Introduction
AS9100D is the quality management standard for aviation, space, and defense organizations, built directly on ISO 9001:2015 and issued by SAE International. But passing certification takes more than adding aerospace vocabulary to an existing quality manual.
Many aerospace teams have procedures, forms, and binders full of records. Yet when an auditor asks for proof, they struggle to show that risk management, product safety, traceability, configuration control, supplier oversight, and corrective action actually function day to day.
This article covers three things: the auditable clauses inside AS9100D, how the standard differs from plain ISO 9001, and the objective evidence auditors expect your team to produce on demand.
Key Takeaways
- Clauses 4 through 10 contain the auditable requirements; Clauses 0 through 3 are introductory and reference material only
- Most-watched aerospace additions: operational risk, product safety, configuration management, counterfeit parts, traceability, supplier control, and human factors
- Auditors judge both documented arrangements and whether staff can demonstrate consistent, effective results
- Gap analysis must cover customer- and contract-specific requirements, not just the published standard
AS9100D Requirements: A Clause-by-Clause Overview
AS9100D keeps ISO 9001:2015's ten-clause structure, then layers aerospace-specific requirements inside it. Reading the aerospace additions in isolation misses the point. Each one sits inside an existing ISO clause and depends on that underlying requirement working correctly first.
Clauses 4 Through 7: Foundation and Support
Clause 4 covers interested parties, QMS scope, and process interaction, with an aerospace twist: organizations must also account for aviation, space, or defense-specific internal and external issues, such as export control exposure or regulatory oversight.
Clauses 5 and 6 assign leadership accountability for the quality policy, objectives, and roles, then require planning for risks, opportunities, and QMS changes. Clause 7 covers competence, infrastructure, monitoring equipment, organizational knowledge, and document control, with added emphasis on awareness of product safety and ethical conduct.
| Clause | Heading | Primary Focus |
|---|---|---|
| 4 | Context of the Organization | Interested parties, QMS scope, process interaction |
| 5 | Leadership | Policy, roles, responsibilities, authorities |
| 6 | Planning | Risk and opportunity, objectives, planned changes |
| 7 | Support | Competence, resources, documented information |
Clause 8: Where Most Nonconformities Happen
Clause 8 carries the heaviest aerospace load. Beyond standard operational planning, customer requirements, design control, and external providers, AS9100D adds four dedicated subclauses:
- 8.1.1 Operational risk management: identifying, assessing, mitigating, and reviewing risk across product realization
- 8.1.2 Configuration management: controlling approved product definitions and revision status
- 8.1.3 Product safety: addressing safety throughout the product lifecycle
- 8.1.4 Prevention of counterfeit parts: source controls, traceability, and detection
Production control, identification and traceability, and nonconforming output management all run through this clause too, making it the longest and most heavily audited section of the standard.
Clauses 9 and 10: Proving Effectiveness
Clause 9 covers monitoring, customer satisfaction, internal audits, and management review. Clause 10 addresses nonconformity, corrective action, and continual improvement.
IAQG's clause overview confirms human-factor consideration belongs in Clause 10.2.1's causal analysis, not as a standalone Clause 8 requirement. Auditors in these clauses care less about whether an audit happened and more about whether it changed anything.
The Key Differences Between AS9100D and ISO 9001
ISO 9001 provides a general QMS framework suitable for any industry. AS9100D takes that same foundation and bolts on controls built specifically for aviation, space, and defense risk.
Risk expectations go further. ISO 9001 asks for general risk-based thinking throughout the QMS. AS9100D requires a formal operational risk management process that identifies, assesses, communicates, mitigates, and reviews risk across the entire product realization cycle, not just at a single planning stage.
Product safety and human factors get named attention. Organizations must identify who owns product-safety responsibilities and, where applicable, consider human contributors to errors and escapes during corrective action, rather than stopping analysis at "operator error."
Configuration and traceability carry more weight. AS9100D expects tighter control over approved product definitions, revision status, part identification, and traceability across the full lifecycle, including after design changes.
Supply-chain controls are more detailed. Expect approved-provider evaluation, ongoing performance monitoring, requirement flow-down, verification of purchased outputs, and counterfeit-parts prevention. One common misconception: flowing AS9100D certification itself down to every supplier isn't automatically required.
Supplier control failures surface constantly in aerospace audits. One recurring Boeing supplier finding: a Clause 8.4.3 major nonconformity after a supplier accepted incoming parts from a new vendor without completing re-qualification first.
AS9100D isn't a higher-tier ISO 9001 certificate. It's an aerospace-specific system that has to reflect product safety, complex multi-tier supply chains, customer flow-downs, and lifecycle risk all at once.
What AS9100D Auditors Look For
Auditors follow a process from requirement to record to result. That means interviewing personnel, observing work in progress, sampling records, and tracing one product or order end to end to see if actual practice matches the documented process.
Evidence Auditors Commonly Sample
- Leadership and process ownership: current objectives, assigned responsibilities, management-review outputs, and proof that leadership acts on risk and performance trends
- Operational risk and product safety: risk criteria, risk registers, mitigation actions, residual-risk decisions, and evidence that risks get revisited after a change or escape
- Configuration and traceability: approved drawings, revision-controlled work instructions, change approvals, traveler updates, serial or lot identification, and material certificates
- Supplier and counterfeit-parts control: approved supplier records, evaluation results, purchase-order flow-down, receiving verification, and suspected-counterfeit containment
- Corrective action: problem definition, containment, root-cause analysis, action ownership, and verified effectiveness, not just closure
Take an out-of-tolerance bore discovered on three lots from one supplier. A defensible investigation record names the applicable requirement, the measurement results, affected lot numbers, dates, and measurement-system checks.
A handful of good parts right after an adjustment doesn't prove the fix holds. Auditors know that pattern well, and they test for it.
Templates alone don't satisfy this. A revised work instruction sitting in the document system means nothing if training records don't show the floor actually received and acknowledged it.
AS9100D Documentation and Employee Readiness
AS9100D doesn't mandate one universal document set. Required documented information depends on your processes, scope, risks, customer requirements, and applicable regulations. A small machine shop and a Tier 1 structures supplier will produce different evidence for the same clause.
A Practical Readiness Checklist
Organize evidence by type, not by clause number alone:
- QMS scope, process maps, and interested-party analysis
- Quality policy, objectives, and performance data
- Risk and opportunity records, updated after changes
- Competence and training records tied to specific roles
- Document and configuration control records
- Supplier evaluation, monitoring, and flow-down records
- Production, inspection, traceability, and release records
- Internal-audit and management-review outputs
- Corrective-action files with verified effectiveness
For each applicable clause, assign an owner, a process, a record, a performance result, and an effectiveness check. Then test whether employees can actually locate and explain that evidence without digging through shared drives for twenty minutes.
Testing Before the Real Audit
Run an internal or mock audit that traces one real order, part, nonconformity, supplier issue, or engineering change from start to finish. Common weaknesses worth checking before certification day:
- Obsolete documents still sitting at the point of use
- Training records that are incomplete or undated
- Risk records that weren't updated after a process change
- Supplier requirements that never got flowed down in the purchase order
- Corrective actions marked closed without verified effectiveness
Boeing, Lockheed, and other Tier 1 customers don't accept "we sent them to a class" as proof that a team can run an internal audit. They want to see it happen.
Structured preparation closes that gap. QMS Learning's AS9100D Internal Auditor pathway walks teams through Clauses 4 through 10, a turtle diagram, evidence questions, and a mock audit capstone.
The platform's AI Workbench recommends the right corrective-action method for a given gap and generates supporting documentation. The Manager Dashboard exports time-stamped training and scenario evidence as a single audit-evidence package.
None of this replaces your certification body's assessment. It's preparation built to close the gap between "we took the class" and "we can show you."
Conclusion and Next Steps
AS9100D readiness comes from an operating, evidence-based QMS, not a stack of procedures assembled the week before the audit.
Three priorities matter most:
- Understand how Clauses 4 through 10 apply to your specific scope and products
- Identify which aerospace-specific controls create your largest implementation gap
- Verify that employees can demonstrate effective process performance, not just recite a procedure
Start with a clause-to-process gap analysis, then:
- Validate customer and contract requirements separately from the published standard
- Assign evidence owners for each clause
- Use internal audits to test effectiveness before the certification body shows up
If your team wants practitioner-led AS9100D training with a structured path to audit-ready capability, QMS Learning's Aerospace & Defense pathway was built by a quality practitioner who has written over 1,000 findings on real audit floors.
Frequently Asked Questions
What are the mandatory clauses in AS9100D?
Clauses 4 through 10 contain the auditable requirements. Which specific controls apply within those clauses depends on your scope, processes, design responsibility, products, services, risks, and customer requirements.
What documents are required for AS9100D?
AS9100D requires documented information and retained records for applicable processes, but it doesn't impose one identical document list on every organization. Expect coverage of scope, process controls, risks, supplier controls, traceability, audits, management review, and corrective action.
What's the difference between AS9100 and AS9100D?
AS9100 is commonly used as the family or standard name, while AS9100D identifies the current D revision. Confirm current revision terminology with your certification body before publishing any formal documentation.
What are the key differences between AS9100D and ISO 9001?
AS9100D includes the full ISO 9001 foundation and adds aerospace-focused controls for operational risk, product safety, configuration management, traceability, supplier oversight, counterfeit parts prevention, and human factors.
What does an AS9100D auditor look for?
Auditors evaluate documented processes, implementation, employee competence, objective evidence, and process results. They check risk controls, corrective-action effectiveness, and whether what the QMS says matches what the organization actually does.
Is AS9100D certification legally required?
It's generally not a universal legal requirement. However, aerospace, defense, space, OEM, and government contracts frequently require certification or equivalent controls for supplier approval.