AS9100 Risk Management: The Essential 2026 Guide to 6.1 and 8.1.1

AS9100 risk management works on two levels, and confusing them is one of the most common reasons organizations struggle in audits. Clause 6.1 covers the organization-wide risks and opportunities that affect your quality management system. Clause 8.1.1, operational risk management, is the aerospace addition: a defined process for managing risks to the achievement of product and service requirements inside your operational processes.

This AS9100 risk management guide explains both clauses, how they differ, what an operational risk process must include, and what auditors expect as evidence. It is based on AS9100D, which remains the certifiable revision as of October 2026.

Two Levels of AS9100 Risk Management

Aspect	Clause 6.1: Risks and opportunities	Clause 8.1.1: Operational risk management
Source	ISO 9001:2015, carried into AS9100D	Aerospace addition specific to AS9100D
Scope	Strategic and QMS-level: context, interested parties, business direction	Operational: risks to meeting product and service requirements
Typical owner	Top management	Process owners: program management, sales, design, purchasing, production
Typical tools	SWOT, PESTLE, context analysis, strategic risk register	Risk matrix per process or program, FMEA, program risk registers
Typical frequency	Annual planning and management review	Continuous: at contract review, new product introduction, changes and during delivery
Documented process required?	No explicit procedure	A planned, implemented and controlled process; most organizations document it

Both feed management review, and the two should connect. A strategic risk such as dependence on a single customer may show up operationally as capacity or delivery risks on that customer’s programs.

What Clause 8.1.1 Operational Risk Management Requires

AS9100D requires the organization to plan, implement and control a process for managing operational risks to the achievement of applicable requirements, appropriate to the organization and its products and services. The process must cover:

• Responsibilities for operational risk management
• Risk assessment criteria, such as likelihood, consequences and risk acceptance
• Identification, assessment and communication of risks throughout operations
• Identification, implementation and management of actions to mitigate risks that exceed the defined acceptance criteria
• Acceptance of risks remaining after the mitigation actions are implemented

Read the exact text in the standard, available as AS9100D from SAE. The requirements carry over from the earlier revision C, where they sat under clause 7.1.2; Rev D retitled them “operational risk management” and made clear they apply to services as well as products.

Where Operational Risks Come From

Operational risk management applies across the product and service realization processes. Typical risk sources by process:

• Contract review and sales: unclear requirements, new specifications, aggressive delivery dates, unfamiliar customer flow-downs
• Program and project management: schedule, capacity, resource and dependency risks
• Design and development: new technology, design maturity, verification and validation gaps
• Purchasing: sole sources, supplier capability, obsolescence, counterfeit parts exposure, long lead times
• Production: new processes, special processes, key characteristics with low capability, aging equipment, single-skilled operators, FOD
• Delivery and service: packaging and preservation, logistics, export controls, post-delivery support

Our counterfeit parts prevention guide and product safety guide cover two of the risk areas AS9100D treats with dedicated clauses.

Building an AS9100 Risk Management Process That Works

1. Write a short procedure. Define who owns operational risk at each stage, when assessments happen (for example at contract review, before first production, at changes) and how risks are recorded.
2. Set clear criteria. A simple likelihood-by-severity matrix with defined scales, and an acceptance threshold above which action is mandatory.
3. Assess at defined triggers. New contract, new part, new supplier, process change, work transfer, capacity change.
4. Record risks in one place. A risk register per program or per process, with owner, rating, action and residual rating.
5. Act and verify. Mitigation actions should have owners and dates, and the residual rating should be re-scored when they are complete.
6. Accept residual risk formally. Someone with defined authority signs off risks that remain after mitigation.
7. Communicate. Share relevant risks with the people affected, including suppliers and customers where appropriate.
8. Review. Feed risk status into management review and update ratings as the program matures.

Example: An Operational Risk Register Entry

Field	Example
Process	Production, new part introduction
Risk	Thin-wall feature may distort during machining, causing key characteristic nonconformance
Initial rating	Likelihood 4 × severity 4 = 16 (above acceptance threshold of 9)
Mitigation	Dedicated fixture, revised machining sequence, capability study before first article
Owner and date	Manufacturing engineer, before first article inspection
Residual rating	Likelihood 2 × severity 4 = 8 (accepted by operations manager)

The scoring scale is illustrative; set your own scales and thresholds in your procedure.

Evidence Auditors Expect for AS9100 Risk Management

• A defined process for 8.1.1 with responsibilities and criteria
• Risk registers or program risk assessments that are current, not created once for the audit
• Mitigation actions with evidence of completion
• Formal acceptance of residual risk
• Links from risk assessment to contract review, supplier selection, production planning and change control
• Strategic risks and opportunities under 6.1, with actions and their evaluation
• Risk inputs to management review

Auditors often test 8.1.1 through a recent contract or new part: they ask what risks were identified, what was done, and who accepted what remained. If the answer lives only in someone’s head, expect a finding.

Common Mistakes

• One enterprise risk register used for both clauses, with no operational detail
• Risk assessments done once at certification and never updated
• No defined acceptance criteria, so nobody knows which risks require action
• Mitigations listed but not verified
• Supplier risks ignored, even though purchasing is often the biggest operational risk source

What About IA9100?

The IAQG plans to replace AS9100D with IA9100, but as of October 2026 the new standard has not been published. Risk management is expected to remain central. Build the process now on AS9100D and adjust when the new text is released. See our IA9100 guide for the latest status.

The AS 9100 Toolkit includes a risk management procedure and register templates aligned to AS9100D, part of 38 editable documents. For how risk fits into the wider AS9100 family, read our overview of aerospace quality management.

Connecting AS9100 Risk Management to Other Aerospace Clauses

AS9100 risk management is not a standalone exercise. Several other aerospace requirements depend on it:

• Configuration management (8.1.2): assess the risk of changes before approving them
• Product safety (8.1.3): hazards and safety-critical items are risks with the highest consequence
• Counterfeit parts (8.1.4): sourcing outside authorized channels is a defined risk to mitigate
• Work transfers: moving work between sites or suppliers should trigger a risk assessment
• External providers (8.4): supplier risk drives the level of control applied
• Production (8.5.1): FOD, special processes and key characteristics all carry operational risk

A simple way to show auditors the link is to reference the operational risk procedure from each of these procedures, so every trigger leads back to one consistent method.

Scaling AS9100 Risk Management to Your Organization

A small build-to-print machine shop may manage operational risk with a one-page assessment at contract review and a short risk section on each new part plan. A design-authority manufacturer running multi-year programs will need program risk registers, regular risk reviews and links to design reviews. AS9100D allows both, provided the process is appropriate to your products and services and the evidence is current.

Opportunities, Not Just Threats

Clause 6.1 refers to risks and opportunities, and auditors notice when a risk register lists only threats. AS9100 risk management at the strategic level should also capture opportunities, such as a new customer program, a process technology that improves capability, or a supplier that could reduce lead time. Record them with owners and planned actions in the same way as risks, and evaluate the effectiveness of the actions taken at management review. Doing so shows that the process supports improvement as well as protection.

Frequently Asked Questions

Is a risk register mandatory under AS9100?

The standard does not name a risk register, but you need evidence of identified risks, ratings against criteria, actions and accepted residual risk. A register is the simplest way to show that.

Is FMEA required for AS9100 risk management?

No. AS9100D does not prescribe a method. FMEA is common, especially when customers invoke AS9145, but a simpler risk matrix is acceptable if it meets the clause requirements.

Who should own AS9100 risk management?

Top management owns the strategic risks and opportunities under clause 6.1. Operational risks under 8.1.1 are usually owned by process or program owners, with the quality function maintaining the method and checking that it is applied.

How often should operational risks be reviewed?

At defined triggers such as new contracts, new parts, process changes and work transfers, and periodically during delivery. Many organizations review program risks monthly and summarize the status at management review.

Does AS9100 risk management require a separate procedure?

Clause 8.1.1 requires a planned, implemented and controlled process. A short documented procedure is the most practical way to show that, and most certified organizations have one.