ISO 9001 / AS9100 Clause 7, Part One, Resources: What It Takes to Actually Run the System

Clauses 4 through 6 were about knowing your business, leading it, and planning. Clause 7 is where the standard asks the blunt follow-up question: do you actually have what it takes to do any of it?

Clause 7 covers a lot of ground, so I'm splitting it across two posts. This one covers 7.1, Resources, which breaks into six subclauses running from people and buildings all the way through the knowledge in your employees' heads. Next time we'll pick up 7.2 through 7.5: competence, awareness, communication, and documented information.

It's tempting to read Clause 7 as the housekeeping section; the boring inventory of things you need to have.  Far too often I’ve seen resource gaps met with the direction to “just figure it out.”  While unplanned resource needs can be difficult to support and can directly impact the bottom line, at some point “just figure it out” means no more than wishing or hoping your team will be able to bail your organization out of the predicament you’ve found yourself in.  Clause 7.1 states in black and white what resources are required to meet customer expectations. 

7.1.1:  General

What's expected: Determine and provide the resources needed to establish, implement, maintain, and continually improve the QMS. In doing so, consider the capabilities of and constraints on existing internal resources, and what needs to be obtained from external providers.

What conformance actually looks like: This is the umbrella requirement, and it's mostly demonstrated through the subclauses that follow. The second half directs consideration of the context of the organization, its capabilities and the constraints on internal resources, and what needs to be obtained from external providers.

The failure mode isn't under-resourcing, but rather under-resourcing without noticing; committing to a quality objective, a new customer, or a scope expansion that the organization has no realistic capacity to support, and then discovering that during execution.

Why it matters to the customer: Almost every supplier failure I've investigated traces back to a capacity or capability gap that was known internally before the order was accepted. The customer's experience of "they overpromised" is usually a resource determination that never happened.

Where the operational payoff is: Honest resource assessment is what lets you say no to the wrong work, which is one of the more profitable things a shop can learn to do.

7.1.2:  People

What's expected: Determine and provide the people necessary for the effective implementation of the QMS and the operation and control of its processes.

What conformance actually looks like: This is about whether the roles the QMS depends on are actually staffed by someone with the time to do them. The single most common gap I find in small shops: the quality manager who's also the production scheduler, the shipping approver, and the person who runs first articles. Every one of those responsibilities is legitimate. Collectively, they mean the QMS-specific work happens last, if at all.

Note the interaction with 5.3 from two posts back. The standard requires quality responsibilities to be assigned and requires the people to carry them out. Assigning quality authority to someone with no capacity to exercise it satisfies neither clause.

Why it matters to the customer: Under-staffed quality functions fail in a predictable order: proactive work goes first (internal audits slip, corrective actions age), then verification work compresses, and eventually something ships that shouldn't have. By the time the customer sees it, the resource problem is typically a year old.

Where the operational payoff is: This is a place where the standard gives a quality manager useful leverage. "I need another inspector" is a request. "We cannot fulfill our verification requirements as currently staffed, and here's the evidence" is a business case.

7.1.3:  Infrastructure

What's expected: Determine, provide, and maintain the infrastructure necessary for the operation of processes and to achieve conformity of products and services. Infrastructure includes buildings and utilities, equipment (hardware and software), transportation, and information and communication technology.

What conformance actually looks like: The keyword here is maintain. Providing a machine is easy; maintaining it is the requirement people miss. Conformance generally means a preventive maintenance program with a schedule, records showing it's being followed, and some evidence that maintenance is driven by something other than failure.

An auditor's quickest test is to ask for the PM schedule and then ask for the last three completed records. The gap between the two tells the whole story. Also note that infrastructure explicitly includes software and IT:  your ERP, your inspection data systems, your document control platform. Those need maintenance plans too, a point that becomes obvious the first time an unpatched system goes down mid-quarter.

Why it matters to the customer: Equipment that isn't maintained doesn't fail on a schedule you can plan to. It drifts,  producing parts that are still in tolerance but trending, until they aren't. The customer sees that as a batch-to-batch consistency problem, which is one of the harder trust problems to recover from.

Where the operational payoff is: Planned maintenance is cheaper than unplanned maintenance by a wide margin, and unplanned downtime hits hardest when you're busiest, because that's when the machines are running hardest. This is the clause where compliance and basic operational sense point in exactly the same direction.

7.1.4:  Environment for the Operation of Processes

What's expected: Determine, provide, and maintain the environment necessary for the operation of processes and to achieve product and service conformity. The standard notes this can include physical factors (temperature, cleanliness, humidity, light, airflow, noise), social factors (non-discriminatory, calm, non-confrontational), and psychological factors (stress-reducing, burnout prevention, emotionally protective).

What conformance actually looks like: In precision manufacturing the physical side is straightforward and often critical.  Temperature control in the inspection room isn't a nicety when you're holding tenths, and cleanliness requirements can be contractual. Conformance means you've determined what your processes actually require and can show you're maintaining it.

The social and psychological factors get dismissed as filler more than any other content in the standard. That dismissal is getting harder to sustain: the 2026 revision threads quality culture through the environment clause alongside leadership and awareness, and the AS9100 revision in progress carries similar language, with culture cited as an environmental factor covering quality, ethical behavior, product and personnel safety, and quality of work life.

The substance was always there. An environment where people are afraid to report a problem is an environment that doesn't support process conformity.  When there is an emotional tax to deliver bad news, it creates an environment where the cultural norm becomes hiding issues, including issues affecting product.  The last two posts covered how that shows up as observable symptoms. This clause is simply where the standard says the environment has to support the work, and a fear-based environment demonstrably doesn't.

Why it matters to the customer: Environmental controls are usually invisible to customers right up until they aren't. Contamination, corrosion from humidity, measurement error from thermal drift; these produce failures that are genuinely hard to root-cause after the fact, because the evidence has already equalized to room temperature.

Where the operational payoff is: Environmental control reduces variation, and variation is what you spend money on, in scrap, in rework, in tighter-than-necessary process controls compensating for a condition you could have just fixed.

7.1.5:  Monitoring and Measuring Resources

What's expected: Determine and provide the resources needed to ensure valid and reliable monitoring and measurement results, ensure those resources are suitable and maintained, and retain documented information as evidence of fitness for purpose. Where measurement traceability is a requirement (7.1.5.2), measuring equipment must be calibrated or verified at specified intervals against standards traceable to international or national measurement standards, so long as these standards exist. It is also identified to determine its status, and safeguarded from adjustments or damage that would invalidate its status. When equipment is found unfit, you must determine whether the validity of previous measurement results has been adversely affected and take appropriate action.

AS9100 adds requirements around the calibration system itself, including maintaining a register of monitoring and measuring equipment with the calibration method, acceptance criteria, and recall status.

What conformance actually looks like: Most shops handle the mechanics of this reasonably well:  gage list, calibration schedule, stickers, and certificates on file. Two things are commonly weak:

First, customer-owned and employee-owned gages. The micrometer an operator brought from home is in the system or it isn't, and "isn't" is a finding waiting to happen.

Second, and much more important, the out-of-tolerance recall process. The requirement to assess previous results when equipment is found unfit is the one that has teeth, and it also tests the traceability limits of your systems. When a gage comes back out of tolerance at annual calibration, you own an honest question: what did we measure with it since the last time it was known good, and where did those parts go? That's uncomfortable work. It's also the exact moment where the documentation-matches-reality principle gets tested, because the easy path is to file the certificate and move on.

A calibration system is the measurement equivalent of a chain of custody. The certificate isn't the point, the unbroken chain is. One link that can't be verified calls everything downstream of it into question.

Why it matters to the customer: Your customer is relying on your measurements as much as on your machining. An uncontrolled gage means every inspection result it produced is an assertion rather than evidence. In aerospace, where your records may be reviewed years after delivery, that's a serious exposure.  A well-executed recall, though painful, is exactly the thing that preserves customer trust when it happens.

Where the operational payoff is: Good gage management prevents the most expensive kind of rework: parts made correctly and rejected because the gage was wrong, or parts made incorrectly and accepted for the same reason. It also shortens source inspections considerably:  calibration status is one of the first things a customer rep checks, and a clean system sets the tone for everything after.

7.1.6:  Organizational Knowledge

What's expected: Determine the knowledge necessary for the operation of your processes and to achieve conformity of products and services. That knowledge must be maintained and made available to the extent necessary. When addressing changing needs and trends, you must consider your current knowledge and determine how to acquire or access any additional knowledge required.

The standard notes that organizational knowledge comes from internal sources (intellectual property, lessons learned, undocumented experience, results of improvements) and external sources like standards, conferences, and customer or provider input.

What conformance actually looks like: This is the newest concept in the resource clause and the one most often satisfied with a gesture. A folder of work instructions and a lessons-learned log are the usual answer, and neither is wrong, but neither addresses the real exposure.

The real exposure is the knowledge that runs your floor and exists nowhere but in a few people's heads. Which setup gets the finish right on that job. Which customer's print notes actually mean something different from what they say. Which quote to walk away from. Which machine needs the second op run before lunch or the part walks. That knowledge is genuinely valuable:  it's often the actual competitive advantage, and it's completely uninsured.

Conformance means you've determined what knowledge your processes require, which necessarily means identifying knowledge you don't currently have written down anywhere. An honest gap list is more compliant, and vastly more useful, than a tidy document library that quietly omits everything important.

Why it matters to the customer: Your customer's confidence in you is usually confidence in a specific set of people, whether either party has said so out loud. Everyone in this industry has watched a supplier's quality fall off a cliff after a retirement. Documented organizational knowledge is what makes your capability an attribute of the company rather than an attribute of an individual, and it's increasingly something customers ask about directly, because they've been burned.

Where the operational payoff is: This is capacity, not paperwork. When setup knowledge lives in one person, everything that needs that knowledge queues behind that person. Capturing it doesn't just protect you against their departure, it lets three people do what one person could do, today, while that person is still there to explain it. That's the part shops consistently underestimate: the retirement risk is the headline, but the throughput gain arrives immediately.

AS9100 Clause 7: The Biggest Concern

Of everything in 7.1, organizational knowledge is the requirement I'd push hardest on right now, because the industry's demographics have turned a compliance clause into an urgent business problem.

The manufacturing workforce is old and getting older. Skilled trades skew significantly toward the back half of the last century, and the replacement pipeline hasn't kept pace for decades. Deloitte and the Manufacturing Institute project that 3.8 million new manufacturing employees will be needed by 2033, with a large share of that demand coming from retirements rather than growth. In most shops I walk into, the people who know how the hard jobs actually run are within a decade of leaving, and several are within a year or two.

Here's what makes this different from a normal staffing problem: when a machinist retires, you don't just lose a machinist. You lose the reason a setup is done the way it is. You lose the workaround that's been quietly preventing a recurring defect for eleven years. You lose the judgment about which jobs to quote. You can hire a replacement machinist in a few months. You cannot hire that.

It's the difference between losing a book and losing the only person who could read the language it's written in.

Clause 7.1.6 has been sitting in the standard since 2015 asking companies to solve this before it becomes urgent. For a lot of manufacturers, the window to do that calmly is closing.

Come Talk About This in Person

If this is the part of the post you recognized your own shop in, I'm running a working session on exactly this problem at the KCMN SWOT Summit, Breakout Session 3B: The Retirement Cliff: Turning Tribal Knowledge Into Capacity & Something Your Customer Can Audit — co-presented with Ben Karrasch of Corello AI.

It's a working session, not a lecture: we'll diagnose where your shop's knowledge is trapped and what it's costing you, and you'll leave with a one-page self-score you can take back to your team. It's built for owners, GMs, plant managers, and quality managers.

Registration is open through October 9: KCMN SWOT Summit breakout sessions

If you're going to be there, find me.  I'd genuinely like to hear how your shop is handling this.

What's Next

Part two of Clause 7: competence, awareness, communication, and documented information — including why "documented information" replaced "documents and records," and what the 2026 revision changes about awareness.