Aerospace manufacturers should prepare evidence that controlled documents are current, approved, available at the point of use, traceable to change control, and protected from unauthorized or obsolete use. The goal is not to assemble a perfect binder for the auditor. The goal is to show that the document control process works in the real operating environment, including PLM, MES, QMS, ERP, file shares, supplier portals, and any legacy systems still in use.
This preparation does not guarantee an audit outcome. Findings depend on the standard being audited, customer requirements, contractual flowdowns, site procedures, auditor sampling, and the maturity of the local process.
Core evidence to have ready
- Controlled document register: procedures, work instructions, drawings, specifications, forms, inspection plans, travelers, templates, customer documents, and externally controlled standards, with owners and current revisions identified.
- Revision and approval history: effective dates, approvers, approval sequence, reason for change, electronic signature records where used, and audit trails showing who changed what and when.
- Point-of-use control: evidence that operators, inspectors, planners, and support teams can access the correct revision where work is performed, not just in the document repository.
- Obsolete document controls: proof that superseded drawings, work instructions, forms, and printed copies are removed, blocked, watermarked, archived, or otherwise prevented from unintended use.
- Change control linkage: ECO, ECN, deviation, waiver, MRB, or CAPA records that show why a document changed and which parts, routings, inspection steps, or training requirements were affected.
- Training records: role-based training evidence tied to the applicable document revision, including completion dates, impacted personnel, and controls for people who were not trained before the effective date.
- Record retention and retrieval: production, quality, inspection, and release records that can be retrieved within the site’s stated retention rules and customer requirements.
- Supplier and customer flowdown evidence: records showing that applicable customer specifications, quality clauses, drawing changes, and supplier instructions were communicated and controlled.
- System validation and access records: where electronic systems manage controlled documents, prepare evidence of configuration control, user access, backup, audit trail behavior, and any validation or qualification records required by the site’s procedures.
Trace a few changes end to end
Before the audit, sample recent document changes and trace them from the trigger event through approval, release, training, shop-floor use, and record creation. A useful sample includes at least one engineering-driven change, one quality-driven change, and one production or maintenance instruction change.
Pay attention to revision alignment across systems. A drawing revision in PLM, routing revision in MES, inspection plan in QMS, and part or work order data in ERP may not update at the same time. If the systems are not tightly integrated, be ready to explain the approved source of truth, the reconciliation process, and any manual controls used to prevent wrong-revision work.
Do not ignore brownfield realities
Many aerospace sites run mixed document repositories, legacy MES, older ERP instances, shared drives, paper travelers, customer portals, and local work instruction systems. Auditors will usually care less about whether the architecture is modern and more about whether the controls are defined, followed, and traceable.
A full system replacement immediately before a documentation control audit is usually unrealistic and often creates more risk. Qualification burden, validation cost, downtime risk, data migration defects, integration complexity, and long equipment lifecycles make last-minute replacement a poor control strategy. It is usually safer to stabilize the current process, identify the authoritative records, close obvious gaps, and document temporary controls where the process depends on manual reconciliation.
Common failure modes to check
- Uncontrolled PDFs or screenshots used on the floor.
- Printed work instructions without revision status, expiration control, or removal rules.
- Customer specifications stored outside the controlled document process.
- Training records that show attendance but not the document revision trained against.
- Changes released in PLM but not reflected in MES routings, inspection plans, or operator instructions.
- Supplier documents or quality clauses not linked to the applicable purchase order, part, or program.
- Weak access control for export-controlled or customer-restricted technical data.
- Audit trails that exist technically but cannot be explained by process owners.
- Records that are retained but difficult to retrieve within the site’s stated procedure.
Practical pre-audit actions
- Run an internal sample audit using the same document families and production areas likely to be sampled.
- Prepare an evidence index so process owners can find records quickly without improvising.
- Confirm who will answer questions for engineering, quality, operations, IT, document control, and training.
- Verify read-only auditor access, screen-sharing rules, or controlled export procedures before the audit starts.
- Freeze nonessential document changes during the audit window if the site’s change control process allows it.
- Document known gaps, containment actions, and corrective action status rather than relying on verbal explanations.
The exact preparation depends on the audit scope. An AS9100 surveillance audit, customer audit, special process audit, defense program review, or MRO recordkeeping review may sample different evidence. The common requirement is the same: controlled documents must be identifiable, approved, current, available to the right people, linked to records, and protected from uncontrolled use.
