ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
An AS9100 internal audit checklist is how an aerospace supplier finds its own problems before a certification body, a prime contractor or a customer does. Internal audits are a requirement of the standard, but a lot of companies treat them as paperwork, and that is exactly how avoidable nonconformities reach the external audit.
This guide explains how to plan the audit programme, what to put in the checklist, how to audit processes rather than clauses and how to close findings. It is written for quality managers and internal auditors at aerospace, space and defense suppliers. The current standard is AS9100D, and an update under the IA9100 name is expected; confirm the status with your certification body. Nothing here replaces the standard itself.
Free gap assessment
Are you ready for the 2026 edition of ISO 9001?
Score yourself against the new edition, free, including the risk and opportunity split and the clause 10 renumbering that breaks converted checklists.
Run the free ISO 9001 gap assessment → or View premium report sample
AS9100 builds on ISO 9001 and adds requirements specific to aerospace, such as product safety, counterfeit parts prevention, configuration management, first article inspection, special requirements and risk, key characteristics and on-time delivery. The internal audit requirement is in the same clause as in ISO 9001: the organization conducts audits at planned intervals to determine whether the quality management system conforms and is effectively implemented.
That means the programme must cover every process and every requirement, including the aerospace additions, and it must consider process importance, changes affecting the organization and results of previous audits. See our comparison of AS9100 vs ISO 9001 for what the extra requirements are.
Build an annual schedule that covers every process, site and shift. Assign competent, objective auditors, and make sure nobody audits their own work. Base frequency on risk: processes with poor performance, recent change or a history of findings deserve more attention. Write an audit plan for each audit with scope, criteria and method.
Keep records of auditor training and qualification. Customers and certification bodies often ask to see them, and they are easy to forget until someone asks. If your company is small, consider sharing auditors with a sister site or hiring an independent auditor for sensitive areas.
The best audits follow a process through the business rather than marching through clause numbers. Take the order-to-delivery process, for instance: contract review, planning, purchasing, receiving inspection, production, test, packing, shipping and feedback. At each stage ask who owns it, what the inputs and outputs are, what the risks are, what indicators exist and what happened the last time something went wrong.
A process map or turtle diagram for each process makes the audit faster, because the questions come from the map. Link each question to the relevant AS9100 clauses in the checklist so that coverage can be demonstrated afterwards.
| Audit focus | What to test | Evidence to sample |
|---|---|---|
| Process approach | Inputs, outputs, owners, risks and performance indicators | Process maps, KPI reports |
| Delivery and quality performance | On-time delivery and quality performance monitored and acted on | OTD and OQD reports, action logs |
| Product safety and counterfeit parts | Controls and training for personnel and suppliers | Procedures, training records, supplier requirements |
| Configuration management | Baselines, change control, status accounting | Change records, configuration reports |
| First article inspection | Completed when required and retained | FAI reports |
| Supplier control | Approval, flow-down and monitoring | Approved supplier list, scorecards, flow-down records |
| Nonconformity and corrective action | Containment, root cause and effectiveness | Nonconformance reports, corrective action records |
Write the checklist from your own procedures and the standard, and include space for evidence, not just yes or no. Include these questions in every audit cycle.
These aerospace-specific areas often receive too little attention in internal audits. Read our guides on AS9100 product safety, counterfeit parts prevention and configuration management before you write the questions.
For product safety, test awareness: ask operators how their work affects the safety of the end product and how they would report a concern. For counterfeit parts, check purchasing flow-down and receiving inspection. For configuration, trace one part number from the approved baseline to the shipped item and confirm the records match. On first article inspection, see first article inspection.
Write findings against a clause and with evidence. Classify them as your procedure requires, and record the responses. The auditee should determine the cause, correct the problem and take corrective action that prevents recurrence; the auditor then verifies effectiveness. Keep findings and trends visible to management.
Use the results as an input to management review. Trends by process, site and clause show where the system is weak and where to spend audit time next year. Our pages on aerospace quality management and AS9110 vs AS9120 cover related standards for maintenance and distribution.
According to a March 2026 summary from a certification services provider, AS9100D remains the active standard, with the IA9100 update targeted for late 2026 and an estimated two-to-three-year transition window after publication. The same summary lists expected emphasis on product safety, information security, counterfeit parts, supplier control and quality culture. Treat these as expectations until the final text is published. Our page on IA9100 tracks the change, and the Smithers explanation of AS9100 D and the coming IA9100 update is a good overview.
Practically, add a line to your audit programme to review the new edition when it is released and to plan a gap analysis. Keep the AS9100D checklist in use until your certification body confirms your transition dates.
The audit programme, plan, checklist, report and corrective action forms are the core documents. The AS 9100 Toolkit includes editable templates for those and for the rest of the quality system, written for the aerospace requirements, so you can start from a working structure. Decide also whether certification is worth it for your business; see is AS9100 worth it and AS9100 certification cost.
Take the checklist to the point of work. Pick a job in progress and trace it: the traveler or work order, the approved drawing revision, the tooling and gauges in use, the operator’s training record, the inspection stamps and the material certificates. Ask the operator to show you the current revision of the instruction and explain what they would do if a dimension was out of tolerance. Check that nonconforming material is tagged and segregated and that the nonconformance report matches the physical evidence. Note what you see, not what you expected to see.
Watch for the gaps that paperwork hides: a calibration sticker that has expired, a work instruction taped to a machine that is two revisions old, a special process performed by an operator whose approval has lapsed, or a first article report that cites a drawing no longer in force. Each of these is easy to fix and easy for an external auditor to find, so your AS9100 internal audit checklist should prompt for them by name.
Plan time by risk. A high-risk process such as special processing or final inspection may need half a day, while a low-risk support process may need an hour. Sample across shifts and across part numbers, including recent engineering changes and new customers. Record how many records you reviewed so the audit shows its own coverage. If time runs out, say what was not audited and schedule a follow-up, so nobody assumes the gap was covered.
Include a sample of supplier controls in each cycle: confirm that the approved supplier list is current, that purchase orders carry the required flow-down and that incoming inspection matches the requirements. Also check customer-supplied property, such as tooling or material, for identification, storage and reporting of loss or damage. These areas are often left to the end of the audit programme and then dropped when schedules compress.
Review the checklist after every audit cycle and whenever the standard, a customer requirement or your own process changes. Remove questions that never find anything, and add questions for new products, new suppliers and recent findings. Version the checklist, so an auditor always works from the approved copy, and keep old versions to show how the programme evolved. A living AS9100 internal audit checklist stays useful; a static one slowly turns into a formality.
Certification bodies expect to see that internal audits are effective, not simply scheduled. A well-kept AS9100 internal audit checklist with evidence, findings and follow-up is the easiest way to show that. It also reduces the number of surprises on audit day, because the problems the external auditor would raise have usually been found, fixed and recorded months earlier by your own team.
Typical errors include generic checklists, auditing only paperwork, leaving aerospace additions out, letting the same people audit the same areas every year, and closing findings without checking effectiveness. Another common one is skipping performance data: an audit that never looks at on-time delivery and quality performance misses the most visible indicator of a system in trouble.
Yes. The standard requires audits at planned intervals covering the whole quality management system.
Every process should be covered within your programme, with frequency based on risk, importance and past results. Many companies cover all processes at least annually.
No. Auditors must be objective and impartial and must not audit their own work.
A new edition is expected, so plan a gap review when it is published and confirm transition dates with your certification body.
Scope, criteria, findings with clause references and evidence, conclusions and follow-up actions.
October 1, 2026
