Quality Substrates for AS9100 Shops: Turn Audit Prep from Weeks Into Hours

The quality manager at a typical AS9100D shop spends 2 to 4 weeks preparing for each customer audit. Most of that time is hunting for evidence across a QMS that does not search well, a SharePoint that grew organically, an email archive that holds the actual decisions, and a quality manual that is two revisions behind the floor. A quality substrate cuts that prep to hours. This piece is the depth treatment of the substrate pattern for AS9100, ISO 9001, and ISO 13485 shops. What lives in it. What the audit-day workflow looks like. What KoldOps does to install it.

If you have not read the parent pillar yet, start there: Why Manufacturing AI Projects Stall.

The audit-prep pattern at most shops

The notification arrives 30 to 60 days before the audit. The quality manager sends the customer the latest QMS manual. The customer responds with their scope: clauses they want to see evidence on, processes they want to walk, specific findings from the last audit they want closure on.

The hunt begins. Clause 7.5 evidence is in three folders on SharePoint. Clause 8.5 walks are documented in the QMS but the photos and CMM data live on the network drive. Clause 9.1 monitoring is in a spreadsheet that the production manager updates from memory once a quarter. Clause 10.2 corrective actions exist but the last three are in an email thread between the quality manager and the supplier that nobody else has access to.

By audit day, the quality manager has built a binder. It is mostly current. It is mostly correct. It is mostly defensible. The "mostly" is what causes the findings.

What a quality substrate is

A quality substrate is the AS9100 evidence corpus, in markdown, in git, with named-reviewer gates on every change, and indexed by clause, by part, by customer, by date. It sits alongside the existing QMS (whether that is ProShop, Master Control, Greenlight Guru, or an in-house tool). The QMS remains the system of record. The substrate is the queryable, LLM-readable view.

What lives in the substrate:

• The quality manual, as markdown, version-controlled. Every clause has a stable anchor. Every revision diff is reviewable. The "current revision" is unambiguous.
• Documented procedures for every required process, in markdown, with revision history. Cross-linked to the clauses they satisfy.
• FAI and PPAP records indexed by part number, customer, and date. Including supporting CMM data, material certs, in-process inspection records, and customer-specific PPAP elements.
• NCR and MRR history indexed by defect mode, part, customer, supplier, and disposition. The corpus that lets the AI agent answer "have we seen this NCR before."
• Corrective and preventive action records indexed by source (audit finding, customer complaint, NCR), with closure evidence and effectiveness verification.
• Internal audit reports, including the audit plan, observations, findings, and follow-up evidence.
• Customer audit history, including each customer's prior audit reports, findings, our responses, and closure verification.
• Supplier evaluation records, supplier scorecards, AVL evidence, AS9100/AS9120 cert tracking for the supply chain.
• Training records, including job descriptions, competency requirements, training matrix, completion evidence.
• Calibration records indexed by tool, with calibration interval, last cal date, traceability to NIST.

The substrate does not replace the QMS. It mirrors the QMS into a format the AI agent (and any new hire, and any auditor) can read fluently. The QMS continues to drive workflow. The substrate enables retrieval and reasoning.

The audit-day workflow with a substrate

The customer auditor arrives. They open with a request: "Show me the corrective action you took on the finding from last year's audit, and the evidence that the action was effective."

Without a substrate, the quality manager walks to the file cabinet, pulls the prior audit binder, walks to the corrective-action log, walks to the QMS to find the closure record, walks to the email archive to find the supplier verification, and assembles the answer over 30 to 45 minutes.

With a substrate, the quality manager asks the agent: "Pull last year's customer-audit finding number 3 and the corrective-action record that closed it, plus the effectiveness-verification evidence." The agent returns the prior finding text, the CAR-2025-031 record with its closure date and named approver, the on-site reverification photos with timestamps, and the supplier's revised process documentation. Total time: 45 seconds. The quality manager hands the auditor the response with citations to the underlying documents.

The substrate does not change the audit outcome (good shops still pass; poor shops still get findings). It changes the audit-prep cost, the audit-day stress, and the auditor's perception of the operation's rigor. An operation that can answer evidence requests in 60 seconds, with traceable citations, is an operation the auditor stops looking for problems in.

The clauses the substrate is most useful for

AS9100D clause	What the substrate provides
7.1.5 Monitoring and measurement resources	Calibration corpus with traceability to NIST, indexed by tool, with intervals and last-cal evidence.
7.1.6 Organizational knowledge	The substrate itself. The auditable record that the knowledge required for product conformity is documented, current, and accessible.
7.2 Competence	Training records by employee, role, and competency. Job descriptions cross-linked to required training.
7.5 Documented information	Every controlled document, with revision history, named author and approver, and a clear current-revision marker.
8.4 Externally provided processes	Supplier evaluation records, AVL with effective dates, OSP cert chains indexed by lot.
8.5.1 Control of production	Routings, work instructions, FAIs, in-process inspection records, traceable to part number and lot.
8.7 Control of nonconforming output	NCR and MRR corpus indexed by defect mode, with disposition and effectiveness evidence.
9.1 Monitoring, measurement, analysis	Quality objectives, KPI history, customer satisfaction data, supplier performance scorecards.
9.2 Internal audit	Audit plans, reports, findings, and closure evidence indexed by clause and by audit cycle.
10.2 Nonconformity and corrective action	CAR corpus with source, root cause, corrective action, closure, and effectiveness verification.

The buildout sequence

KoldOps installs quality substrates as fixed-scope engagements. The starting point is one clause cluster. Usually 8.5 + 8.7 + 10.2 (production control, nonconformance, corrective action) because that cluster has the highest audit-finding frequency and the most operational impact. The sequence:

1. Business System Review (2 weeks). Map the QMS as it exists. Score the substrate against the 5-question audit. Identify the clause cluster with the highest audit-prep cost.
2. Substrate buildout for the chosen cluster (4 to 6 weeks). Mirror the existing QMS records into markdown. Set up the review workflow. Index by clause, part, customer, date. Wire retrieval. Verify that auditor-style queries return the right evidence in under 60 seconds.
3. Pilot the substrate against a real audit-prep cycle (1 audit cycle). Use the substrate for the next customer audit prep. Measure prep time delta. Track findings and the substrate's role in defending them.
4. Expand to additional clause clusters. The customer's quality team runs the buildout pattern on remaining clauses with KoldOps as advisor.

Total time from contract to a production substrate covering one clause cluster: 6 to 10 weeks. Audit-prep time reduction on the covered clauses: typically 70 to 90 percent on the second audit cycle.

Frequently asked

We already have a QMS (ProShop, Master Control, Greenlight Guru, etc.). Why do we need a substrate?

The QMS is the system of record. It enforces workflow and stores the canonical records. It is generally not designed for the queries an auditor or an AI agent actually wants to run. The substrate sits alongside the QMS, mirrors the records, and provides the queryable retrieval surface the QMS does not. Both stay. The QMS continues to drive the day-to-day; the substrate enables audit-prep and AI-agent reasoning.

Will an auditor accept the substrate as evidence?

Auditors accept the records the QMS produces. The substrate is a mirror of those records, not a replacement. The audit-day workflow shows the auditor records from the QMS, with citations the substrate generated. The substrate's role is to find the right record faster; the record itself is what gets shown.

Is this defensible for FAA and DCMA-flowed-down requirements?

Yes. The substrate does not change the record-keeping the FAA, DCMA, or the customer requires. It changes the speed and accuracy with which existing records are retrieved. The records themselves continue to be produced by the QMS and stored per the operation's existing retention policy.

Our customer audits include ITAR-restricted work. Can the substrate be on-premise?

Yes. The substrate is markdown in git, the retrieval is open-source, the inference layer can run on a Mac Mini cluster or dedicated GPU box inside the ITAR-controlled environment. See on-premise AI for deployment options. The substrate does not require any cloud component.

How does the substrate handle the documentation our customers ask us to upload to their portals?

The substrate is the source. The portal-upload step becomes a one-line export from the substrate, with the correct revision, the correct customer-specific format, and the correct supporting documentation attached. The customer-specific PPAP requirements are stored in the substrate (one document per customer); the portal upload is generated from the substrate plus the customer's requirements.

What's next

If your shop is AS9100, ISO 9001, or ISO 13485 certified and the next customer audit is on the calendar, run the substrate audit against your quality records. The score will tell you how much audit prep is wasted on retrieval that should be one query.

If the score confirms a substrate gap, the next step is a Business System Review. Fixed scope, written report, no further commitment. We map the clause coverage, score the substrate as it stands, and hand back a prioritized buildout plan.

For the broad framing on manufacturing-specific substrate work, see Why Manufacturing AI Projects Stall. For the substrate philosophy underneath, see Decision-State, Airlocked to Code-State.