AS9100’s requirements for configuration management (CM) are well understood by the massive aerospace primes, but can present overkill and confusion for small downstream suppliers. Fortunately, for the small machine shop, the configuration management requirements can be easily met.

Normally, there are two types of machine shops: those with design responsibility, and those which merely manufacture products per the customer’s design. This article will discuss the approaches for both.

Let us start by reviewing the CM clause within AS9100 revision C:

7.1.3 Configuration Management

The organization shall establish, implement and maintain a configuration management process that includes, as appropriate to the product

a)            configuration management planning,

b)            configuration identification,

c)            change control,

d)            configuration status accounting, and

e)            configuration audit.

NOTE See ISO 10007 for guidance.

Configuration management is defined by ISO 10007 as “coordinated activities to direct and control the interrelated functional and physical characteristics of a product [as] defined in the requirements for product design, realization, verification, operation and support.” That is quite a lot to manage, so a shorter definition might be “managing the components of a product.”

For the machine shop, such “management” generally falls into two areas of focus: document control and product identification. The document control aspect is concerned with the identification of design data (drawings, for example); the product identification aspect is concerned with ensuring the revision level of parts is verifiable when looking at physical parts. As the 7.1.3 clause indicates, this activity is limited to CM “as appropriate to the product.” Therefore CM does not need to be applied to setup tooling or equipment; doing so is optional. Also, each bullet point in clause 7.1.3 may or may not be applicable to your particular product; not all requirements are mandatory.

Configuration management is necessary when products are comprised of various levels of parts that come together to form a final, complex assembly. For the purposes of this article, we will simplify this to two levels: the master part, which is then comprised of component parts. See below.

For such assemblies, not only must the master part be identified with a part number and revision level,  each component part must also be identified by part number and revision level. The print for the highest level master part must include an indication (normally a list) of the components including – again – their revision levels.

Configuration Management Planning

The first requirement is for “configuration management planning.” In the typical machine shop, this is easily accomplished by developing a single Configuration Management Procedure. This can be included in your Quality Manual, or made as a separate document. Generally, this procedure would only be a few pages long, and define the overall methods for configuration management that you implement. It will include the two aspects I mentioned: document control and identification of configuration items. It’s best to proceed through the other requirements to understand how you might implement CM, and then you can write your procedure based on that, at the end. So we will revisit this in a moment.

Configuration Identification

The second requirement is for “configuration identification.” The goal of configuration identification is to consistently ensure that product is properly identified not only with its current part and revision status, but that we know for sure that it is comprised of the proper sub-components, each at their current part and revision status. 

In the typical machine shop, this is accomplished as follows:

  • Conceptual identification: when designing parts, these must be assigned both a part number and a revision level. This would then be captured in the associated design data (drawings, solid models, etc.) A method must exist to be able to identify which sub-components are used to form the higher-level assembly; again, this may be a “Master Data List” (MDL) of associated component parts within the master part’s design data, or it may be done through a numbering scheme which identifies the master part for which all component parts are associated. For machine shops with design responsibility, this applies; for machine shops without design responsibility, the shop must ensure it obtains the proper design data from the customer.
  • Physical identification: physical products must be identified with the part number and revision. (Both are required; one without the other fails basic CM expectations.) Such identification can be a physical marking/tagging on the part, or merely having paperwork nearby when marking or tagging is not possible (such as when a part is going through a furnace, or being plated.)
Work orders or travelers should also reference the proper configuration (part number and revision level) of the referenced part(s).
Configuration identification applies to raw materials, in some cases. This is true when a sub-component is a purchased part. In such cases, the part itself must be ordered by part number and revision, which may be defined by the manufacturer or distributor; if so, the design documentation will reference these numbers, unless a company part number is created. If the latter, a matrix of company part numbers and manufacturer part numbers must be maintained. Then, when the purchased parts are received, the part’s identification must include that part number.

Configuration Change Control

The third requirement is for “configuration change control.” This is an important requirement aimed at ensuring the known configuration identification is maintained when the part’s design is changed. The changes may occur from two directions: a change to the master part, which impacts on one or more of the sub-components; or a change to one of the sub-components, which thus changes the master part.

For machine shops that design parts, the design change process (often via an Engineering Change Order) must include updating related parts at the higher and/or lower levels. A change to a component will always necessitate a change to the highest level master part, for example, since the master part’s revision level is always reflective of a specific set of components, each of a specific revision level themselves.

For machine shops that do not design parts, but merely manufacture parts designed by their customer, the only requirement would be to maintain the configuration of the customer. This means not altering the design of the product, and ensuring the parts produced always match the design data provided. When the customer changes the design, there must be a method to ensure the changes are implemented as directed by the customer; this could be purging of the old parts, or using up the existing stock and applying the change only to new orders, etc.

Configuration Status Accounting

The next requirement is for “configuration status accounting” (CSA). This terms confuses a lot of folks, but it helps if you shuffle the words as follows: “accounting of the configuration status.” ISO 10007 defines this as including the “recording and reporting of product configuration information, the status of proposed changes and the status of the implementation of approved changes.” It merely means maintaining knowledge of the product’s configuration, even when it changes.

For large design and manufacturing houses, CSA can be complicated. Imagine an aircraft manufacturer: they must account for the configuration of all parts at all levels of the aircraft, from the very first bolt produced, through to the final aircraft itself, which may be comprised of hundreds of thousands of part numbers. A robust CSA program helps keep all this on track.

For machine shops, however, the activities associated with part identification and change control comprise CSA, and therefore no additional effort is required. However, your configuration plan document (from the first requirement, above) should clearly indicate this.

Configuration Audits

The final step is for “configuration audit” (CA). Again, for large manufacturers this can be an incredibly complex activity; imagine auditing the final aircraft to ensure that all the installed parts are at their correct revision levels.

For machine shops solely manufacturing parts to customer prints, CA does not apply at all. Remember, AS9100 says that these requirements are to be applied “where applicable to the product.” For machine shops with design responsibility, the final inspection of products should include a step that ensures the final assembly is comprised of all appropriate sub-components, and all revision levels match the approved design (prints). So final QA inspection can count as a configuration audit. Once again, this should be defined in the configuration plan document, so this is clear. But no massive, complex “configuration audits” would be required.

Configuration Management Planning (Redux)

Coming back to the Configuration Management Plan document, as we said, a procedure would suffice for small machine shops. Beyond the typical header and introductory material, the content should look like this:

  • Scope of CM activities: a description of how much CM the company is responsible for, whether the shop is design responsible or not, and the role the customer may play in any of the CM steps.
  • Unique definitions: any company specific CM-related definitions that may differ from those in the industry.
  • Configuration identification: define how the company creates part numbers, how part revisions are assigned, how design data (drawings, models, etc.) include this data, and how product (including purchased parts) are physically identified.
  • Configuration change control: define the methods for changing product design data, including how revisions are advanced, and how such changes are approved. This may be included in related design procedures, so referring to these may be sufficient.
  • Configuration status accounting: include an explanation that the activities for identification and change control (above) constitute CSA, and that work orders or travelers will monitor the configuration status throughout production.
  • Configuration audits: include an explanation that configuration audits are not required “due to the limited CM requirements applicable to the company.” Then, explain that final QA inspections will “audit” the configuration of the finished product before delivery, and that signoff of QA shall constitute a record of a successful configuration audit.

Your mileage will vary with the effectiveness of this approach. Some small machine shops may nevertheless have significant design responsibility, or may work on very complex products, so a more robust process may be required. But for the majority of small shops, this approach will be sufficient to both meet AS9100 as well as ensure good configuration control to ensure the quality of finished products.


About Christopher Paris

Christopher Paris is the founder and VP Operations of Oxebridge. He has over 30 years' experience implementing ISO 9001 and AS9100 systems, and is a vocal advocate for the development and use of standards from the point of view of actual users. He is the author of Surviving ISO 9001 and Surviving AS9100. He reviews wines for the irreverent wine blog, Winepisser.


Aerospace Exports Inc