What Actually Happens During an AS9100 Audit (And What Auditors Are Really Looking For)

For many businesses, the audit is the part that creates the most uncertainty.

What will the auditor ask? What are they really looking for? What happens if something goes wrong?

It’s often the point where everything starts to feel real.

In practice, however, an AS9100 audit is not designed to catch businesses out. Its purpose is to understand how the organisation actually operates, and whether that operation is controlled in a way that the aerospace industry can rely on.

Once that distinction is clear, the process becomes far easier to navigate.

The Two Stages of an AS9100 Audit

Every AS9100 certification audit follows a two-stage approach, with each stage serving a distinct purpose.

Stage 1 – Readiness Review

Stage 1 is effectively a structured review of your management system to determine whether the business is prepared to proceed to full certification.

At this point, the auditor is not testing your operations in detail. Instead, they are assessing whether the framework of your system is in place.

This typically includes a review of your documented management system, the defined scope of certification, your key processes, and evidence that internal audits and management reviews have been conducted.

The underlying question is straightforward: does this organisation have a sufficiently developed system to justify moving to Stage 2?

Where gaps are identified, the business is given the opportunity to address them before progressing. It is not about perfection at this stage, but there does need to be clear structure and intent.

Stage 2 – Full Certification Audit

Stage 2 is where the audit moves from theory into practice.

Here, the auditor is no longer focused on what the system says should happen, but on what actually happens within the business.

This involves following real processes as they occur, sampling records, speaking directly with employees, and observing activities across the organisation.

In other words, the audit shifts from documentation to operation.

The objective is to determine whether the system is being followed consistently, and whether it is effective in controlling the organisation’s activities.

What Auditors Are Really Looking For

A common misconception is that AS9100 audits are primarily concerned with documentation.

While documentation is important, it is not the focus of the audit.

What auditors are really assessing is whether the business is operating in a controlled and consistent manner.

This typically becomes visible through several key indicators. Processes should be clearly defined and understood, but more importantly, they must be followed in practice.

There needs to be traceability, allowing products or services to be tracked from origin through to delivery. Activities should be repeatable, rather than dependent on individual interpretation, and employees should have a clear understanding of their roles within those processes.

Crucially, there must also be evidence. Records should demonstrate that the system is functioning as intended, rather than simply existing on paper.

When a management system accurately reflects how the business operates day to day, these elements tend to fall into place naturally.

Where the system is disconnected from reality, gaps become much more visible.

How the Audit Actually Flows

Another area that often causes confusion is how the audit itself is structured.

Rather than working through the clauses of AS9100 sequentially, auditors typically follow the organisation’s processes.

A common starting point might be a customer order, which is then traced through purchasing, goods receipt or production, inspection, and final release.

This process-based approach allows the auditor to understand how different parts of the business interact, and whether those interactions are controlled.

It also reflects how work actually happens within the organisation, which is why it is far more effective than a clause-by-clause review.

What Happens If Issues Are Found

It is not unusual for auditors to identify issues during an audit. These are formally recorded as nonconformities and are generally classified as either minor or major, depending on their severity and impact.

A minor nonconformity typically represents an isolated lapse or a small gap in the system, whereas a major nonconformity indicates a more significant breakdown in control or a systemic issue.

Importantly, the presence of nonconformities does not mean that certification has failed. Instead, it highlights areas where improvement is required.

The organisation is expected to investigate the root cause, implement appropriate corrective actions, and provide evidence that the issue has been resolved in a way that prevents recurrence.

When this is handled effectively, certification can still proceed.

What Makes an Audit Go Well (And What Doesn’t)

In practice, audits tend to run smoothly when the management system is aligned with the way the business actually operates. Employees understand their roles, processes are followed as defined, and records are consistent and readily available.

Difficulties tend to arise where the system has been developed in isolation from the operation itself. This is often the case when templates have been applied without proper integration, resulting in processes that employees do not recognise and records that do not align with what is happening in practice.

In these situations, the issue is rarely capability. It is a lack of alignment between the system and the business.

What Auditors Don’t Expect

There is often an assumption that audits require perfection, detailed knowledge of the standard, or a highly polished presentation.

In reality, auditors are looking for something much simpler: a system that is controlled, functional, and coherent.

They expect to see that the organisation understands its processes, applies them consistently, and maintains appropriate records.

Beyond that, they are not looking for perfection, but for confidence that the system works.

Final Thought

An AS9100 audit is best understood as a structured method of demonstrating that your business operates with the level of control expected within the aerospace sector.

When the management system is built around real processes, the audit becomes far less confrontational than many expect. It becomes an opportunity to confirm that the organisation is operating in a way that others can trust.

If you need help with this, we’re more than happy to help you through the process.