How to perform an AS9100 gap analysis that finds real control gaps.

Start with the business, not the checklist.

Before testing individual controls, establish the scope, products and services, regulatory and customer context, key processes and the risks that matter. This gives the assessment a business frame rather than treating every requirement as equally significant.

For aerospace and defence organisations, the practical question is not only whether a process exists. It is whether the process is capable of protecting product conformity, delivery, traceability, safety, configuration and customer requirements.

Assess four different things: defined, implemented, evidenced and effective.

A control can be well documented but poorly deployed. It can be implemented but leave weak evidence. It can have records and still fail to achieve the intended result. Separating these four questions makes the diagnosis materially better.

• Defined — is the control deliberately established, owned and suitably designed?
• Implemented — is it deployed consistently across the intended scope?
• Evidenced — can objective evidence demonstrate what happened?
• Effective — does the control achieve the intended outcome and manage the relevant risk?

Follow evidence across process interfaces.

Do not stop at the procedure. Sample live records, interview the people doing the work and follow the evidence into connected processes. Contract review may link to design, supplier flow-down, configuration, production and release. A gap can sit at the interface even when each department has its own procedure.

Repeated exceptions, overdue actions, customer escapes or recurring supplier issues are signals to test the control more deeply.

Turn findings into proportionate action.

If the control is undefined, strengthen governance and criteria. If it is defined but not used, focus on deployment and competence. If the evidence is weak, improve traceability and verification. If the control is ineffective, investigate the failure mechanism rather than writing more paperwork.

Use the authorised standard for conformity decisions.

This guide is practical assurance guidance, not a reproduction of AS9100D. Clause references and tools can help structure the work, but conformity decisions should be made against an authorised copy of the applicable standard plus customer, statutory, regulatory and contractual requirements.