Our defense prime is asking for ISO 9001 or AS9100. Which one do we need?

What to do now

The answer is written down already. Find it.

Locate the quality clause on the purchase order or in the referenced supplier quality document. Primes code these precisely. Northrop Grumman's FQA-0500 uses one clause code to require a quality system conforming to ISO 9001 as documented by a third-party registrar, with the right to request the registration certificate annually, and separate codes for AS9100 and AS9120. Boeing, Lockheed Martin, Pratt and Whitney, Collins, and GE Aerospace generally require AS9100D at tier two. The code on your document is the answer, and guessing costs a full audit cycle.

Check whether you are a manufacturer or a distributor. AS9100 covers manufacturing. AS9120 covers distributors and stockists. Certifying to the wrong one means buying a harder audit than your customer asked for, or an insufficient one.

Ask about sub-tier flowdown while you are in the document. Defense supplier checklists commonly require you to flow quality requirements to your own suppliers, and to report promptly if your certification lapses. Both become your obligations the moment you accept the order.

Ask your customer whether other programs are coming. If aerospace work is the direction of the business, going to AS9100 once costs less in total than certifying to ISO 9001 now and adding AS9100 in two years.

What it costs

AS9100 costs more than ISO 9001 for the same company, and the gap is smaller than people expect on the audit side and larger on the preparation side.

Audit days are set by the same IAF headcount tables, so the registrar's time is broadly comparable. At 86 to 125 effective personnel that is seven auditor days for an initial audit, which at recent day rates of roughly $1,350 to $1,600 lands near $9,500 to $11,200 plus travel. Aerospace auditors are separately approved and the audit is scored and reported into an industry database, which adds administrative cost at the body.

Preparation is where the real difference sits. AS9100D contains ISO 9001:2015 in full and adds requirements around risk and program management, configuration management, product safety, counterfeit part prevention, first article inspection to the AS9102 format, and control of externally provided product. For a shop new to formal quality systems, configuration management and first article inspection are usually genuinely new work rather than documentation of existing practice.

Consultant-led implementation benchmarks of $15,000 to $25,000 at 150 employees are an ISO 9001 figure. Expect the aerospace additions to sit on top of that.

What good looks like

One certificate that covers what your customer asked for, from a body accredited for that standard, registered where your customer can verify it.

That last part is a real difference. AS9100 certifications are recorded in a shared industry database that primes can query directly, so your customer confirms your status without asking you. Check that your chosen registrar holds accreditation for the aerospace scheme specifically, not just for ISO 9001, because the two are separate scopes.

It also looks like a scope that matches the work. If aerospace is one line in a plant that mostly does commercial fabrication, certifying that line rather than the whole company is legitimate and cheaper. Confirm with the customer that the narrower scope covers their parts.

When to bring in outside help

When the aerospace additions are new to you. Configuration management and first article inspection have specific formats and expectations, and learning them from the standard alone takes longer than learning them from someone who has been audited on them.

When the deadline is tied to a specific program award. Aerospace programs run to dates that do not move.

When you are choosing between the two standards and the answer is not obvious from the paperwork. A short conversation with someone who reads these documents regularly resolves it faster than a month of internal debate.

You do not need help to read the clause code. Do that yourself, today, before you talk to anyone.

How ARG does it

We start by reading your customer's actual requirements documents rather than working from what the standard says in general. The clause code, the flowdown obligations, the sub-tier requirements, and any customer-specific formats are the real specification.

From there it is the same method as any readiness engagement: on site, clause by clause, evidence first, interviewing the people doing the work. Findings with clause references and a prioritized remediation plan, then fixed-scope projects against the named gaps, then a mock audit before the registrar arrives.

Noah Brown leads that work as a certified ISO 9001 lead auditor who hosts customer and third-party audits inside a working manufacturer that supplies utility-scale electrical infrastructure. Where your program requires the aerospace additions, we are explicit about what sits inside our scope and what does not, and we would rather tell you that early than discover it at Stage 2.

We prepare you for certification and we never issue it. Your registrar's independence is what makes the certificate acceptable to your prime.

FAQ

Does AS9100 include ISO 9001?

Yes, in full. AS9100D contains ISO 9001:2015 with aerospace additions, so one certificate covers both and a separate ISO 9001 certificate is normally unnecessary.

Can we start with ISO 9001 and upgrade later?

You can, and for a shop new to quality systems it spreads the work. It costs more in total than going directly to AS9100 if you already know aerospace is the destination.

Does our certificate have to be accredited?

For defense and aerospace flowdown, effectively yes. The language usually specifies third-party registration, and supplier quality teams check the accreditation. An unaccredited certificate is the most expensive way to save money here.

Do our suppliers need certification too?

That depends on your contract. Sub-tier flowdown of quality requirements is common in defense, and your purchasing process has to implement whatever your customer imposed on you.

Is AS9100 worth it if we only have one aerospace customer?

Scope the certificate to that work and the arithmetic usually holds, because audit days follow the headcount inside the scope. If that customer is a meaningful share of revenue, the certificate is the cost of keeping the work.

Sources

• Northrop Grumman FQA-0500 supplier quality flowdown, clause codes QQS5, QQS7 and QQS8.
• IAF MD5:2023 audit-time tables.
• ARG market research 2026, section 2.3 for prime requirements, United States AS9100 share and Utah aerospace cluster figures; section 7.1 for consulting benchmarks; section 7.2 for registrar arithmetic.