Introduction
Your team passed the internal readiness check. Everyone felt confident. Then the registrar's auditor leaves behind a report full of forms nobody recognizes, plus something called a PEAR score, and suddenly the quality manager is fielding panicked emails.
Here's the thing: AS9100D tells you what your quality management system needs to do. AS9101 tells the auditor exactly how to audit it and what the report has to look like. Most teams study the first standard obsessively and never open the second.
That gap is where the panic comes from.
This guide breaks down the actual forms in an AS9101 audit report, how the PEAR effectiveness scale works, and how nonconformities get documented and closed. By the end, nothing in that report package should catch your team off guard.
Key Takeaways
- An AS9101 audit report is built from five linked forms, not one free-form document
- Every audited process gets a PEAR effectiveness rating (Level 1-4), not just a conform/nonconform mark
- Nonconformities are classified major or minor, each with different evidence and closure demands
- Know the format before audit day so you can prep targeted evidence instead of scrambling
What AS9101 Actually Governs (And What It Doesn't)
AS9101G is the SAE standard that tells registrars how to plan, conduct, and document audits against the 9100-series standards. Its current revision dates to November 2022. AS9100D, by contrast, is the standard your organization is actually certified against. It defines the QMS requirements themselves.
Mixing the two up is common, and it matters because AS9101 doesn't operate alone. It works alongside:
- ISO/IEC 17021-1 — sets the baseline rules for how any certification body must operate (competence, impartiality, consistency)
- IAQG 9104-1 — governs the aerospace certification scheme as a whole
Where these documents conflict, AS9101 requirements take precedence for 9100-series audits.
| Standard | What it governs |
|---|---|
| AS9100D | QMS requirements your organization must meet |
| AS9101G | How the audit is conducted and reported |
| ISO/IEC 17021-1 | Baseline rules for certification bodies |
| IAQG 9104-1 | Overall aerospace certification scheme |
Registrars and auditors use AS9101 daily. Your quality team probably never will use it directly. But understanding it means you can anticipate exactly what evidence format the auditor is required to produce — instead of learning it for the first time when the report lands on your desk.
The Five Forms That Make Up an AS9101 Audit Report
The report isn't a single narrative document. It's a package of five standardized forms, each cross-referencing the others by process and clause, submitted together to support the certification decision. IAQG maintains the current official form templates that registrars use for this reporting.
Form 1: Stage 1 Audit Report
Covers the readiness review: scope, sites, the documented QMS review, and whether your organization is ready to move into Stage 2. Think of it as the auditor's fact-finding pass before the real assessment begins.
Form 2: QMS Process Matrix Report
This is your traceability map. It lists every audited process alongside its applicable clauses, effectiveness rating, NCR status, and the objective evidence reviewed. It's the auditor's proof that the full certification scope was actually covered, with nothing skipped.
Form 3: PEAR (Process Effectiveness Assessment Report)
Generated separately for each individual process audited — not for the QMS as a whole. It captures inputs, activities, outputs, KPIs, and the resulting effectiveness level. We'll dig into how that scoring actually works next.
Form 4: Nonconformity Report (NCR)
One record per nonconformity found. Each record includes the statement, evidence, clause reference, major/minor classification, and the full response chain your team submits back.
Form 5: Audit Report
The summary document that ties everything together: total NCRs, PEAR results across all processes, certification scope, and the auditor's final recommendation for Stage 2, surveillance, or recertification.
Understanding the PEAR: How Processes Are Actually Scored
Here's where a lot of teams get surprised. AS9101 doesn't ask an auditor to simply mark a process "conforming" or "nonconforming." Every process gets a graded effectiveness rating on a four-level scale.
| Level | What it means |
|---|---|
| 1 | Process not fully determined; planned results not delivered; corrective action underway |
| 2 | Process fully determined and realized; planned results still not delivered; action underway |
| 3 | Process determined but not fully realized; planned results are delivered |
| 4 | Process fully determined, fully realized, and delivering planned results |
The PEAR looks at two things together: Process Realization (did you actually do what your documented process says?) and Process Results (did that process produce the outcome it was supposed to?). A process can be well-designed on paper and still score low if the outputs aren't showing up in the data.
A nonconformity gets raised when a process isn't delivering planned results and appropriate action isn't being taken to fix it: that trigger condition, not a specific numeric cutoff.
That graded approach pushes auditors past procedure checks into trend data, KPIs, and real outcomes.
Practical takeaway: score your own internal audits using this same four-level logic before the registrar shows up. QMS Learning's AS9100D Internal Auditor course builds the same four-level scoring into its mock-audit capstone, so process owners practice this effectiveness thinking in-house first.
How Nonconformities Are Documented in the AS9101 Report
Every NCR follows the same anatomy, regardless of which registrar issues it:
- Nonconformity statement: the specific gap identified
- Objective evidence: what the auditor actually saw, sampled, or reviewed
- Clause reference: which AS9100D requirement wasn't met
- Classification: major or minor
Major vs. Minor: What's the Real Difference
A major nonconformity signals a systemic breakdown: missing system elements entirely, or significant doubt that your outputs will meet requirements. A minor is an isolated lapse that does not point to a broader system failure.
Registrar guidance from DNV, for example, defines majors as findings tied to absent system elements or grouped minor issues. A minor is a single lapse with no downstream impact on product or service requirements.
What You Have to Submit Back
Every NCR requires a formal response covering four elements:
- Containment: immediate action to stop the problem from spreading
- Root cause analysis: the actual "why," not just the symptom
- Corrective action plan: what changes to prevent recurrence
- Verification of effectiveness: proof the fix actually worked
Closure timelines vary by registrar, since AS9101 leaves the specific day count up to the certification body. As one documented example, NQA requires responses within 30 days, with additional objective evidence for majors due within 90 days — and certification can be suspended if those windows are missed.
Weak root cause analysis is one of the most common reasons certification decisions stall. Teams jump to a corrective action without finding the underlying cause, and the same finding shows up again next cycle.
QMS Learning's AI Workbench diagnoses whether a nonconformity looks like a process gap, an isolated incident, a supplier-driven issue, or a design flaw, then routes to the matching methodology. A recurring supplier defect, for instance, triggers 5-Why plus Supplier CAPA rather than FMEA. FMEA is built to evaluate potential failures in new or changed processes, not to close an existing finding.
The Workbench then generates the audit-ready artifact. In one documented example, that was a four-page corrective action report citing AS9100D §8.4.3, combining the 5-Why analysis with a CAPA and verified effectiveness.
How to Prepare Your Team Before the Auditor Arrives
Once you understand the report structure, preparation gets a lot more concrete.
Run internal audits using the same format the registrar will use. If your team practices PEAR-style effectiveness thinking and NCR documentation internally, the certification report format stops being a surprise. QMS Learning's AS9100D pathway builds this directly into its mock-audit capstone.
Organize evidence by process and clause ahead of time. Waiting until audit week to hunt for records across email threads and shared drives is how minor gaps turn into findings. QMS Learning's Document Management System keeps controlled documents clause-mapped, with an append-only audit trail and revision history. The Manager Dashboard exports training records, completed scenarios, and generated documents into one indexed evidence package on demand.
Cross-train more than one person. If only your quality manager can read and respond to a nonconformity report, readiness depends entirely on one person being available and unrattled. Competency-gap tracking on the Manager Dashboard shows where that single point of failure sits—before audit day, not during it.
Frequently Asked Questions
What is an AS9101 audit report?
An AS9101 audit report is the structured format registrars use to document conformity and process effectiveness findings during an AS9100-series certification audit. It uses five linked forms rather than one free-form write-up.
How do I prepare for an AS9101 or AS9100 audit?
Run internal audits using the same PEAR-style effectiveness scoring and NCR format the registrar will use. Organize objective evidence by process and clause in advance, and cross-train more than one team member on the report structure.
What are the four main types of audit reports?
Within the AS9100/AS9101 certification cycle, the four types are Stage 1, Stage 2 (initial certification), surveillance, and recertification. Each produces its own audit report package—Stage 1 covers readiness; Form 5 (the final Audit Report) covers the outcome.
What's the difference between AS9101 and AS9100?
AS9100D is the quality management system standard your organization is certified against. AS9101 is the separate standard that governs how the registrar conducts and documents that certification audit.
Who fills out the AS9101 report — the organization or the auditor?
The registrar's audit team completes and owns the report itself. Your organization provides objective evidence and formally responds to any nonconformities raised, including containment, root cause, and corrective action.
How long do we have to close a nonconformity from an AS9101 report?
Closure windows are set by the registrar, not a fixed AS9101 number. Responses are typically due within 30 days, with additional evidence for major findings often due within 90 days before certification is affected.
