AS9100 does not specify a page count, template, or software for corrective action records. Instead, it requires that your records provide objective evidence that you followed your documented corrective action process and met the standard’s requirements. In practice, a compliant record must contain enough detail that a technically competent third party can reconstruct what happened, why it happened, what you changed, and how you know the issue is controlled.
Minimum elements AS9100 expects to see in a corrective action record
At a minimum, an AS9100-compliant corrective action record should clearly document:
- Problem statement: A concrete description of the nonconformity, including what failed, where, when, and how it was detected. Reference relevant part numbers, processes, documents, lots, and dates.
- Containment / immediate actions: Actions taken to protect the customer and prevent further nonconforming output (e.g., segregation, holds, rework, recalls, additional inspection).
- Evidence of evaluation of impact: How you assessed risk and impact on delivered product, safety, regulatory requirements, and customers. Include decisions on fielded product review or notification, where applicable.
- Root cause analysis: The method used (for example 5 Whys, fishbone, fault tree) and the actual reasoning path that led to the identified root cause(s). This must go beyond “operator error” or “training issue” unless those are supported by analysis.
- Identified root cause(s): Clear statement of the underlying cause(s) for the nonconformity and, where required by your procedure, contributing and systemic causes (e.g., process, design, documentation, or management system weaknesses).
- Corrective actions: Specific, actionable changes implemented to remove the root cause(s). Include what changed (process, method, tooling, software, documentation, training, supplier controls, etc.), how, and when.
- Verification / validation of corrective action effectiveness: Description of how you confirmed the action works over time (e.g., trend monitoring, capability data, audit results, sampling plans) and the criteria for success or closure.
- Responsibilities and approvals: Who performed the investigation, who approved the actions, and who approved closure, aligned with your documented authority and responsibilities.
- Dates and traceability: Dates for each major step (initiation, containment, analysis, implementation, effectiveness check, closure) and links to related records (nonconformance reports, customer complaints, concessions, deviations, change requests, risk assessments).
Without these elements, you will struggle to demonstrate conformity to AS9100 requirements on nonconformity and corrective action, and you increase the risk of repeat findings or customer escalations.
How much detail is “enough”?
The required level of detail is risk-based. AS9100 expects you to scale the depth of analysis and documentation with the potential impact on safety, regulatory requirements, and customer performance.
- Low-risk / low-impact issues (e.g., easily detected cosmetic nonconformities, internal housekeeping issues): Shorter records may be acceptable if the risk evaluation is explicit and the root cause and actions are still clearly stated.
- Moderate to high-risk issues (e.g., product performance, safety, airworthiness, critical process deviations, repeated escapes): Expect to provide detailed problem definition, thorough root cause analysis, documented consideration of systemic impacts, and more robust effectiveness verification.
- Customer-mandated or regulatory-driven CAPAs: Often require greater detail than your internal minimums, including supporting data, trend analysis, and alignment with customer-specific forms or portals.
A practical test is: could a qualified auditor or customer engineer, with only this record and linked evidence, understand what actually happened, why it happened, what changed in the system, and whether the risk of recurrence is genuinely controlled? If not, the record is probably too thin.
Common failure modes in corrective action records
Even when forms look complete, records often fail AS9100 expectations in these ways:
- Vague or incomplete problem statements: Descriptions like “part out of tolerance” without specifying which feature, by how much, under what conditions, and with what impact.
- Superficial root cause: Stopping at “operator error” or “did not follow procedure” without asking why the error was possible, frequent, or undetected (e.g., poor ergonomics, unclear work instructions, unrealistic takt times, inadequate mistake-proofing).
- Actions that do not address the root cause: Corrective actions limited to retraining, memos, or reminders, with no change in the process, controls, or system that allowed the failure.
- No real effectiveness check: Closure with only a statement such as “no further issues observed” and no defined monitoring period, metrics, or data supporting that claim.
- Missing linkage to risk and configuration controls: No update to risk assessments, FMEAs, control plans, work instructions, drawings, or software configuration where those were part of the failure path.
- Poor traceability across systems: CAPA record refers to nonconformances, deviations, or change records that are not consistently referenced in MES, ERP, PLM, or QMS systems, making end-to-end traceability difficult to demonstrate.
Coexistence with legacy QMS, MES, ERP, and PLM systems
In brownfield environments, corrective action records are often spread across multiple systems: QMS for the CAPA, MES for nonconforming product tags, ERP for returns and credits, and PLM or document control for drawing and specification changes. AS9100 does not require you to replace these systems, but it expects:
- Consistent identifiers (e.g., CAPA number, NCR number, deviation/waiver number) used across systems so an auditor can follow the chain.
- Configuration and change control so that any design, process, or software changes made as part of the corrective action are properly reviewed, approved, released, and version-controlled.
- Validated and controlled tools where your procedures claim reliance on them (for example, electronic signatures, workflow enforcement).
- Accessible evidence within downtime and IT constraints, so you can retrieve data, logs, and related records during audits and investigations.
Attempting a full system replacement just to “clean up” CAPA records often fails in aerospace-grade environments due to qualification and validation burden, integration complexity with existing traceability, and downtime risk to production. Enhancing the discipline and completeness of records within the current toolset, while gradually improving interfaces and traceability, is typically more achievable.
Practical guidelines for defining your internal level of detail
To operationalize AS9100 expectations, organizations typically:
- Define a standard CAPA template (paper or electronic) that explicitly prompts for the elements listed above and references your nonconformity and corrective action procedures.
- Use a risk-based tiering for investigations, where higher-risk issues require more data, formal tools (like fishbone diagrams or 5 Whys), and more rigorous verification plans.
- Specify minimum evidence types for each CAPA stage (e.g., photos, inspection reports, process data, meeting minutes, training records, updated work instructions).
- Define what “acceptable root cause” looks like in work instructions or training, with examples of insufficient vs sufficient analysis.
- Embed cross-functional review (quality, engineering, operations, sometimes supply chain and IT) for medium- and high-risk CAPAs to make sure systemic issues are captured.
- Periodically audit closed CAPAs to check whether the documented level of detail matches internal expectations and AS9100 requirements.
The goal is not maximum text, but sufficient clarity, traceability, and objective evidence to withstand internal, customer, and certification body scrutiny.
Key takeaway
An AS9100-compliant corrective action record must be as detailed as necessary to:
- Show a clear, factual description of the nonconformity and its impact.
- Demonstrate a logical, documented root cause analysis.
- Link specific corrective actions to the identified causes.
- Provide evidence that those actions are implemented, controlled, and effective over time.
- Maintain traceability across the existing QMS, MES, ERP, and PLM ecosystem.
Where your current records do not achieve this level of clarity and traceability, increasing the detail and structure of the records is necessary to align with AS9100 expectations, even if the standard does not dictate an exact format.
