AS9100D Internal Audit Checklist: Evidence Questions, Findings & How to Use It

Introduction

Most AS9100D internal audit checklists fail for the same reason: they ask "is this controlled?" instead of "show me." A checklist built around yes/no questions produces an audit trail that looks complete and proves almost nothing.

SAE International published AS9100D in 2016, layering aerospace, space, and defense requirements on top of ISO 9001:2015. The internal audit requirement exists to confirm that your QMS actually works, not just that it's documented.

This article tackles the problems that show up in real audits:

• Vague questions that invite vague answers
• Missing or partial evidence
• Audit trails that stop at one department instead of following the work
• Findings that never state which requirement was violated
• Corrective actions closed before anyone verified they worked

We'll cover checklist structure, evidence-based questioning, how to run the audit itself, and how to write findings that hold up under scrutiny.

Key Takeaways

• A strong checklist links AS9100D clauses to processes, risks, owners, evidence sources, and follow-up actions
• Questions should force auditors to inspect records, watch work happen, and trace outputs, not accept verbal assurance
• Every finding needs three parts: the requirement, the objective evidence, and the specific gap
• Treat the checklist as a guide for judgment, not a replacement for it

What an AS9100D Internal Audit Checklist Should Cover

AS9100D's internal audit clause (9.2) requires you to evaluate conformity to your own QMS, to applicable customer and regulatory requirements, and to whether processes are effectively implemented and maintained. That's three separate questions, and a checklist that only addresses the first one is incomplete.

Build It by Process, Not Just by Clause

A clause-only checklist misses how work actually flows. Organize your checklist two ways at once:

• By process: map each audit to a specific process (purchasing, production, design) and follow its inputs through outputs
• By clause: confirm the applicable AS9100D requirements are addressed somewhere in that process

Each checklist entry should include fields for:

• Audit scope and criteria
• Process owner and auditor name
• Dates and sampled records
• Evidence reviewed and results
• Follow-up action

Skip one of these fields and you'll lose traceability the moment someone asks "where did this finding come from?"

Cover the Core QMS Areas

Your checklist should sweep across:

• Context, interested parties, and QMS scope
• Leadership, quality policy, objectives, and responsibilities
• Planning, risk management, opportunities, and change control
• Support: competence, awareness, infrastructure, documented information
• Operations: customer requirements, design, purchasing, production, release, nonconforming outputs
• Performance evaluation, internal audits, management review, improvement

Add Aerospace-Specific Prompts

Copying a generic ISO 9001 checklist leaves the aerospace-specific controls uncovered. Build in prompts for:

Control area	What the checklist should ask
Configuration management	Is product configuration controlled and traceable to the current design?
Counterfeit parts prevention	How does receiving inspection verify authenticity on at-risk items?
Special processes	Is the special process validated, and is the external provider controlled?
Key characteristics	Is variation on key characteristics monitored against AS9103 expectations?
FOD/FOD controls	Are tool accountability and FOD risk assessments in place at the work area?

Round this out with process-effectiveness checks. Ask for:

• Defect or escape trends
• On-time delivery data
• Customer feedback and supplier performance
• Rework/scrap figures and corrective-action trends

Don't assert specific numbers in the checklist itself. Ask for whatever data the process actually tracks.

Evidence Questions to Include in the Checklist

"Is the process controlled?" invites a one-word answer and tells you nothing. A strong evidence question asks the auditee to produce something: the current procedure, a recent record, or a demonstration of the work itself.

Five Evidence Sources

Build questions around each of these:

• Document review: Which approved procedure, drawing, specification, or customer requirement governs this activity?
• Record review: Which completed records show the activity happened and met requirements?
• Interview: How does this employee know what to do, what changes trigger a different response, and what happens to nonconforming output?
• Observation: Can the auditor watch the process run and compare it to what's documented?
• Data and traceability: Can you trace a product, order, change, or nonconformance from input to output?

Sample Questions by Process Type

For management and QMS processes, ask:

1. How were current objectives set, and who reviews progress against them?
2. How does a risk or planned change get evaluated before it's implemented?
3. How do internal audit results reach the managers who own the affected process?
4. How is a management review action tracked until it's actually closed?

For operational and aerospace-specific controls, ask:

1. How are customer requirements reviewed before a contract is accepted?
2. How is configuration controlled when a design changes mid-production?
3. How do production personnel confirm they're working from the current instruction revision?
4. How are special process or inspection records retained and linked to the lot?
5. How are supplier risks assessed, and how are counterfeit-part risks escalated?

Push Further on Effectiveness

Add follow-up questions that test whether a control actually works:

• What happened the last time this process failed to meet requirements?
• How was the nonconforming output contained?
• Was a root cause analysis performed, or just a quick fix applied?
• What evidence shows the problem hasn't come back?
• Did the fix affect other processes or previously accepted product?

A revised work instruction by itself proves nothing. You still need to check the relevant revision level at the point of use and confirm the affected employees were actually trained on it.

How to Use the Checklist During an Internal Audit

A checklist is only as good as the audit plan behind it. Preparation determines whether you spend the audit chasing paperwork or actually testing the process.

Prepare Before You Walk the Floor

Before the audit starts, define:

• The audit objective, scope, and criteria
• Which processes, locations, or functions are in play
• The audit team, schedule, and records you intend to sample
• Prior findings or recent changes that should increase audit depth

Open the audit by confirming scope and logistics with the process owner.

Follow the Audit Trail

Start with the process owner's planned arrangements: what's supposed to happen. Then follow the actual trail: inputs, activities, controls, outputs, performance indicators, and how this process hands off to the next one.

A Turtle diagram mapping inputs, outputs, resources, responsibilities, and measures is a practical tool for keeping this trail organized during the audit.

Sample With Intent

Don't let the auditee hand you the three easiest files. Use a documented, risk-informed sampling method that includes:

• Recent records and older ones
• Normal work and unusual or non-routine jobs
• Recently changed processes
• Prior problem areas and different shifts or personnel

Record Evidence as You Go

Capture document identifiers and revision levels, record references, interview roles, observed conditions, and product or order numbers in real time. Memory fades fast once you're three processes deep into an audit day.

Close the audit by walking through confirmed evidence and any unresolved questions with the process owner, before you write the report, not after.

How to Document Findings and Drive Corrective Action

Not every gap is a nonconformity. Classify based on the applicable requirement, the verified condition, the risk involved, and your organization's current rules, not on how uncomfortable the finding feels to write.

Write Findings With Three Elements

Every finding needs:

1. Requirement: the specific AS9100D clause, customer requirement, procedure, or drawing that applies
2. Objective evidence: what was reviewed, observed, or confirmed, stated precisely enough that someone else could verify it
3. Statement of nonconformity: how the evidence fails the requirement, without speculation or added severity

For illustration only (not an actual finding from any organization), a gap might look like: "Per [procedure reference], receiving inspection must verify supplier certifications before stock release. Three lots from Supplier X were found in inventory with release stamps but no corresponding certification on file. This does not meet the documented receiving-inspection requirement."

That statement is specific, evidence-based, and does not guess at why it happened. Other patterns worth watching for include:

• An outdated work instruction still posted at the workstation
• A supplier evaluation file missing required fields
• A traceability gap between a nonconformance record and the affected lot
• A management review action with no documented closure

Respond Before You Investigate

Once a finding is confirmed:

• Contain affected product or stop the process if needed
• Determine how far the condition extends
• Notify the responsible process owner
• Record the correction taken
• Assess whether customer or regulatory notification applies

Connect Corrective Action to Root Cause

The action owner should define:

• The correction and the root-cause method used
• The corrective action itself
• A responsible person and due date
• Affected processes or records
• Objective evidence that the action was actually implemented

Verify Effectiveness Before Closing

Closing a corrective action because the paperwork is complete is a common mistake. Before closure, verify:

• The action was implemented exactly as planned
• The original condition has stopped recurring
• Related risks elsewhere were addressed
• Documents, training, or audit planning need updating as a result

A few good parts right after an adjustment don't prove the fix held. You need a sampling period and defined conditions before calling it effective.

For teams that want this reinforced through structured practice rather than one-off training, QMS Learning's Aerospace & Defense Audit-Ready pathway walks through evidence questions, finding statements, and a mock audit so that judgment is exercised before it is needed on the floor.

Conclusion

A good AS9100D internal audit checklist does one job well: it helps auditors ask sharper questions, follow evidence through the actual process, and write findings that management can act on without guessing what they mean.

Review your checklist after every audit cycle. Fold in process changes, recurring issues, customer feedback, and trends from prior findings. Keep it aligned with the current AS9100D standard and whatever customer or regulatory requirements apply to your scope — a checklist that never changes stops reflecting the organization it's auditing.

Frequently Asked Questions

What should be on an AS9100D internal audit checklist?

Cover audit scope and criteria, clause-mapped process requirements, and aerospace controls such as configuration management and counterfeit-parts prevention. Include evidence questions, sampling guidance, effectiveness indicators, and fields for findings and corrective-action follow-up.

How do I prepare for an AS9100 audit?

Review your audit plan, current QMS documents, and prior findings before you start. Gather objective evidence in advance, confirm employee readiness, check management review and internal audit outputs, and verify open corrective actions actually closed with evidence, not just paperwork.

How often are AS9100 audits required?

AS9100D clause 9.2.2 does not set a fixed internal audit frequency. Base the schedule on process risk, importance, and prior results per IAQG clarification guidance. Your certification body's surveillance and recertification cycle is separate and contractual.