Quality Certifications

Certification Is the Gatekeeper

30-second summary: Quality certifications are a business necessity for deep hole drilling shops — they are often prerequisites for quoting work in aerospace, medical, automotive, and defence supply chains. Each standard imposes specific requirements for quality management, traceability, process control, and documentation. This guide covers the major certifications relevant to deep hole drilling, their requirements, costs, and strategic considerations.

Deep hole drilling appears on critical-to-function components: aircraft landing gear struts, hydraulic actuators, medical bone screws, fuel injector bodies, and oilfield tools. Customers in regulated industries require assurance that the drilling process is controlled, repeatable, and auditable. Certification provides that assurance through third-party auditing against recognised standards. In practice, most prime contractors and tier-one suppliers will not accept purchase orders from uncertified shops — certification is the toll gate, not the destination.

The Six Frameworks a Deep Hole Shop Encounters

ISO 9001:2015

ISO 9001:2015 is the baseline quality management system (QMS) standard applicable to any manufacturing operation. It requires documented procedures for context of the organisation, leadership and commitment, planning for risks and opportunities, support (resources, competence, awareness, documented information), operation (planning, customer requirements, design and development, control of externally provided processes), performance evaluation (monitoring, measurement, analysis, internal audit, management review), and improvement (nonconformity, corrective action, continual improvement).

What it demands from a deep hole shop

Cost and timeline

Implementation runs 3–6 months for a small shop, 6–9 months for medium, and up to 12 for large organisations. The process is: define scope → gap analysis → document the QMS (quality manual, procedures, work instructions, records) → implement with a trial run of at least 3 months → internal audit and management review → Stage 1 documentation audit → Stage 2 on-site audit → certificate. Typical cost is $5,000–$15,000 for the initial audit plus $2,000–$5,000 annually for surveillance (small shops commonly land near $3,000–$4,000/yr). The certificate is valid three years with annual surveillance audits and a recertification audit in year three.

AS9100 Rev D & AS9102

AS9100 Rev D (with AS9102, AS9103, AS9138) adds aerospace-specific requirements on top of ISO 9001. For a deep hole shop the heavy hitters are configuration management (controlling changes to part geometry and process parameters), risk management (formal PFMEA on the drilling process), First Article Inspection per AS9102, full lot traceability from raw material through each operation, counterfeit part prevention (keeping fake tooling and consumables out of the process), and special process control — deep hole drilling is routinely treated as a special process requiring documented qualification of operators, machines, and procedures.

First Article Inspection — the drill-down

AS9100 section 8.5.1.3 (Production Process Verification) requires the organisation to take a representative item from the first production run and verify that the production process, documentation, and tooling can produce a conforming part. That activity is the FAI, and AS9102 defines how it is documented — in three forms plus a ballooned drawing.

When the FAI has to be redone

• Change in design characteristics affecting form, fit, or function
• Change in manufacturing source, process, location, tooling, or materials
• Change in the CNC program or its transfer to another medium
• Natural or man-made events adversely affecting the process
• Corrective action implemented after a nonconformance
• Production lapse of two years or more (full FAI required)
• Change in raw material source or sub-tier processing

A partial (delta) FAI covers only the changed characteristics, provided everything else conformed on the prior FAI. For a machine shop this is the everyday trigger: a new insert grade, a new tool holder, or a re-tuned coolant flow usually means a delta FAI on the affected characteristics.

Getting certified and what it costs

Certification follows a two-stage audit: Stage 1 (readiness review, 1–2 days on-site, documentation and scope) followed 1–2 months later by Stage 2 (comprehensive process-level audit). New organisations typically need 9–12 months to implement; shops already on ISO 9001 usually upgrade in about six months. The QMS must run for a 3–6 month pilot to generate audit evidence. Costs: $10,000–$25,000 initial, $4,000–$8,000 annual surveillance (registrar audits alone run $5,000–$20,000 plus optional consulting at $15,000–$30,000). Registration is administered through the IAQG ICOP scheme and listings appear in the OASIS database that primes check when qualifying suppliers.

NADCAP

The National Aerospace and Defence Contractors Accreditation Program (NADCAP) is an industry-run, cooperative accreditation program for aerospace and defence suppliers of special processes. It was launched in 1990 and is administered by the Performance Review Institute (PRI) under the SAE International umbrella, running over 6,200 audits a year across 26 process categories. The value proposition is unique: one NADCAP audit is accepted by every member company (Airbus, Boeing, and others), so a supplier is audited once against common requirements instead of once per customer.

Machining is on the checklist

While AS9100 certifies the QMS, NADCAP certifies that specific processes meet industry standards — and Conventional Machining as a Special Process (CMSP) is a NADCAP commodity. Its scope includes holemaking (with or without process monitoring), broaching, turning, milling, grinding, and edge treatment. Governing documents are AC7000 (general audit criteria), AC7126 Rev D (CMSP criteria), AC7126/1 (holemaking supplement), and AC7126/3 (turning supplement). Nonconventional machining such as EDM sits under AC7116/3. For a deep hole shop, holemaking with process monitoring is squarely in scope.

Deep hole drilling itself is not currently a standalone NADCAP process, so a shop drilling flight-critical parts will more likely need NADCAP for the supporting processes — most commonly NDT (penetrant, magnetic particle, ultrasonic) of the finished bores. Audits are performed by PRI technical experts and are typically more rigorous than QMS audits.

The audit cycle

• Supplier applies and registers on eAuditNet, where all checklists are public
• Self-audit against the applicable checklists, uploaded at least 30 days before the audit
• On-site audit including a job audit — roughly half the time is spent watching live process, equipment, and workpieces
• Nonconformance Reports (NCRs) classified Major or Minor, plus Type P (potential product issue) or Type C (confirms product non-suitability); responses in English within 21 calendar days, then 7-day rounds, max 4 rounds
• Successful vote by industry working group → accredited and listed on the Qualified Manufacturers List (QML)
• Accreditation granted for ~18 months; re-accreditation cycles run every 12–24 months depending on past performance

Costs vary by process scope and typically run $5,000–$15,000 per process per year. Audits are conducted entirely in English and can be resource-intensive for smaller shops — a frequent reason shops phase NADCAP in after AS9100 rather than at the same time.

ISO 13485

ISO 13485:2016 is the QMS standard for medical device manufacturing. Compared with ISO 9001 it shifts weight onto design controls (if the shop designs drills or fixtures), risk management per ISO 14971 (formally analysing how drilling hazards — burrs, contamination, dimensional nonconformance — affect device safety), and above all process validation.

Process validation: clause 7.5.6

ISO 13485 clause 7.5.6 mandates validation of any production process whose output cannot be or is not verified by subsequent monitoring or measurement — exactly the situation with a buried deep hole. A hole wall that is out of tolerance, work-hardened, or damaged by a broken drill is frequently invisible to post-process inspection. The accepted methodology is the DQ/IQ/OQ/PQ framework.

Validation requires documented plans with methods, acceptance criteria, sample sizes, and revalidation triggers (defined production units, process or machinery changes, time intervals). Parameters confirmed in OQ are locked under engineering change control. Computer software that affects product conformity — including the CAM program and monitoring systems — must itself be validated.

Cleanliness and records

For implantable devices, drilling coolant must not leave residues that cause adverse tissue reactions — a deep hole through Ti-6Al-4V ELI or 316L is a crevice where coolant and debris accumulate. Material-specific variation (thermal expansion, progressive tool wear, coolant contamination) must be formally documented. Records are retained for the lifetime of the device plus 10–30 years depending on jurisdiction, aligning with EU MDR 2017/745 and FDA 21 CFR Part 820.75. Cost: $8,000–$20,000 initial, $3,000–$6,000 annual surveillance.

IATF 16949

IATF 16949:2016 is the automotive QMS standard, built on ISO 9001:2015 with more than 80 additional automotive-specific requirements and mandating the core tools: APQP, PPAP, FMEA, SPC, and MSA. It is effectively required for direct suppliers to automotive OEMs and most tier-ones; tier-two suppliers may only need ISO 9001 plus customer-specific PPAP.

PPAP — the approval gate

PPAP (Production Part Approval Process) is the formal approval before a new part enters serial production. Level 3 — the full 18-element package plus physical samples — is the default for new machined parts. The 18 elements include design records, DFMEA, process flow, PFMEA, control plan, MSA studies (Gage R&R), dimensional results, material test reports, initial process study (Cpk/Ppk), qualified lab documentation, master sample, and the Part Submission Warrant. Roughly 60% of rejected PPAPs fail on just four interconnected elements: PFMEA, Control Plan, MSA, and Initial Process Studies. The initial capability study is taken from 300 consecutive production parts (some OEMs demand 500–1,000).

Capability thresholds that matter for hole characteristics

Cpk 1.67 corresponds to roughly 1 ppm defect rate; Cpk 1.33 to about 64 ppm. Some OEMs (Toyota, BMW) demand Cpk ≥ 2.0 on critical dimensions during initial PPAP, and GM’s addendum requires Cpk/Ppk ≥ 1.67 (1.33 acceptable) for Key Product Characteristics. For a bore that is a safety-critical characteristic, a 30-part internal Cpk study may help setup confidence, but the PPAP submission needs the full 300-piece run, a ballooned drawing, MSA, and a signed PSW.

MSA and the reality of machining

MSA studies are mandatory for every measurement system used on special characteristics: Gage R&R under 10% is acceptable, 10–30% requires management review, and over 30% is not acceptable. In deep hole work, gauge R&R on bore gauges and air gauges is the usual battlefront — the gauge itself often contributes more variation than the drilling process. The biggest capability threats in machining are thermal drift (machine heat shifts dimensions), tool wear drift, and incoming material variation; tool-wear compensation driven by SPC feedback is the most effective way to hold Cpk on long runs. Cost: $15,000–$30,000 initial, $5,000–$10,000 annual.

Other Certifications & Frameworks

Beyond the big QMS standards, deep hole suppliers bump into a second ring of requirements that are often confused with certification but are distinct obligations.

What the Standards Mean for the Bore

Every one of these standards resolves, for a deep hole shop, into the same practical demand: prove the bore is controlled. Here is what the paperwork maps to on the machine.

Machine qualification feeds the paperwork

Machine geometric verification per ISO 230 and ASME B5.54/B5.57 — bed level, spindle runout, axis straightness, coolant pressure stability and filtration level — is the technical backbone of AS9100 production process verification and ISO 13485 installation qualification. A deep hole machine is often qualified with laser interferometry, ballbar testing, and coolant-flow verification before the FAI or IQ is accepted.

NDT of the finished hole

Flight-critical and medical bores commonly require magnetic particle (MPI), liquid penetrant (LPI), ultrasonic (UT), or X-ray inspection for cracks, laps, and tearing — especially after interrupted drilling or in work-hardening superalloys. NDT operators must be certified (BINDT/ASNT frameworks), and in aerospace the NDT process itself frequently needs NADCAP accreditation even when the drilling process does not.

Certification Comparison

Typical Certification Paths by Part Type

Getting Certified, Staying Certified

Every standard follows the same spine: document, prove it works, get audited, stay audited. Budget 3–6 months of pilot operation before any certification audit so records exist to show.

Which certification first?

Common pitfalls

• Scheduling audits too late — most registrars want surveillance scheduled 60–90 days before the expiry date. A lapse of even a few days can disqualify the shop from shipping until reinstated.
• Calibration gaps — gauges past due, missing labels, no traceability to NIST. The classic machining nonconformity.
• Missing work instructions for critical drilling operations, or process parameters not actually recorded per job.
• Unqualified special processes — drilling treated as a normal process with no operator, machine, or procedure qualification.
• Retrospective SPC — charts created after the fact are a quality-system failure under IATF.
• NADCAP response slips — NCR responses have hard 21-day then 7-day deadlines; missing them risks losing accreditation.

What Customers Check in a Deep Hole Supplier

When quality engineers audit a deep hole drilling shop, the certificate is the entry ticket; the evidence is what wins the work. The recurring focus areas are remarkably consistent across all five standards.

Keep Reading