The quality system your accreditation audit runs on

Every part that leaves has a certificate behind it, and this is where it comes from.

A typical business running one of these has 25 to 100 staff on one site, a quality manager and one or two inspectors, books in 20 to 60 deliveries of material a week, and sends out 50 to 200 despatches a week, each with a certificate of conformity. It holds ISO 9001, often with a customer-driven accreditation on top, AS9100 for aerospace or ISO 13485 for medical work, and the whole system is built around the annual audit. Whether the batches sit in an Access database from 2010 or a browser system from 2018, the job is the same.

In the quality manager's words, the material certificate is scanned at goods-in and tied to the heat number, which follows the batch through the shop. At despatch the certificate prints: the material, the processes and the subcontractors' certificates, the inspection results, in each customer's wording. A non-conformance, raised at inspection or from a return, carries its disposition, root cause and corrective action until it is closed. The calibration register lists every gauge with its interval and next due date.

The rules it holds are the ones the auditor asks about:

• Each customer has its own certificate wording: one wants the heat number and specification, another the mill certificates attached, the aerospace one the first article reference.
• A concession needs the customer's written agreement, and its reference goes on the certificate for that batch.
• A gauge found out of tolerance shortens its own interval and triggers a search for every batch it measured.
• A split batch keeps both halves linked to the parent's certificates.
• A third non-conformance against one supplier in a year raises a corrective action request.

Most of that is in the quality manual. The rest is in the system.

Written around 2010 by the quality manager in Microsoft Access to hold the batch numbers and the certificates, and grown since to take the non-conformance reports. The calibration register stayed in an Excel workbook that was always going to be moved in and never was. Where the data reached SQL Server, the certificate and the audit reports became SSRS reports on a report server in the corner, written by someone who has since left. The Access front end sits on the quality office PCs and the data on the server in the comms cupboard.

The quality manager who wrote it now runs the audits and has no time to change it, or has moved on. The report definitions are opened rarely and nervously, and every new customer's wording joins a queue behind the one person prepared to try.

The same trail built between 2016 and 2022, usually by a freelancer or a small agency as a web system in PHP or .NET Core, or put together in Zoho Creator or Power Apps by the quality manager who followed the one with the Access database. Inspectors enter results on a tablet at the bench, the certificate goes out as a PDF with the despatch email, and the bigger customers download their own certificates from a login. From the quality office it looked as though audit week had been solved.

The certificates are what hold it still. Each customer's wording was written into the template code, so a new customer means a developer, and the last one added took the heat number off a different customer's certificate, which that customer's goods-in noticed before the quality office did. The templates have been frozen ever since. Behind that, the freelancer is in a permanent job and the framework underneath has not had an update in years.

Since 2023 a few quality managers have tried again with an AI app builder, got batches and certificates on screen, and stalled at the calibration register, where a gauge recall has to reach back through every batch it measured. It looks years younger than the Access database, and it is just as stuck.

An answer for any batch the auditor points at, in the time it takes to type the number.

The audit is the reason it exists. The auditor picks a despatch from six months ago, and the screen shows the batch, the material certificate behind it, the plating certificate from the subcontractor, who inspected it and against what. That trail, on demand, is the difference between a morning's audit and a week of finding paper.

It does the same for the customer who sends a part back. The batch number on the returned part opens its history, the non-conformance is raised against it, and the reply goes out with facts rather than an apology. The certificate of conformity on every despatch, in the customer's wording, is why the aerospace and the medical work is there at all; without it the parts are not accepted at the customer's goods-in.

The calibration list keeps the gauges in date, and the management review has the non-conformance trend on one sheet.

Systems like this pass the audit every year. What they cannot do is grow the way the customers' audits have.

The register never joined the database. Calibration lives in the workbook, the certificates in Access, the mill certificates as PDFs in a folder named by year, and the trail across the three is the quality manager's memory. When the quality manager is on holiday, the audit is moved.

The report server has a date on it. The certificate and the audit reports are SSRS reports on a report server running Windows Server 2016, which ends in January 2027, and the person who wrote the report definitions has left. The office has learned not to touch it.

A new certificate wording means Word. In either generation each customer's wording is built into the report or the template code itself, so when a new customer asks for a different certificate the quality manager makes it in Word, prints it, and files a copy by hand. There are now several of those, and the auditor has noticed.

Non-conformances are raised and not chased. The form is easy to raise and has no owner, no due date and no reminder, so the management review shows reports open since 2023 with nobody assigned. The customer's supplier audit now asks for closure times, and the system cannot say.

One trail from the mill certificate to the despatch, with the gauges and the non-conformances on it.

Each of these extends something the system already keeps.

Calibration in the same record as the batch. The register becomes a screen in the database, and the inspector records which gauge measured which batch. A gauge found out of tolerance recalls every batch it touched in one query, which today is a week with the workbook and the job cards.

The certificate as data, worded per customer. The customer's wording held as a template the quality manager edits, and the batch's facts poured into it at despatch. The heat-number version, the mill-certificate version and the first-article version all come from one screen, and the Word copies stop.

Non-conformances with an owner and a clock. Every report has a person, a due date and a reminder, and the management review shows age and closure time. The supplier audit's closure question gets a number.

The audit pack on a page. The batch trail, the calibration status, the open non-conformances and the supplier record as pages the quality manager opens, and a read-only login the auditor can be given for the day, in place of reports on a server with a date on it.

The mill certificates where the batch is. The PDFs captured at goods-in against the heat number, so the folder named by year becomes a link on the batch record.

The existing forms and reports keep running through all of this. The new pieces are added beside them, and each is retired when nothing prints from it.

The certificates that arrive as PDFs and scans, read and checked for a person to confirm, and the heat-number questions no report answers.

The paperwork arrives from outside and gets typed in, and the questions mean searching three places. AI pays back there, and the decisions stay with people:

Mill certificates read at goods-in. The material certificate arrives with the delivery as a PDF or a scan, and the inspector types the heat number, the specification and the test results against the batch. AI reads the certificate into the record and flags any result outside the specification, and the inspector confirms rather than types. At 20 to 60 deliveries a week and a few minutes of typing each, that is typically two to four hours a week back for the inspector.

Subcontractor certificates checked against the order. The plating or heat treatment certificate comes back with the parts, and somebody checks the process, the specification and the quantity against the purchase order before filing it. AI checks each against the order and shows only the mismatches. With outside processes behind many of 50 to 200 despatches a week, a check that typically takes two or three hours a week shrinks to minutes.

"Which despatches went out on that heat?" A customer or the auditor asks which despatches carried one heat of material, and whether any were on concession. No report covers it, so the quality manager searches the database, the folder and the Word copies. AI answers in plain words from the batch records and lists every despatch and certificate behind the answer for checking. Each question is typically most of an hour of searching, and audit week brings dozens.

Not worth doing: letting a model decide a concession. The customer decides that, in writing, and the system's job is to hold the letter.

Nothing should write into a batch record before it has a tested restore and a test copy, so this comes after the first stage. The assessment maps where it would pay back.

The audit date does not move, so nothing here can stop the certificate printing.

1. Stabilise. The data on a supported database if it is not on one already, the report definitions recovered from the server and kept somewhere that is backed up, a restore that has been tried, and a test copy where a certificate can be printed without a despatch behind it. This goes first because the January 2027 date on the report server is the one deadline in this system that is not the auditor's.
2. Calibration into the database. The first new piece is the workbook: the register as a screen in the same database, with the gauge recorded against the inspection from the day it goes live. Small, and the recall query exists for the first time.
3. The certificate as data. Templates per customer, the batch's facts filled in at despatch, run beside the SSRS report until the quality manager stops opening it. The Word certificates go first.
4. Non-conformances, the audit pages, the mill certificates. Each a stage, each priced on its own, and the AI reading at goods-in once the certificates are being captured.
5. Retire Access and the report server when nothing prints from either. The last thing to go is usually the certificate report itself, because the customers have accepted it for years.

The assessment is from £395 + VAT, sized on a free one-hour consultation, with an exact price before you commit. For a quality system that means a few days with the quality manager and the inspectors, reading the database, the report definitions and the workbook, finding where each customer's rules live and what the next audit will ask for, and a report with costed options and a fixed price for each. Each stage after that is priced before you commit to it. How we work, what drives the price and the payment terms each have a page, and so does each technology the system is built on: Microsoft Access, Excel and SSRS, and for the newer generation old PHP and .NET Core.