Top Ten Internal Audit Findings in Aerospace Machine Shops

Common AS9100 internal audit findings in build-to-print machine shops — and how to turn them into a stronger, more usable quality system.

Schedule an AS9100 Internal Audit Readiness Call
Download the Internal Audit Preparation Checklist
Schedule an AS9100 Internal Audit Readiness Call
Download the Internal Audit Preparation Checklist

Finding 1

Contract Review Does Not Fully Capture Customer Requirements.

  • Customer specifications
  • Drawing revision
  • Inspection requirements
  • Material requirements
  • Certificate of Conformance requirements
  • Delivery and packaging requirements
  • Flowdown requirements
  • Customer-specific quality clauses

For build-to-print machine shops, contract review is one of the most important quality processes. If the shop misses a requirement before accepting the job, the error may not show up until production, inspection, delivery, or customer receipt.

  • Are purchase orders reviewed before acceptance?
  • Are customer drawings and specifications reviewed?
  • Are customer quality clauses identified?
  • Are changes reviewed before production continues?
  • Are unclear requirements resolved with the customer?
  • Is there objective evidence of review?

Finding 2

Drawing, Model, or Revision Control Is Weak Auditors may find:

  • Travelers referencing outdated drawing revisions
  • Inspection records missing revision information.
  • Employees using uncontrolled copies of drawings.
  • Customer models stored without clear revision status.
  • Obsolete files not removed or marked.
  • Customer changes not communicated to production or inspection.

Aerospace customers expect product to be manufactured and inspected to the correct revision of the approved requirement. A wrong revision can create scrap, rework, escapes, or customer rejection.

  • Are current drawings available at point of use?
  • Are obsolete drawings controlled?
  • Do travelers and inspection records reference the correct revision?
  • Are digital models controlled?
  • Are customer changes reviewed and communicated?
  • Can employees explain how they know they are using the current revision?

Business Impact:

Revision control protects the company from producing good parts to the wrong requirement.

Finding 3

Build-to-Print Scope and Design Responsibility Are Not Clearly Defined

The company says it is build-to-print, but the QMS does not clearly define whether product design, R&D, reverse engineering, or customer product development are inside or outside the certification scope.

For build-to-print machine shops, design and development applicability should be clear. If the customer owns the design, the QMS should explain how the company controls customer-provided requirements and manufacturing planning without unintentionally claiming responsibility for product design.

  • Is the certification scope clearly written?
  • Does the QMS state whether design and development is applicable?
  • Are R&D or product development activities separated from certified production work?
  • Are CNC programming, setup planning, tooling, and inspection planning defined as manufacturing support rather than customer product design?
  • Do sales and contract review personnel understand the boundary?

Business Impact:

Clear scope prevents over-auditing, confusion, and unnecessary documentation.

Finding 4

Supplier Approval and Flowdown Are Incomplete

Auditors may find:

  • Suppliers used without documented approval.
  • Supplier performance not monitored.
  • Purchase orders missing required flowdowns.
  • Special process suppliers not controlled.
  • Supplier corrective actions not tracked.
  • Receiving verification records incomplete.

A supplier problem can quickly become your customer problem. Aerospace machine shops often rely on outside processing, material suppliers, calibration providers, finishing suppliers, and other external providers.

  • Is there an approved supplier list?
  • Are approval criteria defined?
  • Are supplier risks considered?
  • Are purchase order flowdowns complete?
  • Are supplier performance records maintained?
  • Are special process requirements flowed down?
  • Are supplier corrective actions tracked to closure?

Business Impact:

Supplier control protects product conformity, delivery performance, and customer trust.

Finding 5

Calibration and Measuring Equipment Records Are Incomplete

Common issues include:

  • Measuring equipment past calibration due date.
  • Calibration status not identified.
  • Calibration records missing.
  • Equipment not listed on the calibration recall log.
  • Out-of-tolerance conditions not evaluated.
  • Employees using tools not suitable for the measurement.

Inspection decisions depend on measurement confidence. If measuring equipment is not controlled, the company may not be able to prove that accepted product met requirements.

  • Is all inspection equipment identified?
  • Is calibration status visible?
  • Are calibration records current?
  • Is there a recall process?
  • Are out-of-tolerance conditions evaluated?
  • Are records tied to the equipment used for product acceptance?

Business Impact:

Calibration control protects product acceptance decisions and reduces the risk of customer escapes.

Finding 6

Inspection and Acceptance Records Do Not Prove Conformity

The part may have been inspected, but the records do not clearly show:

  • What characteristic was inspected.
  • What requirement applied.
  • What result was obtained.
  • Who performed the inspection.
  • What measuring equipment was used, if required.
  • Whether the part was accepted or rejected.
  • What drawing revision or job number the record applies to.

In aerospace manufacturing, “we inspected it” is not enough. The organization must be able to provide objective evidence that product met requirements.

  • Are inspection records complete?
  • Do records show actual results where required?
  • Are acceptance criteria clear?
  • Are inspection records linked to the job, drawing, and revision?
  • Are final acceptance and release records complete?
  • Are COC requirements understood and met?

Business Impact:

Good inspection records protect the company during customer questions, audit reviews, and nonconformance investigations.

Finding 7

Material Traceability and Certificate Controls Are Weak

Auditors may find:

  • Material certifications not linked to jobs.
  • Lot or heat traceability not maintained
  • Certificates missing required information.
  • Raw material not clearly identified.
  • Cut material not traceable after separation.
  • COC packages incomplete.

Traceability is essential for many aerospace customers. If the shop cannot connect material, job, inspection, and delivery records, it may not be able to prove conformity after the fact.

  • Is all inspection equipment identified?
  • Is calibration status visible?
  • Are calibration records current?
  • Is there a recall process?
  • Are out-of-tolerance conditions evaluated?
  • Are records tied to the equipment used for product acceptance?

Business Impact:

Calibration control protects product acceptance decisions and reduces the risk of customer escapes.

Finding 8

Nonconforming Product Control Is Informal

Issues may include:

  • Nonconforming parts not clearly identified.
  • Scrap, rework, use-as-is, or return-to-supplier decisions not documented.
  • Unauthorized dispositions.
  • Customer approval not obtained when required.
  • Reworked product not re-inspected.
  • Nonconformance trends not reviewed.

Nonconforming product control prevents unintended use, delivery, or acceptance of product that does not meet requirements.

  • Is nonconforming product identified and segregated or controlled?
  • Are dispositions documented?
  • Are disposition authorities defined?
  • Are rework instructions clear?
  • Is reworked product re-verified?
  • Are customer approvals obtained when required?
  • Are nonconformance trends reviewed?

Business Impact:

Strong nonconformance control prevents escapes and protects customer relationships.

Finding 9

Corrective Actions Do Not Address Root Cause

Corrective action records may show:

  • The issue was corrected, but root cause was not identified.
  • The same issue repeats.
  • The corrective action does not match the cause.
  • Effectiveness verification is missing.
  • Actions are overdue.
  • Evidence of closure is weak.

CAPA should prevent recurrence. If the process only fixes the immediate issue, the same problem may return during production, customer review, or the next audit.

  • Does the corrective action identify root cause?
  • Does the action address the root cause?
  • Is responsibility assigned?
  • Are due dates tracked?
  • Is objective evidence attached?
  • Was effectiveness verified?
  • Are repeat issues reviewed?

Business Impact:

Good CAPA turns problems into business improvement instead of repeat findings.

Finding 10

Internal Audit and Management Review Do Not Drive Improvement How it shows up

Issues may include:

  • Nonconforming parts not clearly identified.
  • Scrap, rework, use-as-is, or return-to-supplier decisions not documented.
  • Unauthorized dispositions.
  • Customer approval not obtained when required.
  • Reworked product not re-inspected.
  • Nonconformance trends not reviewed.

Nonconforming product control prevents unintended use, delivery, or acceptance of product that does not meet requirements.

  • Is nonconforming product identified and segregated or controlled?
  • Are dispositions documented?
  • Are disposition authorities defined?
  • Are rework instructions clear?
  • Is reworked product re-verified?
  • Are customer approvals obtained when required?
  • Are nonconformance trends reviewed?

Business Impact:

Strong nonconformance control prevents escapes and protects customer relationships.

Strengthen your quality system, get AS9100, AS9120, and ISO 9001 support

BOOK A DISCOVERY CALL