A supplier with a valid EN 9100 certificate failed a customer source inspection last month. The certificate was current. The surveillance audit had been completed six weeks earlier with no major findings. The process was not what the certification record described.
This is not an unusual situation. I have encountered variations of it repeatedly across 26 years of supplier quality work in aerospace, automotive, and composite manufacturing. Certification audits and customer audits serve different functions — and the gap between what each one reveals is where quality escapes live.
1. What Third Party Certification Audits Actually Assess
Third party certification audits verify that a quality management system meets the requirements of the standard. They assess documentation, process descriptions, and the evidence that the system is being operated. A well-prepared organization can achieve and maintain certification with a QMS that is largely compliant on paper.
Certification auditors operate on a fixed schedule, with advance notice, against a defined scope. The scope is broad by design — it covers the entire quality management system. For a mid-size aerospace supplier, a surveillance audit may be one to two days. The auditor cannot examine every process in that time.
The IAQG launched OASIS Insights in April 2025 — described by Eric Jefferies, President of IAQG, as a tool that „will transform how organizations showcase the value of audits and identify areas for improvement.“ OASIS Insights version 3.0.0 made IAQG the first certification ecosystem globally to apply AI at scale to analyze audit findings data worldwide, according to Intact Systems. Starting April 1, 2025, certified suppliers automatically receive an OASIS Insights report following completion and publication of initial, recertification, or surveillance audits — providing anonymized benchmarking, a quantitative performance score, and an AI-generated summary of key risk areas.
This is a meaningful development. An organization now understands how its QMS performance compares to the industry as a whole and to other similar organizations. It does not change what a certification audit observes in a single two-day visit, against a broad scope, with advance notice. And it does not provide the customer-specific context that second party audits deliver.
Quality Assurance Authority noted in its February 2026 analysis: „The supplier quality compliance function within the prime contractor monitors certificate validity through databases such as OASIS. However, the OASIS database provides certificate validity information — it does not provide information about actual process capability, recent audit findings in detail, or the specific processes included in the certification scope.“
2. What Second Party Audits Reveal
Customer audits focus on whether the processes your supplier uses to produce your specific parts are stable and capable. The scope is narrower, the questions more specific, and the auditor has context that a certification body auditor cannot have: knowledge of your product requirements, your quality agreement terms, your previous nonconformances, and your upcoming program needs.
TÜV SÜD’s published guidance on audit types is explicit: „Second-party audits remain relevant even if the supplier is certified to ISO 9001, as they address specific contractual requirements beyond the general standard.“ The contractual requirements dimension is critical in aerospace. Customer-specific requirements — flow-down clauses, First Article Inspection requirements, material certification obligations, key characteristics controls — are not fully visible to a certification body auditor who does not have access to your purchase orders and quality agreements.
In my experience, second party audits on certified suppliers consistently surface findings in three areas that certification audits regularly miss:
Actual process parameters versus approved parameters. The process description in the quality plan describes what the process should be. The SPC chart, the setup sheet used by the operator yesterday, and the measurement data from the last 30 production runs describe what the process actually is. These are not always the same document. The certification auditor reviews the documented process. The customer auditor examines whether the documented process is what is actually happening.
Real traceability versus documented traceability. A quality system can have excellent traceability documentation while having a physical process that intermixes materials, skips recording steps under schedule pressure, or reconstructs records after the fact. The documentation looks correct. The physical product flow does not match it. This is the failure mode that produces the situations where a Certificate of Conformity describes a product that was not produced to the stated requirements.
Competency of personnel in quality-critical roles versus training records. Training records confirm that an operator attended a course or passed a qualification test. Asking the operator directly — „what happens if this parameter is outside the specified range?“ — reveals the actual competency state faster than any training matrix. This is exactly the kind of question that IA9100’s human factors root cause analysis requirement will eventually make a formal audit criterion — but second party audits can ask it now.
3. The Risk Management Argument
Using certification status as a substitute for second party audit activity transfers the consequences of that gap to your production line, your customer, or your safety record.
QSTRAT’s December 2025 analysis of best practices for supplier qualification in aerospace confirmed that suppliers are typically requalified every one to three years, involving updated risk assessments, quality system evaluations, on-site or remote audits, and validation of special processes. The requalification cycle creates a risk window between qualification events. Second party audits during that window are not redundant — they are the mechanism for detecting drift between qualification states.
The more useful question is not whether to conduct second party audits, but how to focus them. Risk-based audit planning — directing second party audit resources toward suppliers with elevated risk profiles, recent changes, or open corrective actions — allows organizations to maintain meaningful oversight without auditing every supplier every year.
3 Concrete Actions
1. Review your current approved supplier list and identify how many suppliers are qualified exclusively on the basis of third party certification status, without an active second party audit in the last 24 months. For any of those suppliers providing safety-critical or quality-critical parts, that is a risk exposure that needs active management — not necessarily immediate audit action on every supplier, but explicit risk register acknowledgment and a plan.
2. When planning second party audits, build your audit agenda from your quality agreement and purchase order requirements — not from the EN 9100 or AS9100 clause structure. The certification auditor covers the standard. You need to cover what your contract requires and what your product needs. These are related but not identical sets of requirements.
3. For suppliers who have received a major finding from a certification body in the last 18 months: conduct an independent second party audit before the corrective action closure date, not after. Certification body follow-up visits verify that the corrective action was documented. A second party audit verifies whether the underlying process failure has actually been addressed. The difference between those two verification methods is the difference between compliance on paper and process reality.
👉 Request a Technical Consultation → www.skqc.org
Sources
- IAQG — OASIS Insights Launch Announcement (March 31, 2025), iaqg.org
- Intact Systems — IAQG Unveils OASIS Insights: A New Era in Aerospace Audit and Certification (March 31, 2025), intact-systems.com
- Intact Systems — OASIS Insights Case Study: AI-Enabled Audit Benchmarking, intact-systems.com
- Quality Magazine — Driving Change in Aerospace Quality Management (May 2026), qualitymag.com
- Quality Assurance Authority — Third-Party Audit Compliance for Quality Systems (February 23, 2026), qualityassuranceauthority.com
- TÜV SÜD — What is the Difference Between First-, Second-, and Third-Party Audits?, tuvsud.com
- QSTRAT — Best Practices for Supplier Qualification in Aerospace (December 2025), qstrat.com
- BSI Group — Embracing Changes to IAQG Aerospace Standards, bsigroup.com
#SupplierAudit #QualityManagement #EN9100 #SecondPartyAudit #AerospaceQuality #OASISInsights #IAQG #SKQC