Contract Review and AS9100: Are We Doing It? Can We Do It? Do We Want To Do It? - A Risk-Based Approach | My ISO Consultants
Updated: Sep 17
AS9100 contract review is more than checking whether a customer order is complete. Before an aerospace organization commits to supply products or services, it should determine and review the applicable customer, statutory and regulatory, organizational, and special requirements; confirm that it has the capability and resources to meet them; and address significant differences or risks before acceptance.
A practical way to strengthen that review is to ask three questions: Are we doing it? Can we do it? Do we want to do it? Together, these questions help an organization evaluate current commitments, technical and operational capability, and the business risks associated with accepting new work.
2026 Standards Note
AS9100 Rev D / 9100:2016 remains the current published 9100-series quality management standard used for aerospace certification. IAQG is developing the next IA9100 revision, but organizations should continue working to the current published requirements until the new standard and formal transition guidance are released.
Contract Review in AS9100: Why It Matters
AS9100 addresses the review of requirements for products and services primarily in Clause 8.2.3, while Clause 8.2.2 addresses determining the requirements that must be considered. A strong review helps ensure that the organization understands what it is committing to and can actually meet that commitment before accepting the work. Organizations that need help evaluating these controls can use AS9100 consulting services to review gaps in their current quality management system and contract-review process.
A strong contract review should consider whether:
Customer requirements and applicable statutory or regulatory requirements are understood.
The organization has the capability, capacity, resources, and expertise needed to meet the requirements.
Differences between quoted, ordered, or contracted requirements have been resolved.
Special requirements and operational risks have been identified and evaluated.
Applicable functions such as quality, engineering, operations, purchasing, finance, or legal are involved when needed.
The results of the review and any new or changed requirements are appropriately documented.
This type of review helps reduce preventable misunderstandings, capacity problems, compliance issues, and downstream nonconformities.
Risk Assessment in Contract Review: The Three Key Questions
1. Are We Doing It?
Start by looking at what the organization is already committed to. Similar current work can reveal whether resources are already stretched, whether the same risks have appeared before, and whether lessons learned from earlier projects should affect the new decision.
Existing contracts with similar or overlapping scopes.
Current workload and resource commitments.
Lessons learned from comparable products, services, or programs.
This check helps prevent overcommitment and gives the review team a practical reference point for evaluating the new work.
2. Can We Do It?
Next, determine whether the organization has the technical and operational ability to meet the requirement as promised.
Technical expertise, equipment, facilities, and infrastructure.
Available people, time, and production or service capacity.
Supply-chain reliability and external-provider capability.
Applicable customer, regulatory, and aerospace requirements.
This step is especially important when the work involves new technology, short lead times, unfamiliar requirements, resource constraints, or significant dependencies on suppliers.
3. Do We Want to Do It?
Technical capability does not automatically make a contract a good business decision. The organization should also consider whether the opportunity fits its goals and whether the commercial and operational risks are acceptable.
Profitability and long-term value.
Strategic relevance to the organization.
Scheduling and resource impact on existing customers.
Ethical, reputational, legal, and operational risk.
“Do we want to do it?” is a strategic business and risk-management question rather than a specific AS9100 requirement. It is still valuable because an organization may be capable of performing the work while deciding that the overall risk or business impact is not acceptable.
Embedding Risk-Based Thinking in AS9100 Contract Review
Organizations can strengthen contract review by using:
A consistent contract-review method or checklist.
Cross-functional involvement from the departments affected by the commitment.
A defined method for identifying, recording, and addressing special requirements and operational risks.
Clear criteria for contract acceptance, clarification, negotiation, or rejection.
Documented information showing the review outcome and any new or changed requirements.
The objective is not to create unnecessary paperwork. It is to make sure the organization understands the commitment, has evaluated the important risks, and can demonstrate that the review occurred before accepting the work.
Frequently Asked Questions
Which AS9100 clause covers contract review?
AS9100 addresses the review of requirements for products and services primarily in Clause 8.2.3. Clause 8.2.2 covers determining the requirements that must be considered before the organization commits to supply products or services.
Does AS9100 require a specific contract review form or procedure?
AS9100 requires the organization to review applicable requirements and retain appropriate documented information about the results of the review and new or changed requirements. It does not require one universal contract-review form or a specific risk-register format.
What should be evaluated during an AS9100 contract review?
The review should confirm that applicable requirements are understood, differences are resolved, and the organization has the capability and resources to meet the commitment. Aerospace organizations should also evaluate relevant special requirements and operational risks and involve the appropriate functions in the review.
Conclusion
A strong AS9100 contract-review process helps aerospace organizations avoid commitments they cannot reliably meet, identify operational risks earlier, and protect quality, compliance, customer relationships, and business performance. The three-question framework provides a practical way to make the review more useful without turning it into unnecessary bureaucracy.
If your organization needs help evaluating contract review, operational risk, or overall certification readiness, My ISO Consultants provides AS9100 certification readiness and consulting support designed around real aerospace operations and customer requirements.
