Depending on how your QMS was written concerning validation, approval, and continued monitoring of ASPs, someone or something triggers the approval of the SP correct? For myself, our Prime has Approved Special Processors listed and I try to use those exclusively as they have already met the criteria of the Prime, in my case an OEM. When I have a SP that I can't find an ASP on that list, I have an entirely different rout I must travel...a Vendor Survey Form which must be completed. Most of our work is Military and they only want to se compliance of a SP to a Standard. A NADCAP Approval to my DCMA-QAR would just be one more feather in my cap sort-of-speak. Normaly, their approval or cert on the wall is not enough by itself.
So look at the Standard:
8.5.1.2
"For processes where the resulting output cannot be verified by subsequent monitoring or measurement (STOP! to me if this criteria can be met, is there need to go further? NO!), the organization shall establish arrangements for these processes including, as applicable:
a. definition of criteria for the review and approval of the processes; (What do you say in your QMS? Do you have a Vendor Survey Form? What does it ask? Would your customers approve you with those responses?)
b. determination of conditions to maintain the approval; (What do you say in your QMS? Annual Vendor Surveys? Every other year? Are CAPA/ SCARs part of that review? is there a threshold that must be maintained?)
c. approval of facilities and equipment; (What do you say in your QMS? Is it adequate to preform in a timely fashion? Is there risk of product damage? Do they demonstarte some sore of conveyance and mitigation?)
d. qualification of persons; (What do you say in your QMS? What is your customer's requirements/ expectations? They are in the Driver's Seat, the Standard doesn't care as long as it is addressed)
e. use of specific methods and procedures for implementation and monitoring the processes; (What do you say in your QMS? Again, this can be as simple or as compplex as you want to make it.)
f. requirements for documented information to be retained. (What do you say in your QMS? What documentation? How stored? How long?)
NOTE: For outsourced special processes, the organization’s external provider control process should address these items accordingly and review the use of customer-designated sources, when required"
I am audited several times annually by FAA/ EASA, DCMA, the Prime OEM, and ISO/AS and I have passed all audits without so much as a question or second guess. I have a background in AS9100, NADCAP, and have put together many, many Gap Analysis documents to find if our QMS or Repair Station QM is/ are compliant and any shortcomings they might have. I have to maintain an FAA Approved QM and Training Manual, an EASA MAG, and an AS9110 QM all at the same time currently.
Hope some or any of this helps answer your questions. I may be all wet, but again, no findings or even OFIs in years.