldn't produce, or your last audit left findings you haven't closed, that doesn't get smaller on its own. Fifteen minutes and you'll know whether this is worth anything to you.