AS9100 Certification Journey: How ApexMetal Built an Aerospace-Grade Quality System

In early 2025, ApexMetal was a precision CNC shop with a problem: we could machine to print, but our quality documentation was holding us back from aerospace programs. Two failed customer audits and a near-miss on a DFARS compliance issue made it clear that ad-hoc procedures wouldn't scale. This is the story of how we built an AS9100-grade quality management system from scratch — and what we learned along the way.

DFARS compliance pressure, audit failures, and a quality system held together with spreadsheets

Before 2025, ApexMetal ran a lean operation. Quote, machine, ship, repeat. Our quality "system" was a combination of tribal knowledge, Excel checklists, and a shared Google Drive folder that more than one person had accidentally overwritten. That worked fine for industrial customers — but aerospace and defense buyers noticed the gaps.

Failed audit #1 — work order revision control

In Q3 2024, a Tier 1 aerospace customer sent their quality engineer to perform a source inspection. They pulled three job packets at random and checked the work orders against the traveler records. Two of the three work orders referenced drawing revisions that had been superseded. The issue wasn't that the parts were wrong — the first-off inspection had caught the discrepancy each time — but the fact that the process wasn't documented meant the customer couldn't approve us for the program. We lost the PO.

Failed audit #2 — FAI documentation

A second customer audit in Q4 2024 focused on first article inspection records. We had performed FAI on every part we shipped — we thought that was sufficient. The auditor asked for AS9102 Form 1, 2, or 3 documentation for each FAI. We had inspection reports, but not in the AS9102 format. The customer specified FAI per their quality requirements, which called for AS9102. Missing documentation was treated as missing evidence — we failed the audit on documentation completeness, even though the parts were in spec.

DFARS flow-down: the wake-up call

The final push came when a defense program we were targeting issued their purchasing quality requirements. DFARS Clause 252.246-7004 and 252.244-7000 referenced AS9100 as the expected QMS framework. The prime's supplier quality engineer asked us directly: "Do you have an AS9100 QMS, and can you show me your document control procedure?" We couldn't say yes to either question with confidence. That conversation made the path clear: AS9100 or no defense contracts.

14 months, five phases, and a lot of late afternoons reading Clause 8

Phase 1 — Gap assessment and QMS architecture (Months 1–2)

We started by hiring a part-time quality consultant with 15 years of aerospace QMS experience — someone who'd run AS9100 registrations for small machining shops and knew what registrar auditors actually looked for. Together, we ran a two-week gap assessment against AS9100D Rev D. The findings were humbling: document control had 11 nonconformances, work order authorization was undocumented, CMM calibration records were incomplete, and corrective action records were stored in email threads.

We built a QMS architecture document — essentially a map of every procedure we needed, who would write it, and in what order. Priority went to the clauses that generate the most audit findings: Clause 8.1 (operational planning and control), Clause 8.5.1 (production document control), Clause 8.7 (nonconforming material), and Clause 10.2 (corrective action).

Phase 2 — Document control procedure and work order authorization (Months 2–4)

This was the hardest phase because it changed how the shop floor worked. We implemented a formal work order revision control system: every job got a work order number, a drawing revision reference, an approved setup sheet, and a CNC program revision record. Operators could no longer run a job without the work order in hand — and the work order had to reference the current drawing rev.

For document control, we moved all controlled documents to a structured shared drive with a document register spreadsheet that tracked revision levels, approval signatures, and effective dates. Old revisions were archived in a separate folder — never deleted, just superseded. The first time a customer auditor asked to see our document control procedure and we handed them a 12-page procedure (instead of a blank stare), we knew we'd turned a corner.

Phase 3 — CMM calibration and inspection procedure (Months 4–6)

We scheduled our Hexagon CMM for a full NIST-traceable calibration with a third-party cal lab. Calibration certificates were filed by asset tag, and we set up a calibration due date log that triggered reminders 30 days before each instrument was due. In-process inspection was formalized: every job now had defined inspection points — setup verification, first-off CMM run, and in-process checks at defined intervals. Inspection records were printed and filed in the job packet, not stored in someone's personal folder.

Phase 4 — NCM process and corrective action (Months 6–9)

We built a nonconforming material (NCM) procedure from the ground up: how nonconforming parts were tagged, who could disposition them, and how the disposition was documented. We created an NCR form that required root cause analysis (using the 5 Whys method) before the NCR could be closed. Corrective actions were tracked in a CAR log and reviewed at monthly management meetings. The CAR log became the primary input for our quarterly internal audit schedule — if a process had two NCRs in a quarter, it got audited within 30 days.

Phase 5 — FAI procedure and AS9102 documentation (Months 8–12)

For first article inspection, we built an FAI procedure that specified when FAI was required, how it was performed, and what documentation was needed. We created AS9102 Form 1 (summary sheet), Form 2 (dimensional inspection data), and Form 3 (characteristics worksheet) templates. Every CNC operator who performed FAI was trained on the procedure and signed a training record. The first time we handed a prime's quality engineer an AS9102 Form 1 with the job number, part number, and CMM results — it took us three tries to get the format exactly right, but we got there.

Internal audits and Stage 1/Stage 2 (Months 12–14)

We ran three internal audits before the registrar audit — the first identified 22 nonconformances, the second identified 6, and the third identified 2. We closed every one before calling the registrar. The Stage 1 documentation review took two days. The auditor asked to see our quality manual, 14 procedures, and 8 work instruction templates. We had everything in a binder and a shared drive — and the auditor noted during the closeout that our documentation completeness was above average for a first-time registrant.

Stage 2 (registration audit) was three days on-site. They interviewed our quality manager, two operators, and the shop supervisor. They pulled 6 job packets and verified work order revision control, NCM records, and CAR closure. They audited our CMM calibration records and the FAI procedure. One minor nonconformance was issued — our supplier approval records didn't have a documented periodic review interval. We closed it within 30 days with a procedure update and evidence of the review.

Certification, measurable quality improvements, and a repeatable QMS

AS9100 registration was achieved in March 2026 — 14 months after the decision to pursue certification. The results since then have been measurable:

Quality metrics

• Defect rate: From an estimated 200–300 ppm (parts per million) in late 2024, to below 50 ppm in Q2 2026 — a reduction of roughly 85%. The NCM process catches deviations early, and the CAR system prevents recurrence.
• Customer audit pass rate: 100% on all customer source inspections and quality reviews since January 2026. The document control and FAI procedures have eliminated the findings that used to trip us up.
• NCR cycle time: Average NCR open-to-close time dropped from 18 days (2024 average) to 9 days (Q1 2026). Root cause analysis is now mandatory and operators understand the process.
• Work order errors: Zero instances of wrong drawing revision in production since October 2025. The work order authorization check at job setup catches it every time.

Business outcomes

• New program access: Since receiving AS9100 registration, ApexMetal has been added to three new approved supplier lists (ASLs) for aerospace programs, two of which were previously inaccessible due to the AS9100 gate.
• On-time delivery: 97% on-time delivery rate in Q1 2026, up from an estimated 88% in 2024. Better work order control means jobs are planned correctly and shop floor scheduling is more predictable.
• Quote-to-order conversion: RFQ response time dropped from 2–3 days to under 24 hours on standard aerospace programs. We can reference the QMS procedures in the quote instead of writing them from scratch each time.

What AS9100 registration actually changed

The most significant change wasn't the certificate — it was the culture shift. Operators who used to say "I know what the print says" started asking to see the work order. Quality discussions that used to happen in passing now happen in structured weekly reviews. When a nonconformance occurs, the first question is "what's the root cause?" not "can we just re-run it."

The QMS isn't a burden anymore — it's a competitive differentiator. Aerospace buyers see the registration certificate and spend less time doing their own source inspections. The documented procedures mean new operators can be trained against a standard, not tribal knowledge. And for defense programs requiring DFARS compliance, we can now say with confidence: yes, we have an AS9100 QMS, and here is the document control procedure.

Frequently Asked Questions