AS9100 and IA9100 Aerospace Compliance | Audit Readiness

Christian (00:00)
AS-9100 becoming IA 9100 is not just a naming update anymore. The name change got everyone's attention, but the real story is bigger than the letters on the certificate.

The final draft is moving through ballot. IA 9100 is expected to follow that foundation, and aerospace companies are trying to figure out whether they are facing one transition, two transitions, or just a whole lot of noise. Today we have Mike Varney back on the QT9 QCast to help us separate what is known, what is still speculative, and what companies should start to do now. This is not a panic episode, it is a preparation episode.

Welcome to the QT9 QCast. I'm Christian Reyes, your host. Let's get into it.

Christian (00:39)
So in our first episode, one of the clearest points that that you made was that product safety in AS9100 does not mean worker safety necessarily. Of course, worker safety matters, ⁓ but product safety in this context is about the safe operation of the completed product. so what I wanted to dig into today is is the newer detail. You know, your summary says IA 9100 is expected to strengthen the product safety framework with hazard identification, safety risk analysis and control.

⁓ managing change impacts on safety, safety training and awareness, communication of safety critical information, reporting safety events, you know, even anonymous employee reporting for for safety hazards. What what, if anything, has become clearer around product safety since our initial discussion?

Mike Varney (01:25)
So but product safety, and I know we talked a little bit about this before. ⁓ you know, this threw a lot of people for a loop in in Rev D, you know, 'cause product safety, of course, we want our employees to be safe. Of course, we don't want, you know, workplace accidents. Product safety does not care at all about those topics. that is a separate requirement. I'm not saying it's not important, but that's not what this is about, right? This is about the safe use of the product in the field.

Christian (01:49)
Mm-hmm.

Mike Varney (01:51)
that the product was built to meet the requirements, ⁓ that the product can be safely used by whoever is the the call end user and operator, you know, of of whatever that product is. So, you know, some of the things have become a little more clear. you know, a lot of companies may ask, well, I have no design authority. so what impact do I have on product safety? I didn't design it. I'm just building it to print.

And you know, that's the case for a a lot of the a lot of the organizations out there. The vast majority of AS9100 companies take exclusion to clause 8.3 design and development. So most companies are in that boat. So when we talk about product safety, it's about building to the print. It's about if there's any any confusion about the requirements from the customer, it's getting that clarification and retaining evidence of that communication trail. if there is something that happens to the product during its production,

For example, you know, you're using a forklift to move it, it slips off the pallet, hits the floor. Looks okay, but we're not really sure because we don't know the end use. That would be a situation where we want to document that event, communicate that with the customer, say, hey, we had an incident, it still meets the spec. What do you want us to do? ⁓ we don't have design authority. We may not even know what the product is used for in the end. so we need to make sure that that we're doing our due diligence to do everything that we can to think about that person on the tail end, right?

Think about that person who's installing that part in an aircraft, the person that's using that part in a defense environment. however that product may or may not be used. And again, if we don't know the answer to to the end use of the product, assume that everything that we do to it, you know, that goes against our our best practices or goes against the prints of the requirement is a risk to its safety and clarification should be gained.

Christian (03:05)
Mm-hmm.

Now w does every company need a standalone product safety risk register? or or can this information live inside existing risk or non conformance or cappa or change control processes?

Mike Varney (03:41)
So I I don't think most companies will need an actual, you know, log to keep track of this stuff, right? I I I think if you have a good system in place, if you have a strong QMS, the QMS already has the tools in place to be able to address this. You know, we talk about things like, you know, ⁓ risk controls, reviewing customer requirements, customer communication, ⁓ identification of potential nonconforming events.

⁓ you know, your methodology or your your tools in place to to escalate events. those things should be able to handle product safety. I think if we're talking about organizations that have design authority, that's going to look a little bit different. I'm focusing primarily on build to print with my examples here, but if you have design authority, I expect that'll be a little bit more robust because you you will know more about the design of the product, the use of the product.

what is acceptable and what isn't, right? So maybe instead of having that customer communication to say, hey, we had a potential event, you that communication may be with your engineering department, you know, rather than communicate community with the customer. You may say, hey, to our engineers, we had an incident, you guys designed the product. Do you know if this has potential impact? And you can rely on both internal and external tools for those answers.

Christian (04:55)
That's that's a good good response. and so ⁓ ultimately a company may already have risk management and change control, training, nonconformances, kappa. Like you said, these tools already exist, companies already utilize them. the improvement is more making sure product safety is is visible, visibly considered within those processes, not not creating like a giant new red tape and bureaucracy to to stumble through.

And so what something that we teased on in the last part was ⁓ counterfeit parts and and sub tier controls. so I ⁓ how would you turn those requirements for for counterfeit parts and and sub tier supplier requirements into practical supplier quality guidance? this is definitely the the deepest segment and the the menu is is long on purpose.

But I guess to kind of s set it up for you, ⁓ clause eight is where your summary says most audit depth may increase, again with product safety, counterfeit prevention, sub tier control, and disciplined planning. but for counterfeit parts, the expected emphasis includes counterfeit awareness training, obsolescence monitoring, authorized sourcing, traceability to original source, counterfeit detection, external alert monitoring.

and and segregation and reporting of suspect parts. Where should companies start if they have a basic counterfeit prevention procedure but not much evidence behind it?

Mike Varney (06:17)
That is a great question. most companies, you know, ⁓ the the counterfeit part requirement right now is in clause eight one four. a lot of companies will delegate that responsibility to procurement materials purchasing, whatever you call that department and your organization, which historically handles clause eight point four. ⁓ so usually when we're looking at pairs for purchasing, it's very common that we will see the the clauses

evaluated on that pair would be 814 and 84. They often get tied together even though they're technically in different sections of the standard. I would expect now that we are going to need to see more than just we have an approved supplier list, right? That's always the the default. Well we only buy from approved sources. It's like, well, that is great. However, one follow-up question that I I like to ask my clients in an audit environment is

Christian (06:58)
Mm-hmm.

Mike Varney (07:07)
Okay, we have an approved supplier list. you know, that's that's great, but some of your approved suppliers are distributors. Okay. Distributors have a completely separate risk inherently, because they are sourcing from all sorts of different places, and who you get your material from this week might be different than who you get your material from next week, even though they're coming from the same distributor. You see that on your mill cert, right? Your mill cert may say this mill this week.

in a different mill next week. So so more than just saying, you know, we're only buying from our approved sources, I expect that what we're going to need to prove now going forward is that once we receive product in, that we're actually evaluating the documentation that comes with that product. Right? We we we receive a mill cert, you know, if we're buying from a distributor, we get a mill cert from the actual mill that made the material and sold to the distributor. We need to be evaluating those certs as well with a level of scrutiny that's probably a little bit higher than we have been in the past.

You know, there's there's some things that are higher risk than others. Raw material, hardware, and electronics are the three most likely areas that we see non-conforming or ⁓ counterfeit events generally, historically. so we're gonna want to make sure that that when we're buying these products, that the documentation is actually reviewed. We may we may expect to see some requirements for third party testing on product. maybe not as a blanket requirement, but that may become kind of common practice with raw material.

You know, there's some great tools out there now. You know, we have XRF machines now, which which were very new to market ten years ago, that are able to do ⁓ chemical analysis on properties and material ⁓ live on the spot. Those are great tools that a lot of people are starting to to integrate. but ultimately, you know, those tools need to go a step further than just its purchasing's responsibility.

Christian (08:47)
Absolutely. Absolutely. It's a d it's a little bit different from just di buying from an approved suppliers list and and actually, you know, proving that that counterfeit risk is controlled. ⁓ what does sub tier control mean in in plain language?

Mike Varney (08:58)
Exactly.

So sub tier control it generally refers to you know, any any a vendor that you're relying on as critical in your production of a part. So for example, if you are making product ⁓ you know, and one of the one of the requirements from your customer is that it's a heat treated part. You machine the product, you may machine it final, and then that product goes out to get heat treated. you know, that is a

sub process, right? You sent that out to somebody else. We have great control. We have an awesome QMS. We know that everything is rock solid here in our facility. Where that falls apart is when it leaves our facility, right? Do I know that ABC heat treating is is following you know a quality management system, following the same practices, the same quality culture and ethical behavior that we are up to our standards? And the answer isn't always yes. It's often we don't know.

⁓ you know, and and that's the reality of it. This becomes even higher risk when we start talking about things like subcontract manufacturing. You know, there's a lot of companies out there, we see it now, where hey, when they when they hit their capacity, you know, of their internal capabilities, they start subbing jobs out as a business decision, right? And that's not a bad business decision, but there's an inherent risk there. Because if you just call a machine shop down the street and say, Hey, I'm at capacity, can you run a couple jobs for me? And they run a couple jobs for you, you send them back.

Christian (10:08)
Mm-hmm.

Mike Varney (10:21)
you know to they come back to your facility, you do your final inspection C of C and ship the product out. Other than your C of C and your final inspection at the end, we don't really know a whole lot what happened to that product upstream. you know, in in not just as it pertains to counterfeit parts, but also as it pertains to things like ethical behavior, product safety, right? Did someone there drop the product? If they dropped the product, did they follow, you know, the same things that we would have followed.

Christian (10:33)
Mm-hmm.

Mike Varney (10:47)
to verify that that's still potentially a safe product to use in the field. And often the answer is we're not sure.

Christian (10:52)
How can smaller companies avoid turning this into an impossible supplier policing project?

Mike Varney (10:58)
That is a great question. ⁓ and this comes up all the time. there's a few ways you can do it. You know, there's some are are more manageable than others. you know, there's a lot of companies now that are are starting to blanket flow down the requirements for ⁓ ISO nine thousand one or AS ninety one hundred compliance and of special processing than requiring NADCAP. that's pretty good.

If we're doing that, we know that a C B has vouched for the organization, saying that they are meeting at least the minimum requirements of the standard that they're certified to. Of course, there are companies out there that cherry pick data and make themselves present well in an audit environment. And as soon as the auditor leaves, everything falls apart. Those companies exist. Of course they do. There's not a whole lot that we can do about that, unfortunately. There are some companies that are also still doing on-site audits.

of their suppliers, especially their higher risk suppliers. That went away for a while. And we're starting to actually see a resurgence of that, which is kind of interesting. You know, during during COVID era, a lot of companies said, you know, we're not doing that anymore. There's high risk to it. It's gotten very expensive with the COVID thing going on. It was very challenging to do it. Since that, that period of time, you know, since call it 23, 24, we've started to see those ramp back up, which is kind of interesting because when you have that face-to-face interaction, that accountability increases.

⁓ and you're able to see things that, you know, because you're there not as an auditor, you're there as a customer or a supplier, right? Depending on where you are in your supply chain here. you may you may see things with a different light than the auditor that came in that issued the certificate may have seen it. so there's some value there too. Again, I'm not saying that that should be a default answer to everybody. if you have two hundred suppliers and they're all over the world, I'm not telling you to bankrupt your company by getting on a plane and going out and visiting everybody.

Christian (12:38)
Yeah.

Mike Varney (12:40)
But I think having regular communication, you know, for the higher critic critical ⁓ suppliers, higher risk suppliers to require a quality management standard that or a quality management system that is certified to nine thousand one, ninety one hundred, thirteen forty five, NADCAP, whatever it might be, whatever's applicable, is a great way to start. it's impossible to be a hundred percent rock solid unless we live at that organization.

Christian (13:03)
Mm-hmm.

Mike Varney (13:03)
However,

there's a lot of tools we can put in place to minimize that risk, right? We come back to that risk mitigation discussion.

Christian (13:09)
Absolutely. Absolutely. Kind of a the way I I I'm I'm kind of summarizing is the message is not necessarily that every aerospace supplier now needs to audit every supplier's supplier. It's more the the message is that companies need a risk based way to decide how much control is appropriate. You know, how the requirements are flowed down, what's critical, ⁓ and

Mike Varney (13:26)
That's a h that's a hundred percent it.

And and that that

is subjective to some extent and that's okay. But what what I expect that we're we're gonna have that we're gonna see our auditors asking is is, you know, have we evaluated the criticality of some of these suppliers and what are the high risk suppliers required to do per your requirements? Right? What are you flowing to them? If this is a high risk supplier because they're single source,

They're ⁓ you know, they're a foreign supplier, they're a distributor that sources from lots of different places. For those higher critical, higher level of criticality, what are we doing to mitigate that risk? and I expect that that we're gonna wanna see some sort of a risk evaluation done on those vendors and in some some tools in place.

Christian (14:14)
Absolutely. Absolutely. now your newer summary says clause nine is not expected to structurally change, but data credibility is going to matter more. it specifically mentions that MSA is referenced alongside clauses seven and eight, and that auditors may scrutinize data quality, key performance indicator quality, product safety metrics, operational effectiveness, and of course supplier performance. and this connects to something we discussed in episode one.

Mike Varney (14:36)
Mm.

Christian (14:39)
MSA, APQP control plans, and the idea that FAI alone does not prove process capability. what does data credibility mean in an aerospace

Mike Varney (14:50)
So I I think there's two components to this, ⁓ and they're both interrelated. So, you know, if we're talking clause nine, you know, we're primarily talking about our performance evaluation, right? A review of our our how we performed against our quality objectives, how we performed performed in an internal audit, how our management review reviewed that data. you know, some of the things that I think we're likely to see change and and we've already seen a little bit of this, which is interesting. I think now it's just becoming more of a formal requirement.

Historically companies would say, you know, what are you, or auditors would say, what are you doing to ⁓ or how are you tracking your your ⁓ customer satisfaction? And employee and then you know the client will say, Well, we're tracking it based on customer complaints, on-time delivery, this, that, and the other thing. And they say, Okay, great. What's your goal? What's your numeric value? And they say our goal is 90%, we're scoring 95%. Auditor says, Looks great, and we move on. I think now what we're gonna see a lot more of is

Show me how we got there. Let's look at those trends over time. Are if you're if you're evaluating four different metrics to come up with your cut customer satisfaction data, how are you weighing those metrics? Are those 25% each? if they're 25% each, is that based on what your customer thinks is important? Right? So I bring this up a lot ⁓ with clients of mine.

Christian (16:01)
Mm-hmm.

Mike Varney (16:06)
You know, customer complaints is one of the requirements, customer supplier corrective action requests is one of the requirements in the in the Rev D standard. And then also on time delivery product conformance. If you were to ask your customer, your customer doesn't care so much about customer complaints. Your customer cares about on-time delivery, product quality, right? So it would be normal to see those things weighted maybe a little heavier than some of the other things, because it's based on the perception to which the customer feels that their needs have been satisfied. Right.

Christian (16:22)
Yep.

Mike Varney (16:33)
That's that's roughly how it's worded in the standard, not 25% this, 25% this, 25% this. It's based on what your customer's interpretation is. And if that's what's important to your customer, then we should be weighing it accordingly. And I expect to see auditors wanting to see some that justification. If we're doing weighted averages or or weighted ⁓ weighted factors, how are we choosing how those get weighted? And is that really reflective of what what's important to the customer or just to satisfy the needs of your QMS? And those are two very different things.

Christian (16:33)
Yep.

Mike Varney (17:01)
⁓ now d the the other side of that, ⁓ you know, th I I I use customer science fashion as an example. I I expect that we're gonna wanna see that front. Things like on time delivery, things like product quality. We're gonna have to justify ⁓ our our metrics versus just saying our goal was ninety, we got ninety-five. I I would expect to see some deeper dive questions coming in in in the standard with some minor tweaks in clause nine. Now moving moving back to the APQP, which is interesting, right? The first article inspection, the ⁓

production process validation events. ⁓ this is something that that we we alluded to in part one. this is going to become very important and I think there's going to be a lot of confusion here. and if you want, we can dive a little bit into this. If you think this is a good point to do that, I'd be happy to. ⁓ Okay, great. So the there's an inherent problem with the first article inspection. And this is this is my auditor consultant rant. I apologize.

Christian (17:44)
Yeah. Absolutely. I think this is perfect. Yeah.

Mike Varney (17:55)
First article inspection is ⁓ it's a great tool, right? ⁓ you know, as as the standard requires, we have to do take a a ⁓ I forget exactly how it's worded, but it's a it's like a first piece, first representative piece of a production run or something like that to use to prove that the process is capable. And you know, this can be referred to as a first article inspection, which everybody in the industry, I imagine, at this point in time is familiar with a ninety one two. and ninety one twos are great.

Christian (17:55)
Ha ha ha.

Mm-hmm.

Mike Varney (18:20)
⁓ the follow up question for ninety one twos is if you were to review a ninety one two first article inspection and you asked your quality manager that you might be talking to, was this done using a traditional work traveler that you would see in production? Often the answer is no. This was done as a prototype, you know, in a controlled environment. Okay. Was this done by an operator that is traditionally going to run this in a production environment? No, it was done by the engineering team.

Christian (18:43)
Mm-hmm.

Mike Varney (18:45)
Was this inspected using traditional methods? No, we didn't have the gauging on site, so we used the CMM for everything. So in all of a sudden, the concept of a first article inspection falls apart as a production process validation because you're not actually validating a production process. You validated an isolated event that was overseen by engineering. Does that make sense? So this is an inherent problem with first article inspections. I'm not saying don't do your first article inspections, do your first article inspections.

Christian (19:05)
Yeah. Yeah, absolutely. I think that's a

Mike Varney (19:13)
However, there's other components that often get missed when all we're doing is a first article inspection. Then you you hear things like APQP and PPAP and MSA and and all these all these buzzword acronyms. ⁓ and ultimately acronyms aside, buzzwords aside, you know, I I think what we need to do is we need to focus on proving the process versus proving that we made one good part one time.

So there's I think there's a a really approachable step to do this because APQP scares people. ⁓ you know, that's a that's an that's an old ⁓ automotive born you know validation event that is very cumbersome. It it's kind of newer to aerospace. there's there's some tools out there, but they're daunting tools. ⁓ but there are ways to do this that's that are tangible. So I kind of put together a a list here of six steps that I think that you could use to do a validation event.

Christian (19:39)
Mm-hmm.

Yeah.

Mike Varney (20:06)
and I'll go through these real quick. And I think these are these are really manageable for for smaller organizations to be able to do this in in in bite sized pieces, if you will. So, you know, the first thing we need to do is identify what's important. Do we have critical characteristics? You know, do we have features on there that are more important than others? Those gotta be identified on the front. You know, your second step would be validating under real production conditions. I mentioned this before. Don't be making product in a lab.

Christian (20:14)
Absolutely.

Mike Varney (20:32)
with engineering overseeing it because that's not a real production event, right? Actually set the product up. I mean you can do that. And I'm not telling you not to do that. You know, prototype it out, absolutely. But also make sure that we're running a representative item from a true production run. Set if it's running on machine five, set it up on machine five. If Joe the operator is the one who's going to run it, have Joe run the product, right? Make it a real life event. You know, your third step is is verifying your your measurement method.

Christian (20:36)
Mm-hmm.

Mm-hmm.

Mike Varney (20:58)
I mentioned before, you know, maybe we didn't have the tooling in house to to measure it traditionally. We used, you know, a CMM or another method that we're not going to use in a regular production environment. Make sure our tooling is capable of of measuring what we needed to. Do a basic gauge R and R. I know I said this during our last episode last year. You know, do a very basic gauge R and R. You know, take a couple a couple measurements by a couple of different people, a couple different features, and start tracking these things. There's very simple tools online that that ⁓ make that manageable.

⁓ you know, your fourth step should be running multiple parts, not just one. Don't just check the first part. I mean, obviously check the first part, but maybe check the fifth part, maybe check the tenth part, right? Let's see how it's trending over time. You know, we talk about things like tool like tooling where, you know, run out on equipment, also general operator fatigue. If you have a guy who's running this job for ten hours a day, what does his first hour look like versus what does his last hour look like? ⁓ you know, we need to gather some some data there.

Christian (21:39)
Yeah, yeah.

Mike Varney (21:53)
So we can see how it trends. And if it's trending flat, that's great. But we need to be able to prove that. Our fifth step here would be monitoring your critical characteristics. You know, this is super important. You know, if critical characteristics are are defined by your customer, make sure that we are we have extremely good data on those critical characteristics that were identified on the front end. And then our last one is to establish our ongoing controls. Once we have all that data.

Christian (21:57)
Yeah.

Mike Varney (22:16)
What controls are we going to put in place to make sure that we keep those trends flat? Right. That's the goal is to have the trends be zero. ⁓ and once we get to that point through our validation event, what are we putting in place to keep those flat long term? And I think those are manageable steps to actually build a program with some defensible evidence that is stronger than a first article inspection. A first article is a component of it, but there's more than just a first article. Does that make sense?

Christian (22:41)
Absolutely. No, absolutely. ⁓ I think that that that was a great breakdown. the the the six steps you just ran us through and I mean ultimately the the best preparation is probably strengthening controls that that you probably needed anyways. You know, the all the stuff that you're talking about, it's in theory is what, you know, a continuous improvement should always be working towards and ⁓ you know, but the the the practical side of things doesn't always

Mike Varney (23:01)
Absolutely.

Christian (23:05)
play out how it does in theory. I mean, almost like what what you were saying in terms of you know, doing your first article inspection off of you know, a prototype or something that was, you know, done by the engineering team not actually taking into account the actual production conditions. ⁓

Mike Varney (23:20)
Absolutely.

Christian (23:21)
So no, I think that that that was a great breakdown. and so to kind of close us out here,

if if you could leave aerospace companies with one sentence right now, what would that be?

Mike Varney (23:30)
So I I was thinking about this. you know, in in i I i i admittedly it's gonna be two sentences, I apologize. you know, most importantly, in in this is critical as we go into a transition to a new standard, but also this applies to anybody that's currently certified. you know, your system is only as good as you use it, right?

Christian (23:38)
That's it, that's fine.

Mike Varney (23:53)
You can have the best system in the world. You can show the best procedures to an auditor. that doesn't make the system good in practice. Right. So the use is everything. My second sentence there is that just because it's documented doesn't mean it's implemented. And just because it's implemented doesn't mean it's effective. Right? Those things don't always necessarily inherently mean the next. so make sure that.

Christian (24:01)
Mm-hmm.

Mike Varney (24:17)
that what we have in place is true. if we're doing it, you know, it's effective. And if it is effective, that we have evidence to support that.

Christian (24:24)
think that the the two sentences we we we can waive that the requirement because that we needed the we needed two sentences there no no it was it was called for and Mike thank you thank you so much for for coming back on the show we love having you on here ⁓ probably won't be the last time so but it's ⁓ we I think it was a very helpful conversation today obviously for

Mike Varney (24:29)
Not gonna write me up for it. Yeah.

Course. Happy to be back.

Christian (24:49)
anyone that's that is aerospace you know certified or is or is looking at that, this is a between now and and you know beginning to early next year is is a the beginning of a big transition period for the industry. So I think this information is is extremely helpful. you know the the more that we can get out there the it the the better off everyone will be. so I I really appreciate you taking the time to to to answer my questions as well as you did.

Mike Varney (25:13)
Absolutely. Thanks again. I I appreciate the opportunity. And, you know, I I always encourage people, you know, to to ⁓ you know, ask the questions, you know, talk to talk to the professionals out there, talk to your peers, talk to your supply chain, talk to your customers. you know, everybody's going through a version of this. you know, and and it's important to to kind of collaborate with everybody because that's what's going to give us the best results.

Christian (25:29)
Mm-hmm.

Absolutely. Absolutely. And for any of our listeners that that do have additional questions ⁓ that that Mike would would be a good resource for, check the show notes. We'll have Mike's information ⁓ as well as his company's information in the show notes so you can reach out and and speak to Mike if if you are looking to. And that's all we've got today. So thank you again, Mike, and until next time, stay compliant.