AS9100 Audit Prep: Turn Weeks of Evidence Hunting Into Hours
AS9100 audit prep often means weeks of hunting evidence across SharePoint, the QMS and email. How to keep the records so prep takes hours, not weeks.
The customer's audit notice lands 30 to 60 days out, and the quality manager starts hunting. The evidence sits in a QMS that does not search well, a SharePoint that grew on its own, an email archive that holds the actual decisions, and a quality manual 2 revisions behind the floor. At most AS9100D shops that hunt takes weeks. It can take hours when the records an auditor asks for are kept in an evidence library built to be searched. This post covers what that library holds, what audit day looks like with it, and how KoldOps builds it for AS9100, ISO 9001, and ISO 13485 shops.
For why AI pilots on quality records stall without this groundwork, see Why Manufacturing AI Projects Stall.
The audit-prep pattern at most shops
The notification arrives 30 to 60 days before the audit. The quality manager sends the customer the latest QMS manual. The customer responds with their scope: clauses they want to see evidence on, processes they want to walk, specific findings from the last audit they want closure on.
The hunt begins. Clause 7.5 evidence is in 3 folders on SharePoint. Clause 8.5 walks are documented in the QMS but the photos and CMM data live on the network drive. Clause 9.1 monitoring is in a spreadsheet that the production manager updates from memory once a quarter. Clause 10.2 corrective actions exist but the last 3 are in an email thread between the quality manager and the supplier that nobody else has access to.
By audit day, the quality manager has built a binder. It is mostly current. It is mostly correct. It is mostly defensible. The "mostly" is what causes the findings.
What the evidence library is
The evidence library is the records an auditor asks for, kept as plain text files under version control, with a named reviewer on every change, and indexed by clause, by part, by customer, and by date. It sits alongside the existing QMS (whether that is ProShop, Master Control, Greenlight Guru, or an in-house tool). The QMS remains the system of record. The library is the searchable view, one a person or an AI assistant can read.
What lives in the library:
- The quality manual, as markdown, version-controlled. Every clause has a stable anchor. Every revision diff is reviewable. The "current revision" is unambiguous.
- Documented procedures for every required process, in markdown, with revision history. Cross-linked to the clauses they satisfy.
- FAI and PPAP records indexed by part number, customer, and date. Including supporting CMM data, material certs, in-process inspection records, and customer-specific PPAP elements.
- NCR and MRR history indexed by defect mode, part, customer, supplier, and disposition. The history that lets an AI assistant answer "have we seen this NCR before."
- Corrective and preventive action records indexed by source (audit finding, customer complaint, NCR), with closure evidence and effectiveness verification.
- Internal audit reports, including the audit plan, observations, findings, and follow-up evidence.
- Customer audit history, including each customer's prior audit reports, findings, our responses, and closure verification.
- Supplier evaluation records, supplier scorecards, AVL evidence, AS9100/AS9120 cert tracking for the supply chain.
- Training records, including job descriptions, competency requirements, training matrix, completion evidence.
- Calibration records indexed by tool, with calibration interval, last cal date, traceability to NIST.
The library does not replace the QMS. It mirrors the QMS into a format an AI assistant (and any new hire, and any auditor) can read fluently. The QMS continues to drive workflow. The library makes the records findable.
Audit day with the library
The customer auditor arrives. They open with a request: "Show me the corrective action you took on the finding from last year's audit, and the evidence that the action was effective."
Without the library, the quality manager walks to the file cabinet, pulls the prior audit binder, walks to the corrective-action log, walks to the QMS to find the closure record, walks to the email archive to find the supplier verification, and assembles the answer over 30 to 45 minutes.
With the library, the quality manager asks the assistant: "Pull last year's customer-audit finding number 3 and the corrective-action record that closed it, plus the effectiveness-verification evidence." The assistant returns the prior finding text, the CAR-2025-031 record with its closure date and named approver, the on-site reverification photos with timestamps, and the supplier's revised process documentation. Total time: under a minute. The quality manager hands the auditor the response with citations to the underlying documents.
The library does not change the audit outcome (good shops still pass; poor shops still get findings). It changes the audit-prep cost, the audit-day stress, and the auditor's perception of the operation's rigor. An operation that can answer evidence requests in 60 seconds, with traceable citations, is an operation the auditor stops looking for problems in.
The clauses where the library helps most
| AS9100D clause | What the library provides |
|---|---|
| 7.1.5 Monitoring and measurement resources | Calibration records with traceability to NIST, indexed by tool, with intervals and last-cal evidence. |
| 7.1.6 Organizational knowledge | The library itself. The auditable record that the knowledge required for product conformity is documented, current, and accessible. |
| 7.2 Competence | Training records by employee, role, and competency. Job descriptions cross-linked to required training. |
| 7.5 Documented information | Every controlled document, with revision history, named author and approver, and a clear current-revision marker. |
| 8.4 Externally provided processes | Supplier evaluation records, AVL with effective dates, OSP cert chains indexed by lot. |
| 8.5.1 Control of production | Routings, work instructions, FAIs, in-process inspection records, traceable to part number and lot. |
| 8.7 Control of nonconforming output | NCR and MRR history indexed by defect mode, with disposition and effectiveness evidence. |
| 9.1 Monitoring, measurement, analysis | Quality objectives, KPI history, customer satisfaction data, supplier performance scorecards. |
| 9.2 Internal audit | Audit plans, reports, findings, and closure evidence indexed by clause and by audit cycle. |
| 10.2 Nonconformity and corrective action | CAR history with source, root cause, corrective action, closure, and effectiveness verification. |
How KoldOps builds it
KoldOps builds the library under a fixed-scope contract. The starting point is one clause cluster. Usually 8.5 + 8.7 + 10.2 (production control, nonconformance, corrective action) because that cluster has the highest audit-finding frequency and the most operational impact. The sequence:
- A close look at the QMS as it runs (weeks 1 to 3, on site). Map the QMS as it exists. Time how long auditor-style requests take today. Identify the clause cluster with the highest audit-prep cost.
- Build the library for the chosen cluster (4 to 6 weeks). Mirror the existing QMS records into plain text files. Set up the review workflow. Index by clause, part, customer, date. Set up search. Verify that auditor-style requests return the right evidence in under 60 seconds.
- Pilot the library against a real audit-prep cycle (1 audit cycle). Use the library for the next customer audit prep. Measure the change in prep time. Track findings and the library's role in answering them.
- Expand to additional clause clusters. The partner's quality team runs the same pattern on the remaining clauses, with KoldOps as advisor.
The plan for one clause cluster runs 6 to 10 weeks from contract to records in use. The goal on the covered clauses is audit prep measured in hours instead of weeks, and the pilot cycle is where you measure whether it got there.
Frequently asked
We already have a QMS (ProShop, Master Control, Greenlight Guru, etc.). Why do we need anything else?
The QMS is the system of record. It enforces workflow and stores the official records. It is generally not designed for the questions an auditor or an AI assistant actually asks. The library sits alongside the QMS, mirrors the records, and provides the search the QMS does not. Both stay. The QMS continues to drive the day-to-day; the library speeds up audit prep and gives an AI assistant something reliable to answer from.
Will an auditor accept records found this way?
Auditors accept the records the QMS produces. The library is a mirror of those records, not a replacement. The audit-day workflow shows the auditor records from the QMS, with citations the library generated. The library's role is to find the right record faster; the record itself is what gets shown.
Is this defensible for FAA and DCMA-flowed-down requirements?
Yes. The library does not change the record-keeping the FAA, DCMA, or the customer requires. It changes the speed and accuracy with which existing records are retrieved. The records themselves continue to be produced by the QMS and stored per the operation's existing retention policy.
Our customer audits include ITAR-restricted work. Can the library stay on-premise?
Yes. The library is plain text files under version control, the search software is open source, and the AI model can run on a Mac Mini cluster or a dedicated GPU box inside the ITAR-controlled environment. Nothing in it requires a cloud component. An AI that answers from your own SOPs, prints and records covers how that kind of system is put together.
How does the library handle the documentation our customers ask us to upload to their portals?
The library is where the upload starts. The portal-upload step becomes a one-line export from the library, with the correct revision, the correct customer-specific format, and the correct supporting documentation attached. The customer-specific PPAP requirements are stored in the library (one document per customer); the portal upload is generated from the library plus the customer's requirements.
What's next
If your shop is AS9100, ISO 9001, or ISO 13485 certified and the next customer audit is on the calendar, run the 5-question audit of what your system has to prove against your quality records. The answers tell you how much audit prep goes to hunting for records that should take one search.
If the answers confirm a gap, the next step is a close look at what you run today. We map the clause coverage, time how long the records take to find as things stand, and hand back a fixed scope and price for the first piece.
If the gap is specifically that you cannot find evidence fast enough during a containment, what lot traceability software has to do when a supplier calls covers that narrower problem. Or write to Kol with the date of your next audit, and we will start from what the auditor is likely to ask for.