Top Ten Internal Audit Findings in Aerospace Machine Shops

Common AS9100 internal audit findings in build-to-print machine shops — and how to turn them into a stronger, more usable quality system.

Schedule an AS9100 Internal Audit Readiness Call
Internal Audit Preparation Checklist
Schedule an AS9100 Internal Audit Readiness Call
Download the Internal Audit Preparation Checklist

Finding 1

Contract Review Does Not Fully Capture Customer Requirements.

The shop accepts a purchase order, drawing package, or customer requirement without fully documenting review of:

  • Drawing revision.
  • Customer specifications.
  • Special process requirements.
  • Inspection requirements.
  • Material requirements.
  • Certificate of Conformance requirements.
  • Delivery and packaging requirements.
  • Flowdown requirements.
  • Customer-specific quality clauses.

For build-to-print machine shops, contract review is one of the most important quality processes. If the shop misses a requirement before accepting the job, the error may not show up until production, inspection, delivery, or customer receipt.

  • Are purchase orders reviewed before acceptance?
  • Are customer drawings and specifications reviewed?
  • Are customer quality clauses identified?
  • Are changes reviewed before production continues?
  • Are unclear requirements resolved with the customer?
  • Is there objective evidence of review?

Business impact

Strong contract review prevents rework, missed requirements, customer complaints, and delivery delays.

Finding 2

Drawing, Model, or Revision Control Is Weak Auditors may find:

Auditors may find:

  • Travelers referencing outdated drawing revisions.
  • Inspection records missing revision information.
  • Employees using uncontrolled copies of drawings.
  • Customer models stored without clear revision status.
  • Obsolete files not removed or marked.
  • Customer changes not communicated to production or inspection.

 

Aerospace customers expect product to be manufactured and inspected to the correct revision of the approved requirement. A wrong revision can create scrap, rework, escapes, or customer rejection.

  • Are current drawings available at point of use?
  • Are obsolete drawings controlled?
  • Do travelers and inspection records reference the correct revision?
  • Are digital models controlled?
  • Are customer changes reviewed and communicated?
  • Can employees explain how they know they are using the current revision?

Business impact

Revision control protects the company from producing good parts to the wrong requirement.

Finding 3

Build-to-Print Scope and Design Responsibility Are Not Clearly Defined

The company says it is build-to-print, but the QMS does not clearly define whether product design, R&D, reverse engineering, or customer product development are inside or outside the certification scope.

For build-to-print machine shops, design and development applicability should be clear. If the customer owns the design, the QMS should explain how the company controls customer-provided requirements and manufacturing planning without unintentionally claiming responsibility for product design.

  • Is the certification scope clearly written?
  • Does the QMS state whether design and development is applicable?
  • Are R&D or product development activities separated from certified production work?
  • Are CNC programming, setup planning, tooling, and inspection planning defined as manufacturing support rather than customer product design?
  • Do sales and contract review personnel understand the boundary?

Business impact

Clear scope prevents over-auditing, confusion, and unnecessary documentation.

Finding 4

Supplier Approval and Flowdown Are Incomplete

Auditors may find:

  • Suppliers used without documented approval.
  • Supplier performance not monitored.
  • Purchase orders missing required flowdowns.
  • Special process suppliers not controlled.
  • Supplier corrective actions not tracked.
  • Receiving verification records incomplete.

A supplier problem can quickly become your customer problem. Aerospace machine shops often rely on outside processing, material suppliers, calibration providers, finishing suppliers, and other external providers.

  • Is there an approved supplier list?
  • Are approval criteria defined?
  • Are supplier risks considered?
  • Are purchase order flowdowns complete?
  • Are supplier performance records maintained?
  • Are supplier corrective actions tracked to closure?

Business impact

Supplier control protects product conformity, delivery performance, and customer trust.

Finding 5

Calibration and Measuring Equipment Records Are Incomplete

Common issues include:

  • Measuring equipment past calibration due date.
  • Calibration status not identified.
  • Calibration records missing.
  • Equipment not listed on the calibration recall log.
  • Out-of-tolerance conditions not evaluated.
  • Employees using tools not suitable for the measurement.

Inspection decisions depend on measurement confidence. If measuring equipment is not controlled, the company may not be able to prove that accepted product met requirements.

  • Is all inspection equipment identified?
  • Is calibration status visible?
  • Are calibration records current?
  • Is there a recall process?
  • Are out-of-tolerance conditions evaluated?
  • Are records tied to the equipment used for product acceptance?

Business impact

Calibration control protects product acceptance decisions and reduces the risk of customer escapes.

Finding 6

Inspection and Acceptance Records Do Not Prove Conformity

The part may have been inspected, but the records do not clearly show:

  • What characteristic was inspected.
  • What requirement applied.
  • What result was obtained.
  • Who performed the inspection.
  • What measuring equipment was used, if required.
  • Whether the part was accepted or rejected.
  • What drawing revision or job number the record applies to.

In aerospace manufacturing, “we inspected it” is not enough. The organization must be able to provide objective evidence that product met requirements.

  • Are inspection records complete?
  • Do records show actual results where required?
  • Are acceptance criteria clear?
  • Are inspection records linked to the job, drawing, and revision?
  • Are final acceptance and release records complete?
  • Are COC requirements understood and met?

Business impact

Good inspection records protect the company during customer questions, audit reviews, and nonconformance investigations.

Finding 7

Material Traceability and Certificate Controls Are Weak

Auditors may find:

  • Material certifications not linked to jobs.
  • Lot or heat traceability not maintained.
  • Certificates missing required information.
  • Raw material not clearly identified.
  • Cut material not traceable after separation.
  • COC packages incomplete.

Traceability is essential for many aerospace customers. If the shop cannot connect material, job, inspection, and delivery records, it may not be able to prove conformity after the fact.

  • Are material certifications retained?
  • Are materials traceable to job records?
  • Are lots, heats, or batches controlled where required?
  • Is cut material identified?
  • Are COCs reviewed before shipment?
  • Are customer traceability requirements flowed into production and inspection?

Business impact

Traceability protects customer confidence and reduces exposure when a material or product issue is discovered.

Finding 8

Nonconforming Product Control Is Informal

Issues may include:

  • Nonconforming parts not clearly identified.
  • Scrap, rework, use-as-is, or return-to-supplier decisions not documented.
  • Unauthorized dispositions.
  • Customer approval not obtained when required.
  • Reworked product not re-inspected.
  • Nonconformance trends not reviewed.

Nonconforming product control prevents unintended use, delivery, or acceptance of product that does not meet requirements.

  • Is nonconforming product identified and segregated or controlled?
  • Are dispositions documented?
  • Are disposition authorities defined?
  • Are rework instructions clear?
  • Is reworked product re-verified?
  • Are customer approvals obtained when required?
  • Are nonconformance trends reviewed?

Business impact

Strong nonconformance control prevents escapes and protects customer relationships.

Finding 9

Corrective Actions Do Not Address Root Cause

Corrective action records may show:

  • The issue was corrected, but root cause was not identified.
  • The same issue repeats.
  • The corrective action does not match the cause.
  • Effectiveness verification is missing.
  • Actions are overdue.
  • Evidence of closure is weak.

CAPA should prevent recurrence. If the process only fixes the immediate issue, the same problem may return during production, customer review, or the next audit.

  • Does the corrective action identify root cause?
  • Does the action address the root cause?
  • Is responsibility assigned?
  • Are due dates tracked?
  • Is objective evidence attached?
  • Was effectiveness verified?
  • Are repeat issues reviewed?

Business impact

Good CAPA turns problems into business improvement instead of repeat findings.

Bonus Finding: Training and Competence Records Are Missing or Incomplete

Finding 10

Internal Audit and Management Review Do Not Drive Improvement How it shows up

  • Internal audits performed late or not completed.
  • Audit coverage does not include all required processes.
  • Audits are checklist-only and not process-based.
  • Auditor independence is weak.
  • Findings are not followed to closure.
  • Management review is missing required inputs.
  • Quality objectives are not measurable.
  • Leadership does not review process performance or trends.

Nonconforming product control prevents unintended use, delivery, or acceptance of product that does not meet requirements.

  • Is there an internal audit schedule?
  • Are process audits completed as planned?
  • Are auditors competent and independent?
  • Are findings documented and closed?
  • Does management review include meaningful performance data?
  • Are quality objectives measurable?
  • Are actions assigned and followed up?

Business impact

A strong internal audit and management review process helps the company improve before problems become customer issues.

Bonus Finding:
Training and Competence Records Are Missing or Incomplete

How it shows up
Employees know how to do the job, but records do not show:

  • Required competence by role.
  • Training completed.
  • Evaluation of competence.
  • Procedure change awareness.
  • Qualification for inspection, special tasks, or audit roles.

Why it matters
Aerospace quality systems rely on competent personnel. If the organization cannot show how competence is determined and maintained, the process becomes difficult to defend during an audit.

What to check before the audit

  • Are training records current?
  • Are competence requirements defined?
  • Are employees trained on relevant procedures?
  • Are role-specific qualifications documented?
  • Are new or revised procedures communicated?

Business impact

Good competence records protect the organization and help employees perform consistently.

How to Use This List

This list is most useful when treated as a pre-audit readiness tool. Before your next internal or external audit, review each area and ask:
  • Do we have a defined process?
  • Do people understand the process?
  • Do records show the process is being followed?
  • Are the records complete, current, and retrievable?
  • Does the process help the business, or does it exist only for the audit?
  • Have we reviewed trends and taken action where needed?
If the answer is unclear, the area may be audit risk.

How Apogee Can Help

Apogee helps aerospace machine shops and build-to-print suppliers identify and correct these issues before they become customer or certification-body findings. Support may include:
  • AS9100 internal audit preparation.
  • Internal audit planning and execution.
  • Build-to-print certification scope review.
  • Contract review process improvement.
  • Drawing and revision-control review.
  • Supplier control review.
  • Calibration and inspection record review.
  • CAPA support.
  • Management review preparation.
  • Stage 1 and Stage 2 readiness support.
  • Ongoing audit-ready QMS retainers.

Why Work With Apogee QMS

Apogee QMS is led by Kevin Walters, AEA, PMP, PMI-RMP, an aerospace quality professional with over 30 years of experience in quality assurance, project management, satellite operations, procedure development, training, QMS auditing, supplier/internal audit leadership, corrective action, KPI reporting, and AS9100/AS9120/ISO 9001 consulting. Apogee understands that aerospace suppliers do not need a quality system that only looks good during the audit. They need a system that helps the company operate better every day.

If the answer is unclear, the area may be audit risk.

Want to Find These Issues Before the Auditor Does?

Apogee can help your aerospace machine shop prepare for internal, customer, surveillance, recertification, or certification audits. We provide practical AS9100 internal audit support focused on objective evidence, process effectiveness, and business value.
Schedule an AS9100 Internal Audit Readiness Call
Request an Internal Audit Quote