A nondestructive testing (NDT) company lives on trust. The customer cannot see inside the weld or the forging; they rely on your report, and on the system behind it. A quality management system (QMS) is that system written down: how you find problems, fix them, stop them recurring, and show an auditor you did.
Most NDT firms do not have a quality department. They have a quality manager who is also the Level III, or the owner, or both. This guide is about the working parts of a QMS that such a firm has to run whether or not it holds a certificate: internal audits, corrective action, nonconformances, complaints, risks, controlled documents and management review.
Which quality standard applies?
The customer decides, through the purchase order and the codes it invokes. The common ones in NDT are:
- ISO 9001: the general quality management standard, certified by an accredited registrar. Common with industrial customers.
- AS9100: the aerospace quality management standard, built on ISO 9001 with aerospace additions. Often asked for by aerospace primes.
- Nadcap: special-process accreditation for aerospace, administered by PRI. NDT is one of its commodities, and an NDT accreditation audit looks closely at your personnel program, process control and equipment.
- ISO/IEC 17025: accreditation for testing and calibration laboratories, from an accreditation body.
Beneath all of them sit the NDT documents you already work to. They carry quality requirements of their own that a QMS has to capture: ASTM E1417-21 (7.8) expects process-control records to be kept and available for audit by the customer, the engineering organization or a regulator; NAS410 Revision 6 (8.3.2) lists the conditions that suspend a certification; ASME Section V Article 4 (T-467.3) spells out when ultrasonic data is voided and the area reexamined. These are nonconformances waiting to be recorded.
Internal audits
An internal audit is you checking yourself before someone else does. It works best as a programme rather than an annual scramble: list the areas an NDT shop typically needs to cover (document control, personnel qualification, calibration and process control, purchasing, field work, reporting, corrective action, customer feedback, the internal audit process itself) and give each its own cadence.
Three things make an internal audit worth having:
- A checklist with evidence. Each item answered conform, nonconform or not applicable, with a note saying what was looked at. “OK” is not evidence.
- Independence. The auditor should not audit their own work. In a small firm that often means swapping areas, or bringing in an outside auditor for the areas the quality manager runs. The same principle shows up in the personnel standards: SNT-TC-1A (8.1.8) and NAS410 (7.2.1) both forbid anyone examining themselves or a subordinate.
- Findings that go somewhere. Every nonconformance becomes a finding on the corrective-action register, linked to the audit it came from.
Corrective action (CAPA)
The corrective-action register is the centre of the QMS. Findings from internal audits, customer audits, the registrar's visit, escalated nonconformances and customer complaints should all land in one list, because a pattern across sources is exactly what a management review needs to see.
Each record should carry:
- Containment: what you did straight away to stop the problem spreading.
- Root cause: and how you found it, whether a 5-whys, a fishbone or a plain investigation.
- Correction: the fix for this instance.
- Corrective action: the systemic change so it does not recur.
- A due date and an owner.
- An effectiveness check: a later date on which someone confirms the corrective action worked, and signs to say so.
The difference between correction and corrective action is the question registrars ask most often. Reinspecting the parts a bad gauge touched is a correction. Shortening the gauge's interval, or adding a check that would have caught it, is corrective action.
Nonconformance reports
An NCR records a specific thing that did not meet requirements: a part, a report, a process run, a supplier delivery. In NDT the common ones are a process check that failed with parts already processed, an instrument found out of tolerance, a report issued with the wrong acceptance criteria, a technician who worked on an expired certification or vision exam, and consumables received out of specification.
Each NCR needs what was found, how much, who found it and a disposition: use as is, rework, repair, scrap or return to supplier, with the authority for the decision. When the fix needs to be systemic, the NCR escalates into a corrective action and the two stay linked. For the equipment side in detail, see calibration tracking for NDT equipment.
Complaints, risks and suppliers
Complaints should be easy to make and impossible to lose. Log every one, phone and email included, record the response, and escalate the ones that point at a system problem into corrective action. Customer satisfaction measured rather than guessed makes a better management review input than an impression.
Risks and opportunities should be kept in proportion. For most NDT firms a short register is enough: losing a sole Level III, a radiation source incident, a key customer's audit, a calibration vendor with long turnarounds. Give each a likelihood, an impact, an owner, a planned response and a review date.
Approved suppliers matter because so much of NDT is bought in: consumables, calibration services, outside Level III services, training and examinations. Record who is approved, for what scope, on what basis, and when they are next re-evaluated.
Controlled documents
The quality manual, procedures, technique sheets, the written practice and the forms people fill in are controlled documents. Each needs a number, a revision, an approval with a name and date, and a history. Technicians need to be working to the current revision, and you need to be able to show they have read it. When a referenced standard is revised, the procedures that cite it need review, which is where controlled documents meet keeping up with standard revisions and the written practice.
Management review
Management review is where the owner or leadership looks at the system as a whole, on a fixed cadence, and makes decisions. Its value depends on its inputs: open and overdue findings, the period's NCRs, audit results, complaints and customer feedback, supplier performance, risks, quality objectives, changes, and, in an NDT firm, the state of certifications, vision exams, proficiency and calibration. Record the date, who attended, the decisions and the actions with owners and due dates, and set the next review. A review that slipped by six months is itself a finding.
Records, not certification
A QMS is judged on what you do, and the records are how you show it. Keep them together, dated and linked: the audit to its findings, the finding to its NCR, the NCR to the gauge, the corrective action to its effectiveness check. When the registrar or the Nadcap auditor asks to follow a thread, you want to hand them one.
For aerospace accreditation specifically, see Nadcap for NDT.
How TRACE handles it
The Quality module keeps internal audits run item by item against a checklist, one register for every finding and corrective action (containment, root cause, correction, corrective action, due date and an effectiveness check that closes with your name), NCRs with their dispositions and one-click escalation, a customer complaint register whose entries escalate to a finding, a risk and opportunity register, the approved supplier list, controlled documents with read-and-acknowledge tracking, and a management review log that snapshots its own inputs, including certifications and overdue calibrations from the rest of TRACE. Each due date surfaces on your calendar, in the digest email and in the notification bell.
It is record-keeping, not certification: TRACE certifies or accredits no one, and ships no text from ISO 9001, AS9100, ISO/IEC 17025 or any PRI checklist. Its checklists are TRACE's own original questions, and the Nadcap checklist library starts empty so you can import checklists from your own licensed access.
Frequently asked questions
Does an NDT company need ISO 9001?
Not by law. It needs whatever quality system its customers and codes require. Many industrial customers ask for ISO 9001 registration, aerospace primes usually ask for AS9100 or Nadcap accreditation for NDT, and a laboratory may be asked for ISO/IEC 17025 accreditation. A small shop working to one code for a handful of customers may only need the quality program that code and those purchase orders describe.
What is the difference between a correction and a corrective action?
A correction deals with the problem in front of you: reinspect the parts, fix the report, recalibrate the gauge. A corrective action deals with why it happened, so it does not happen again: change the procedure, the interval, the training or the check that missed it. Registrars and accreditation auditors look for both, plus evidence that the corrective action worked.
Can a Level III be the internal auditor?
Yes, as long as they are not auditing their own work. Internal audits should be done by someone independent of the area being audited. And an internal auditor role is not a certification level: being an internal auditor gives nobody authority to examine or certify NDT personnel. That authority comes from the written practice, through the Level III or Responsible Level 3.
Can software make us ISO 9001 or Nadcap compliant?
No. Software can keep the records an auditor asks for and remind you when they fall due, but certification comes from an accredited registrar and accreditation from the accrediting body, after they audit how you actually work. The standards and audit checklists themselves are copyrighted, so you need your own licensed copies.
Checked against
- NAS410 Revision 6, Aerospace Industries Association, revision date 1 December 2025: 7.1.2, 7.2.1, 8.1 and 8.3.2
- ASNT SNT-TC-1A, 2024 edition, paragraph 8.1.8, with the 2025 addendum
- ASTM E1417/E1417M-21ε1, section 7.8
- ASME Boiler and Pressure Vessel Code Section V, 2025 edition, Article 4 (T-467.3)
- ISO 9001, AS9100 and the Nadcap audit criteria: not reviewed for this guide (described in outline only)
This guide summarises the documents above in our own words to help you find your way around them. It is not a substitute for them: requirements change between editions and contracts add their own, so check every figure against your own licensed copy and your written practice before you rely on it.
Named for reference only. TRACE is an independent product: it is not affiliated with, endorsed by, sponsored by or accredited by ISO (publisher of ISO 9001 and ISO/IEC 17025), the Performance Review Institute (PRI), which administers Nadcap, the Aerospace Industries Association (publisher of NAS410), ASNT (publisher of SNT-TC-1A), ASTM International (publisher of E1417/E1417M), ASME (publisher of the Boiler and Pressure Vessel Code, Section V) or SAE International (publisher of AS9100), or by any other organization whose standards or programs it describes. Their names and marks are their own.