Internal Audit Plan and Audit Checklist per AS9100

[Randy]

.... which just about sums everything up. If the wording of the Standard confuses everyone, what hope is there left for us?

Yep, DUH!

 

[mattador78]

The thing that is confusing me is the word "area". I don't see that in the standard. An audit should be process-based. The audit should check for conformance to requirements. If these 'areas' you discuss are requirements, and they are managed within a process, just ensure the requirements are audited when you get to that process.

How it works here, we have a process that both 9100 and 9001 are produced through jobcard controls it audit against the jobcards. Same area, same process usual difference is just inspection criteria and records controlled by senior staff. On internal and external audits follow the paperwork job done. Doesnt need to be made harder than it needs to be. Same with the office side 9100 is just the bold text its not that much more than the 9001 for most parts.

 

[Jtavo]

Dear all,

I would like to have your advice on the below questions I have.

Our company has ISO9001 certified and we produce our own designed products, including machining the parts and assembly etc.

Now we happened to have a customer who ask for machining their parts that shall be machined per AS9100 (or defence level).

So basically we will be As a build-to-print manufacturer.

Now we have to introduce some new process (project specific), including Configuration and Change Management, FAIR and Internal Audit system with new processes.

I am thinking to make an internal audit checklist as attached focusing on key areas and internal audit plans as well. Do you think this should be sufficient? or should I actually ask our customer to see if they are satisfied with this plan?

Document and Data Control

Are all customer authority datasets registered and controlled?

Are current revisions of documents available at the point of use?

Are obsolete documents removed or clearly marked?

Is SharePoint/local server access restricted and logged?

Are hard copy prints tracked/marked and they are all logged?

Is the logged data up to date? e.g., the location of hard copy in floor shop

Are job-related records archived upon job completion in accordance with retention policy

Can completed jobs be traced to their full quality documentation (e.g., material certs, inspection results, change approvals)

Are documents sensitive labelled and correct file naming is completed?

Is master register logged up to date?

Are all computers/USB and other eletric devices registered for defence project?

Are all hardware or hard copies securely stored?

Is soft copy (e.g., CNC/CMM files) stored securely? e.g., no file should be available on CNC machine or CMM computer.

Change Management Implementation

Is there a formal change request process in place for CNC/CAM/CMM files and process documents?

Are all changes reviewed, approved, and documented before implementation?

Are customers notified and approvals obtained for changes requiring external validation?

Are post-change implementation checks conducted?

For applicable changes, has a First Article Inspection (FAI) been conducted or planned?

Configuration Item Traceability

Are configuration IDs assigned to all relevant work orders or parts?

Can the current part/configuration be traced back to the authority dataset and change history?

Are revision changes reflected in work orders and job travellers?

Derivative Data Register Accuracy

Are CNC, CAM, and CMM files correctly registered and linked to the authority dataset?

Do registers include file name, version, approval status, and linkage to jobs or WOs?

Are backup and access logs maintained?

Nonconformance and Corrective Action

Are all non-conformances formally documented with NCR numbers and traceable to affected parts/processes?

Are NCRs linked to the correct configuration or job traveller?

Is containment action taken immediately for defence-related issues?

Is root cause analysis (e.g., 5 Whys, fishbone) conducted for recurring or critical NCRs?

Are corrective actions documented, approved, and assigned with due dates?

Is effectiveness of corrective action verified and recorded?

Are CAPA records reviewed during internal audits or management review?

Are trends or repeated issues identified and addressed proactively?

Supplier Handling of Controlled Data

Are external suppliers (e.g., heat treaters, coating vendors) provided with the correct drawing revision and specifications?

Is the data sent to suppliers tracked and logged?

Are certificates (COC, heat treat, etc.) linked to the correct job and retained in quality records?

Awareness and Training Records

Have relevant personnel been trained on configuration management, change control, and data handling?

Is training recorded and reflected in the skills matrix?

Are staff aware of where to find controlled documents and how to request changes?

Internal Audit

Are audit results documented and reported to management?

Are internal audits scheduled and conducted according to plan?

Audit Area	Detailed Topics	Frequency
Document Control	Master register, obsolete document handling	Annual
Change Management	CRs for CNC/CAM, customer approvals, FAI updates	Every 6 months
Configuration Traceability	CI ID in WO, revision match, dataset linkage	Annual
Derivative File Accuracy	CNC/CMM/CAM register completeness, backups	Every 6 months
Supplier Data Control	Drawing version sent, CoC traceability	Annual
Nonconformance Management	NCR logging, root cause, CAPA traceability	Every 6 months
Training and Awareness	Skills matrix, training record audit, CM awareness	Annual
Physical Storage & Access	Server access, USB lockout, secure print logs	Annual
Internal Audit Process	Coverage, follow-ups, independence	Annual
Customer Satisfaction	Complaint log, delivery metrics, improvement action	Annual

Have you received a schedule of work with the request? The requirements contained within the schedule should describe the specifications required of the product, by your customer. If you can demonstrate the produced product meets specification then I'd offer that is all that you'd have to do. Perhaps my understanding of the issue is off but "shall be machined per AS9100" talks to specification of the product, though it does imply that you'd have the supporting processes to capture records etc? If your customer is an AS9100 certified organisation they should give you detailed instructions as to what their requirements are and not expect you to build the standards - definitely ask; it's in their interests as they carry the risk. (They should have audited you as one of their suppliers).