Vendor Management

The summer period in aerospace and automotive manufacturing is operationally deceptive. Production volumes often decrease. Engineering teams partially disperse. The quality workload does not decrease — and the reduced staffing levels that accompany summer schedules create specific risk windows that a structured H1 review can help anticipate and manage before they produce Q3 and Q4 problems.

A H1 quality review is not a bureaucratic exercise. It is a structured look at the data that H1 generated — supplier performance trends, open corrective action status, audit finding patterns, certification timeline implications — and a decision about what requires active management before the end of the calendar year. The organizations that conduct it consistently make better Q3 and Q4 resource allocation decisions than those that do not. This post covers five reviews that produce the most value in the shortest time.

1. Open Corrective Actions: The Backlog That Accumulates Quietly

How many corrective actions from H1 2026 are past their agreed closure date? How many were closed without documented effectiveness verification? These two numbers tell you more about the operational state of your supplier quality programme than any certification status check.

Corrective action backlog grows during periods of high production activity because the urgency that opened the SCAR fades when the immediate production pressure resolves. The supplier’s quality team moves to the next problem. The customer’s supplier quality engineer moves to the next program. The SCAR sits open until the next audit surfaces it as a finding — at which point it has often been open for six to nine months, the production context relevant to the root cause analysis has changed, and effective investigation has become significantly more difficult.

AMREPinspect’s December 2025 analysis documented the technical parallel: a process that shows Cpk 1.67 short-term but Ppk 1.11 long-term demonstrates instability over time. The same dynamic applies to corrective action programmes: an organization that closes SCARs on time but has a 30%+ recurrence rate for the same failure mode categories is demonstrating that its corrective action process is producing documentation, not sustained improvement.

A H1 review that produces a clear list of open SCARs, organized by age and by supplier risk tier, gives the supplier quality team specific targets for Q3 follow-up. The list should distinguish between SCARs that are appropriately open — effectiveness verification is pending per the agreed timeline — and SCARs that are open because they have been deprioritized. The second category is the risk. The first category is the process working correctly.

2. Supplier Performance Trends: What the H1 Data Is Telling You

Monthly supplier scorecards capture snapshots. H1 trend analysis captures direction — and direction is a leading indicator of where Q3 and Q4 production risk is building before it materializes as a line stop or customer complaint.

A supplier whose on-time delivery performance dropped from 97% in January to 91% in June is telling you something about their internal capacity and process stability that a June scorecard alone does not communicate. The trend may reflect the titanium sourcing constraints documented in the June post of this series, the rare earth export control impacts on electronic component availability, or the workforce competency challenges flagged in EASA EPAS 2026. Each of those root causes has different quality implications and different appropriate responses.

A supplier whose quality metrics are stable but whose delivery performance is declining should trigger a conversation about what is constraining their throughput. Material delays create schedule pressure that consistently correlates with quality shortcuts. Equipment availability issues managed through overtime create fatigue-related quality risk — exactly the human factors dimension that IA9100 will require in root cause analysis. Staffing reductions that place experienced personnel across multiple processes simultaneously create competency dilution in quality-critical roles.

The H1 trend analysis should identify the three suppliers with the most negative trend direction — regardless of their current absolute performance level. These are the suppliers that warrant proactive engagement in Q3 before their trend translates into production impact in Q4.

3. Audit Programme Status: Completion and Finding Pattern Analysis

Were all planned H1 audits completed? If not, assess the risk of each gap explicitly — a planned audit that did not happen for a supplier with no recent performance issues is a different risk profile than a planned audit that did not happen for a supplier with two open SCARs and declining delivery performance.

For audits that were completed, examine finding patterns across the supplier base. Findings that cluster in the same category across multiple suppliers in the same period often indicate industry-wide conditions rather than supplier-specific failures. IAQG’s OASIS Insights platform — launched April 1, 2025 — now provides AI-generated benchmarking and quantitative performance scores for certified suppliers following each audit. The IAQG’s dual-track approach to standards revision, reported by Quality Magazine in May 2026, means that finding patterns from H1 2026 may reflect emerging IA9100 transition gaps that can be addressed through targeted communication more efficiently than through five individual corrective action cycles.

4. IA9100 Transition Readiness

IA9100 is expected to publish in late 2026. For organizations currently certified to EN 9100:2018 or AS9100 Rev D, the H1 review is the right point to assess where the gap analysis stands and what the transition timeline looks like given your certification body’s planning horizon.

BSI Group confirmed in its published IA9100 guidance that the 9104 series standards — covering the audit scheme — have already completed writing and approval, are being translated into seven languages, and will be ready in late 2025 with a published transition timeline expected by end of 2026. Your certification body should have equivalent planning visibility. If they cannot articulate a transition roadmap, that is a signal worth acting on before the transition window opens.

The four substantive IA9100 additions — cybersecurity integration, human factors root cause analysis, APQP mandatory linkage, and sub-tier controls — each require process development, not just document updates. If none of these areas have been addressed in H1, the H2 plan needs to include specific milestones with accountable owners. Organizations that started IA9100 preparation in 2025 or early 2026 will have significantly smoother transitions than those starting in late 2026 — because the former will be implementing established processes during their transition audit, while the latter will be designing and implementing them simultaneously.

5. Customer Audit Findings: Where H2 Will Begin

If your organization received customer audit findings in H1, the H2 audit will begin exactly where the last one ended. Customer auditors retain notes from previous visits and will specifically revisit findings that were closed with corrective action commitments. The effectiveness of those commitments — measured through process data, not through updated procedures — will be the primary focus of the first hour of the next audit.

A H1 review that includes systematic examination of H1 customer audit findings, the corrective actions committed, and the evidence of effectiveness provides two outputs: confirmation that commitments are being met, and early identification of corrective actions that are behind schedule or lacking the measurement data that constitutes effectiveness evidence. Identifying that gap in August is significantly better than discovering it during the next audit in October or November.

3 Concrete Actions

1. Produce a H1 corrective action status report by supplier, organized by age of open SCAR and by supplier risk tier. Communicate the status to each supplier with open SCARs — specifically identifying which SCARs require closure or effectiveness verification evidence before the end of Q3. This communication creates accountability without requiring a scheduled audit, and it surfaces suppliers who have lost visibility of open corrective actions in their own systems.

2. Run a six-month trend analysis on your top 20 supplier performance metrics — quality, delivery, and responsiveness to SCAR requests. Identify the three suppliers with the most negative trend direction regardless of current absolute performance level. Schedule a proactive review call with each of those suppliers in August or September — before their trend translates into production impact. The conversation is significantly easier before a disruption than after one.

3. Schedule your IA9100 gap assessment for September or October 2026 if it has not been conducted. The gap assessment conducted against the IAQG Key Change Summary and coordination draft materials will be accurate enough to define your preparation priorities. Waiting for the final published standard means starting your gap assessment 6-9 months later than competitors who started earlier — and entering the transition audit with less implementation evidence than organizations that prepared proactively.

👉 Request a Technical Consultation → www.skqc.org

Sources

• IAQG — OASIS Insights: AI-Generated Benchmarking for 9100-Series Certified Suppliers (launched April 1, 2025), iaqg.org
• Quality Magazine — Driving Change in Aerospace Quality Management: IAQG Dual-Track Approach (May 2026), qualitymag.com
• BSI Group — Embracing Changes to IAQG Aerospace Standards: 9104 Series Translation and Transition Timeline, bsigroup.com
• IAQG — IA9100 Key Change Summary: Six Named Areas of Substantive Change, iaqg.org
• AMREPinspect — Ppk vs Cpk: Cpk 1.67 Short-Term vs Ppk 1.11 Long-Term (December 27, 2025), amrepinspect.com
• EASA — European Plan for Aviation Safety (EPAS) 2026 Addendum: Workforce Competency Priority, easa.europa.eu
• QT9 Software — IA9100 Transition: Two-Year vs Three-Year Window Analysis (October 23, 2025), qt9software.com
• Assent Risk Management — AS9100 is Becoming IA9100: Transition Planning Guidance (March 17, 2026), assentriskmanagement.co.uk

#QualityManagement #SupplierQuality #AuditManagement #CorrectiveAction #IA9100 #H1Review #QualityManager #OASIS #SKQC

The instinct when a supplier fails is to either fix them or replace them. Both responses can be wrong. What is consistently underinvested is the analysis that should precede either decision: a structured assessment of why the supplier is failing, what kind of failure it is, and what outcome is actually achievable given the constraints of the relationship, the requalification cost, and the production timeline.

I have seen organizations replace suppliers who had addressable process problems because the corrective action process was too slow and the production pressure was too high. I have seen organizations develop suppliers who had cultural and management problems that no amount of technical support would address. Both responses wasted time and money. Neither one was based on a clear-eyed assessment of the root cause and the realistic options for addressing it.

1. The Case for Supplier Development

Supplier development — investing in improving a supplier’s capability rather than replacing them — is the right strategy when four conditions are present simultaneously:

The root cause is technical, not cultural. Process capability gaps, equipment limitations, procedure deficiencies, and competency gaps in specific technical areas are developable. They require investment in training, equipment, process redesign, or procedure revision — but the organization has the capacity and the management commitment to make those investments. An organization that has a documented quality failure caused by an inadequate inspection procedure, a miscalibrated measurement system, or an undertrained operator in a specific role is a development candidate. An organization that has a documented quality failure caused by a management decision to ship parts they knew were borderline is not.

The supplier has demonstrated capability in the past. A supplier who produced conforming parts for two years before experiencing a quality failure is a different risk profile than a supplier who has never consistently produced conforming parts. The former has a baseline of demonstrated capability that development can restore. The latter requires building capability that does not yet exist — a different and more resource-intensive investment that warrants closer scrutiny before committing development resources.

The switching cost is real and quantified. QSTRAT’s December 2025 analysis of aerospace supplier qualification practices confirmed that suppliers are typically requalified every one to three years — involving updated risk assessments, quality system evaluations, on-site or remote audits, and validation of special processes. For safety-critical and quality-critical parts, requalification can take 12-18 months and require PPAP, First Article Inspection, and customer approval. That timeline creates a risk window that is sometimes worse than the quality risk you are trying to eliminate. The switching cost calculation must include: requalification duration, production risk during the transition, new supplier onboarding cost, and the probability that the new supplier performs better than the current one after development.

Management commitment to improvement is demonstrable — not stated. The distinction is between a supplier whose quality manager presents a corrective action plan in the review meeting and a supplier whose production manager has already made operational changes before the meeting. The first is a document. The second is evidence of organizational commitment. The supplier who calls you before the SCAR deadline to share preliminary corrective action results is a different risk profile than the one who submits documentation on the last day of the response window.

2. The Case for Supplier Replacement

Replacement is the right decision when the problem is structural rather than technical. The indicators are recognizable to anyone who has managed supplier quality over multiple years:

Repeated corrective actions that close on paper but do not sustain in production. A supplier who has received three SCARs for the same failure mode in two years, each with a technically correct corrective action response, is demonstrating that their QMS is decoupled from their operational reality. The corrective action process produces documents. It does not produce sustained process change. This is a management culture problem. It is not addressable through supplier development investment from the customer side — because the customer cannot change the internal management incentive structure that is producing the pattern.

Unwillingness to allow meaningful audit access. A supplier that consistently limits audit access to the quality manager’s presentation, resists requests for shop floor observation, or delays corrective action verification audits is signaling that there is something they do not want audited. That signal is reliable in my experience. A supplier that cannot be audited cannot be trusted. That is a replacement scenario regardless of current performance metrics.

Financial instability creating ongoing process pressure. A supplier operating under severe financial pressure will consistently make quality compromises — not necessarily intentionally, but structurally. Maintenance is deferred. Inspection is reduced. Personnel turnover increases as wages are cut or positions are not backfilled. These conditions produce quality failures regardless of the corrective action process in place. Supplier development investment from the customer does not address the underlying financial condition that is producing the quality risk.

3. The Decision Framework in Practice

The analysis that should precede the development versus replacement decision covers three questions:

What is the actual root cause of the failure — process, system, or culture? Process failures are developable. System failures require more significant investment but are developable with committed management. Culture failures — where the management decision-making consistently prioritizes output over quality — are not developable from the outside. The answer to this question drives everything else.

What is the realistic timeline to qualified alternative sourcing? If the answer is „12-18 months with significant requalification risk,“ that timeline needs to be factored into the decision explicitly. A development investment that closes a quality gap in 6 months may produce better outcomes than a replacement process that creates a 12-month risk window, even if replacement is the right long-term decision.

What does the supplier’s behavior during the corrective action process tell you about their management culture? The way a supplier responds to a quality failure — the speed of response, the depth of root cause analysis, the willingness to accept audit findings without pushback, the consistency between what management says in meetings and what production actually does — is more predictive of future quality performance than the content of the corrective action plan itself. This is the behavioral signal that most supplier quality programmes underweight relative to documentation quality.

3 Concrete Actions

1. Before deciding between development and replacement, conduct a structured root cause analysis at the organizational level. Map the failure explicitly to one of three categories: technical (process, equipment, procedure), systemic (QMS structure, measurement system, corrective action effectiveness), or cultural (management commitment, reporting culture, decision-making under pressure). The category determines the right response. Treating a cultural failure as a technical one produces a good corrective action document and a recurring quality problem.

2. For suppliers in active development: define measurable milestones with specific timelines and explicit exit criteria before the development investment begins. „If Ppk for characteristic X does not reach 1.33 within 90 days of process change implementation, supplier status will be escalated to replacement evaluation“ is a development plan with accountability. „We will work with the supplier to improve their process“ is an open-ended support commitment with no accountability structure. The exit criteria protect both parties.

3. For replacement decisions: initiate the alternative sourcing process before communicating the replacement decision to the current supplier. The timeline for qualifying an alternative source in aerospace is typically 12-18 months. Starting that process before communicating the replacement intent allows the transition to proceed without creating a service risk window, and it prevents the current supplier from using the threat of production disruption as leverage in the transition negotiation. Once you have identified and pre-qualified an alternative, the replacement communication becomes a controlled transition rather than an emergency response.

👉 Request a Technical Consultation → www.skqc.org

Sources

• QSTRAT — Best Practices for Supplier Qualification in Aerospace: Requalification Timelines and Scope (December 2025), qstrat.com
• IAQG — IA9100 Key Change Summary: Sub-Tier Supplier Controls, iaqg.org
• Quality Assurance Authority — Third-Party Audit Compliance for Quality Systems (February 23, 2026), qualityassuranceauthority.com
• AIAG — Production Part Approval Process (PPAP) Reference Manual, 4th Edition
• AIAG — Statistical Process Control (SPC) Reference Manual, 2nd Edition
• EN 9100:2018 — Section 8.4: Control of Externally Provided Processes, Products and Services

#SupplierDevelopment #SupplierManagement #QualityManagement #AerospaceQuality #CorrectiveAction #PPAP #SKQC

A supplier with a valid EN 9100 certificate failed a customer source inspection last month. The certificate was current. The surveillance audit had been completed six weeks earlier with no major findings. The process was not what the certification record described.

This is not an unusual situation. I have encountered variations of it repeatedly across 26 years of supplier quality work in aerospace, automotive, and composite manufacturing. Certification audits and customer audits serve different functions — and the gap between what each one reveals is where quality escapes live.

1. What Third Party Certification Audits Actually Assess

Third party certification audits verify that a quality management system meets the requirements of the standard. They assess documentation, process descriptions, and the evidence that the system is being operated. A well-prepared organization can achieve and maintain certification with a QMS that is largely compliant on paper.

Certification auditors operate on a fixed schedule, with advance notice, against a defined scope. The scope is broad by design — it covers the entire quality management system. For a mid-size aerospace supplier, a surveillance audit may be one to two days. The auditor cannot examine every process in that time.

The IAQG launched OASIS Insights in April 2025 — described by Eric Jefferies, President of IAQG, as a tool that „will transform how organizations showcase the value of audits and identify areas for improvement.“ OASIS Insights version 3.0.0 made IAQG the first certification ecosystem globally to apply AI at scale to analyze audit findings data worldwide, according to Intact Systems. Starting April 1, 2025, certified suppliers automatically receive an OASIS Insights report following completion and publication of initial, recertification, or surveillance audits — providing anonymized benchmarking, a quantitative performance score, and an AI-generated summary of key risk areas.

This is a meaningful development. An organization now understands how its QMS performance compares to the industry as a whole and to other similar organizations. It does not change what a certification audit observes in a single two-day visit, against a broad scope, with advance notice. And it does not provide the customer-specific context that second party audits deliver.

Quality Assurance Authority noted in its February 2026 analysis: „The supplier quality compliance function within the prime contractor monitors certificate validity through databases such as OASIS. However, the OASIS database provides certificate validity information — it does not provide information about actual process capability, recent audit findings in detail, or the specific processes included in the certification scope.“

2. What Second Party Audits Reveal

Customer audits focus on whether the processes your supplier uses to produce your specific parts are stable and capable. The scope is narrower, the questions more specific, and the auditor has context that a certification body auditor cannot have: knowledge of your product requirements, your quality agreement terms, your previous nonconformances, and your upcoming program needs.

TÜV SÜD’s published guidance on audit types is explicit: „Second-party audits remain relevant even if the supplier is certified to ISO 9001, as they address specific contractual requirements beyond the general standard.“ The contractual requirements dimension is critical in aerospace. Customer-specific requirements — flow-down clauses, First Article Inspection requirements, material certification obligations, key characteristics controls — are not fully visible to a certification body auditor who does not have access to your purchase orders and quality agreements.

In my experience, second party audits on certified suppliers consistently surface findings in three areas that certification audits regularly miss:

Actual process parameters versus approved parameters. The process description in the quality plan describes what the process should be. The SPC chart, the setup sheet used by the operator yesterday, and the measurement data from the last 30 production runs describe what the process actually is. These are not always the same document. The certification auditor reviews the documented process. The customer auditor examines whether the documented process is what is actually happening.

Real traceability versus documented traceability. A quality system can have excellent traceability documentation while having a physical process that intermixes materials, skips recording steps under schedule pressure, or reconstructs records after the fact. The documentation looks correct. The physical product flow does not match it. This is the failure mode that produces the situations where a Certificate of Conformity describes a product that was not produced to the stated requirements.

Competency of personnel in quality-critical roles versus training records. Training records confirm that an operator attended a course or passed a qualification test. Asking the operator directly — „what happens if this parameter is outside the specified range?“ — reveals the actual competency state faster than any training matrix. This is exactly the kind of question that IA9100’s human factors root cause analysis requirement will eventually make a formal audit criterion — but second party audits can ask it now.

3. The Risk Management Argument

Using certification status as a substitute for second party audit activity transfers the consequences of that gap to your production line, your customer, or your safety record.

QSTRAT’s December 2025 analysis of best practices for supplier qualification in aerospace confirmed that suppliers are typically requalified every one to three years, involving updated risk assessments, quality system evaluations, on-site or remote audits, and validation of special processes. The requalification cycle creates a risk window between qualification events. Second party audits during that window are not redundant — they are the mechanism for detecting drift between qualification states.

The more useful question is not whether to conduct second party audits, but how to focus them. Risk-based audit planning — directing second party audit resources toward suppliers with elevated risk profiles, recent changes, or open corrective actions — allows organizations to maintain meaningful oversight without auditing every supplier every year.

3 Concrete Actions

1. Review your current approved supplier list and identify how many suppliers are qualified exclusively on the basis of third party certification status, without an active second party audit in the last 24 months. For any of those suppliers providing safety-critical or quality-critical parts, that is a risk exposure that needs active management — not necessarily immediate audit action on every supplier, but explicit risk register acknowledgment and a plan.

2. When planning second party audits, build your audit agenda from your quality agreement and purchase order requirements — not from the EN 9100 or AS9100 clause structure. The certification auditor covers the standard. You need to cover what your contract requires and what your product needs. These are related but not identical sets of requirements.

3. For suppliers who have received a major finding from a certification body in the last 18 months: conduct an independent second party audit before the corrective action closure date, not after. Certification body follow-up visits verify that the corrective action was documented. A second party audit verifies whether the underlying process failure has actually been addressed. The difference between those two verification methods is the difference between compliance on paper and process reality.

👉 Request a Technical Consultation → www.skqc.org

Sources

• IAQG — OASIS Insights Launch Announcement (March 31, 2025), iaqg.org
• Intact Systems — IAQG Unveils OASIS Insights: A New Era in Aerospace Audit and Certification (March 31, 2025), intact-systems.com
• Intact Systems — OASIS Insights Case Study: AI-Enabled Audit Benchmarking, intact-systems.com
• Quality Magazine — Driving Change in Aerospace Quality Management (May 2026), qualitymag.com
• Quality Assurance Authority — Third-Party Audit Compliance for Quality Systems (February 23, 2026), qualityassuranceauthority.com
• TÜV SÜD — What is the Difference Between First-, Second-, and Third-Party Audits?, tuvsud.com
• QSTRAT — Best Practices for Supplier Qualification in Aerospace (December 2025), qstrat.com
• BSI Group — Embracing Changes to IAQG Aerospace Standards, bsigroup.com

#SupplierAudit #QualityManagement #EN9100 #SecondPartyAudit #AerospaceQuality #OASISInsights #IAQG #SKQC