RSC Content Type: Operational Playbook

Step-by-step rollout or execution method.

  • How do we prevent sites from creating unauthorized local variations?

    Preventing unauthorized local variations is primarily a governance, architecture, and change-control problem, not just a training issue. The objective is not zero variation, but to ensure that any site-specific differences are deliberate, justified, traceable, and approved through a controlled process.

    Clarify what “variation” means and where it is allowed

    • Define global vs local elements: Identify which elements must be globally standard (e.g., CTQs, key process parameters, inspection points, data fields) and which can be parameterized by site (e.g., local tooling, machine IDs, shift patterns).
    • Standard templates: Use master templates for routings, travelers, work instructions, and quality plans with clearly marked, controlled “local fields” for allowed tailoring.
    • Document the boundary: In your procedures, explicitly state what a site may change without central approval, what requires central review, and what is strictly prohibited.

    In practice, this connects to data integrity, version control and audit when teams need to turn the answer into repeatable execution habits.

    Establish strong ownership and change control

    • Single process owner: Assign a global owner (or small core team) for each critical process, specification, or standard work family. Local engineering should be contributors, not independent owners, for those assets.
    • Formal change workflow: Run any change that affects safety, quality, regulatory claims, customer requirements, or traceability through a documented change-control process (ECR/ECO, MCO, or equivalent).
    • Site impact assessment: Require sites to assess and document impact of proposed changes on equipment, training, validation, and customer commitments.
    • Tie to QMS: Ensure that unauthorized variations are treated as nonconformances within your QMS, with clear escalation and corrective actions.

    Use systems to technically prevent or flag local edits

    In brownfield environments, you usually cannot rely on a single system. You need a layered approach across PLM, MES, ERP, and document control.

    • Central master data: Keep master specifications, routings, and work instructions in a controlled source system (often PLM or a document control system) with version governance and explicit release states.
    • Role-based permissions: In MES, ERP, and DMS, restrict who can create or modify routings, travelers, WIs, and inspection plans. Limit edit rights at the site level to predefined local fields.
    • Template locking: Use configuration that prevents sites from copying a global template, modifying it, and using it without linking back to the master or triggering a central review.
    • Required linkages: Enforce references to controlled documents (e.g., WI ID, revision) on work orders and digital travelers so that any deviation from the approved rev is visible.
    • Revision and approval checks: Configure systems so that production cannot be released unless the referenced documents and routings are in a released state and match the required revision for that part, customer, and program.

    Make authorized local tailoring explicit and traceable

    Preventing unauthorized variation does not mean eliminating all local flexibility. Instead, you constrain it.

    • Parameterization, not freeform edits: Where differences are expected (equipment models, fixture IDs, photos, local language aids), configure structured fields or options rather than letting sites rewrite the work instruction.
    • Local annexes: When necessary, allow site-specific annex documents that are formally linked to the master WI and controlled through the same change process.
    • Deviation / concession process: Provide a clear, time-bound deviation process so sites are not tempted to create permanent workarounds. Deviation use and closure should be visible across sites and in audits.

    Audit and monitor for drift

    • Layered process audits (LPAs): Include checks that operators are using the correct revision of work instructions, travelers, and inspection plans, and that no “shadow” documents are present at the line.
    • Configuration and data integrity audits: Periodically compare routing/WI versions in MES/ERP against PLM or document control to detect unauthorized local variants.
    • Exception reporting: Set up alerts for cases such as: a new routing created at site level without a linked engineering change, work orders referencing obsolete revisions, or documents modified by unauthorized roles.
    • Supplier and outsourced work: Extend similar controls to suppliers where they use your travelers/WIs or create derived versions. This often requires clear contract language and incoming verification steps, but that is a commercial/legal matter, not a system guarantee.

    Training, incentives, and consequences

    • Operator and supervisor training: Ensure they understand that “local tweaks” to work instructions, inspection methods, or data collection can create compliance and traceability risks.
    • Make the right path easier: If the official change process is slow or opaque, local variation will reappear. Streamline low-risk changes and communicate typical lead times so sites can plan.
    • Management expectations: Site leadership should be evaluated not only on throughput and yield, but also on adherence to standard work and configuration integrity.
    • Clear consequences: Define and apply consequences (within HR and QMS policies) for deliberate bypassing of approved processes, while avoiding blame for systemic design gaps.

    Brownfield and long-lifecycle realities

    • Multiple systems will coexist: Legacy MES, homegrown travelers, spreadsheets, and paper appendices often exist in parallel. You will not eliminate these overnight, so prioritize control around the most critical, high-risk processes and customers.
    • Incremental tightening, not big bang: Full replacement of legacy systems to eliminate variation is rarely feasible in aerospace-grade environments due to validation cost, downtime risk, and integration complexity. Focus on tightening master-data control, permissions, and audit coverage rather than waiting for a new platform.
    • Validation and change burden: Any change to how WIs, routings, or inspection plans are distributed and controlled may trigger revalidation or customer notification. Plan rollouts with robust change control and evidence of equivalence.

    Practical steps to start

    • Map where standards are authored today (PLM, doc control, shared drives) and where they are actually executed (MES, paper, local spreadsheets).
    • Identify top 5 processes or part families where unauthorized variation would have the highest risk (safety, regulatory, key customers) and focus controls there first.
    • Lock down edit permissions and enforce master references for those areas, then expand the pattern as you harden integrations and validate changes.
    • Integrate findings from internal audits, customer audits, and nonconformances back into your control strategy for continuous tightening.

    Ultimately, you prevent unauthorized local variations by combining clear ownership, constrained flexibility, robust change control, and system-enforced guardrails, all adapted to the realities of your current technology stack and regulatory obligations.

  • How can aerospace organizations move from MRB-driven firefighting to systemic prevention?

    Moving from MRB-driven firefighting to systemic prevention is less about a new tool and more about changing how you use data, govern change, and close feedback loops. In aerospace, the constraints of qualification, long lifecycles, and mixed legacy systems mean this shift has to be incremental and highly traceable.

    1. Reframe MRB as a system signal, not just a disposition step

    MRB will never disappear in aerospace. The goal is to treat every MRB event as structured input to prevention, not just a one-off decision.

    In practice, this connects to non-conformance management when teams need to turn the answer into repeatable execution habits.

    • Standardize MRB data capture: Ensure nonconformances, dispositions, and justifications are captured in a consistent, queryable form (not only in PDFs or free text).
    • Enforce minimal required fields: e.g., defect code, operation/sequence, tool or program ID, material/lot, supplier, shift, station, inspector, and links to NCR/CAPA records.
    • Separate MRB risk decisions from analysis: Keep urgent airworthiness decisions fast, but schedule structured review of MRB patterns at daily/weekly cadence.

    2. Tighten traceability between MRB, process, and design

    Prevention requires clear digital threads from nonconformance back to the specific conditions that produced it.

    • Link MRB records to:
      • Specific work orders, operations, and revision of work instructions.
      • Tool IDs, CNC programs, fixtures, test stands, and measurement programs.
      • Material/lot, heat, and supplier batch where relevant.
    • Integrate systems minimally before replacing: Use connectors or lightweight data hubs to join QMS/MRB data with MES and ERP identifiers rather than attempting a full system swap that is unlikely to survive validation and downtime constraints.
    • Make traceability queryable: Engineers need to ask, for example, “Show all MRB events for Operation 40 on Part X for Rev C in the last 12 months.” If your current stack cannot support this, prioritize enabling these queries before chasing advanced analytics.

    3. Stabilize and govern standard work before automating prevention

    Systemic prevention depends on stable, controlled processes. If routing, settings, and instructions frequently change informally, you will only automate chaos.

    • Harden digital work instructions: Ensure work instructions, inspection plans, and torque/parameter limits live under explicit document control with revision history and formal approval.
    • Control local variation: Reduce “tribal” workarounds at cells (taped notes, unofficial parameter tweaks). If variation is needed, bring it under controlled deviation processes.
    • Apply change control rigor: Any process change implemented as a response to MRB should go through your standard change control, with explicit linkage back to the triggering nonconformances.

    4. Build a tiered problem-solving system around MRB data

    Instead of handling every MRB event the same way, introduce tiers of response that distinguish between quick fixes and systemic issues.

    • Tier 0: Containment at the cell
      • Operators and supervisors document nonconformance and immediate containment actions.
      • Use simple visual controls or checklists to ensure segregation of suspect product and documentation of impact.
    • Tier 1: Recurrent issue screening
      • Daily or shift-level quality review of MRB and NCR logs, grouped by part, operation, or defect type.
      • Basic pareto analysis and trend detection, using whatever tools your environment supports (QMS reports, BI tools, or custom queries).
    • Tier 2: Structured root cause analysis
      • For recurring or high-severity MRBs, trigger formal root cause analysis and CAPA using standard methods (5-Whys, fishbone, fault tree, etc.).
      • Require explicit linkage from MRB records to the CAPA and to any preventative actions in process, design, training, or supplier management.

    5. Prioritize high-leverage prevention targets

    Trying to “prevent everything” spreads resources too thin. Focus on a small number of recurrent, high-cost, or high-risk MRB drivers.

    • Use cost and risk weighting: Rank MRB categories by impact on scrap, rework hours, schedule slip, and customer impact (e.g., escapes, concessions).
    • Select a limited number of themes per quarter: For example, one structural nonconformance category, one cosmetic/dimension category, and one test/functional category.
    • Align engineering, manufacturing, and quality on these themes: Assign clear owners, charters, and target metrics for reduction.

    6. Close the loop with process and design changes

    Systemic prevention only happens when MRB insights reliably change how products are made and maintained.

    • From MRB to process control:
      • Update process FMEAs and control plans based on recurring MRB modes.
      • Introduce in-process checks at the operations where defects originate, not just at final inspection.
      • Standardize known-good setups, parameters, and fixtures where variation is driving MRB.
    • From MRB to design feedback:
      • Feed persistent manufacturability issues back into design reviews and drawing standards.
      • Flag tolerances and features that repeatedly drive MRB for DFM consideration on future programs or block changes.
    • From MRB to training:
      • Convert recurring human-factor MRBs into targeted training modules and certification criteria.
      • Use MRB cause codes to identify where training content or on-the-job guidance is ineffective.

    7. Layer analytics and monitoring on top of existing systems

    In brownfield aerospace environments, a full QMS/MES/ERP replacement seldom delivers quick prevention gains due to validation burden and downtime. Targeted analytics on existing data is usually faster and safer.

    • Start with basic aggregation: Use existing QMS exports or direct database access to build recurring MRB dashboards by part, cell, operation, supplier, shift, and revision.
    • Introduce early warning indicators: For example, trigger a review when MRB rate per 100 units for a given operation crosses a control limit, or when a new revision’s MRB volume spikes.
    • Use pilots, not big bangs: Apply analytics and prevention workflows to a focused product family or line first. Prove value and refine the model before expanding.

    8. Align governance, metrics, and incentives with prevention

    If leadership only rewards MRB cycle time and on-time shipment, people will optimize for fast firefighting.

    • Balance metrics: Track both response metrics (MRB throughput time, aging) and prevention metrics (reduction in MRB frequency and severity by category, number of MRB-driven process/design changes implemented).
    • Protect engineering and quality capacity: Reserve a fixed portion of engineer/ME/quality time for Tier 2 systemic work, not just MRB signoffs and urgent concessions.
    • Institutionalize learning: Hold periodic, evidence-based MRB reviews that focus on patterns, not blame. Document and share lessons across programs, especially in high-mix / low-volume contexts.

    9. Practical starting steps for a regulated, brownfield environment

    Given integration debt, validation overhead, and constrained downtime, a pragmatic approach might look like:

    1. Define a common MRB taxonomy for defect types, causes, and operations across programs, and ensure it is actually used in QMS entries.
    2. Establish regular cross-functional MRB review on a limited product family, focusing on patterns and systemic actions, not individual cases.
    3. Create basic MRB analytics from existing systems, even if initially via exports and a BI tool, to visualize paretos and trends.
    4. Pick 1–3 high-impact MRB modes and drive formal CAPA, with documented updates to work instructions, FMEAs, or design standards.
    5. Harden traceability between MRB, work orders, and revisions so that future analysis is faster and less manual.

    These steps can usually be done on top of existing QMS/MES/ERP with controlled configuration changes, avoiding risky wholesale replacements.

    Over time, the organization moves from reacting to each MRB to treating MRB as a structured feedback system that continuously hardens processes, designs, and training. The pace of firefighting slows as the number of repeated issues declines, while the remaining MRB workload becomes more about rare or novel conditions rather than chronic, preventable ones.

  • How often should aerospace organizations review their risk register?

    There is no single mandated review frequency that fits every aerospace organization, but in regulated, complex environments a multi-layered cadence is usually expected.

    Typical baseline cadences

    For most aerospace manufacturers, MROs, and system integrators, a practical pattern looks like:

    In practice, this connects to AS9100 compliance when teams need to turn the answer into repeatable execution habits.

    • Quarterly formal review of the enterprise or site-level risk register, tied to management review, internal audits, or steering committee meetings.
    • Monthly operational review of high and emerging risks in production, MRO, supply chain, and IT/OT security, often embedded in existing performance or safety meetings.
    • Event-driven updates any time a significant change or incident occurs, such as configuration changes, process transfers, major quality escapes, supply disruptions, or cybersecurity events.
    • Annual deep-dive reassessment of the overall risk framework, criteria, and assumptions, often aligned with QMS, SMS, or ISMS review and strategic planning.

    The register should be treated as a living artifact. If risks and mitigations remain unchanged between reviews, that should be explicitly confirmed and documented, not assumed.

    Factors that should drive review frequency

    The appropriate cadence depends on your specific context. Common drivers include:

    • Program phase and lifecycle: Development, industrialization, and ramp-up typically justify more frequent reviews than stable, mature production, because design, suppliers, and processes are still changing.
    • Regulatory and customer expectations: Commitments under AS9100, internal process audits, OEM/customer contracts, and aviation authority expectations can implicitly set minimum review expectations, especially where safety or continued airworthiness is involved.
    • Risk profile and tolerance: Safety-critical systems, complex assemblies, and software-heavy products often require tighter monitoring than lower criticality parts or services.
    • Change volume: High rates of engineering change, supplier churn, site transfers, or digital transformation justify more frequent reviews because underlying assumptions age quickly.
    • Incident history: Repeated escapes, audit findings, cyber incidents, or recurring supply issues are strong signals that the risk register is stale or incomplete and needs more frequent attention.
    • System maturity: Organizations with integrated QMS/MES/ERP and strong metrics can review efficiently and more often. Fragmented, manual environments may be forced into less frequent but more intensive reviews, with higher risk of blind spots.

    Brownfield and system coexistence considerations

    In brownfield aerospace environments, risk data is typically scattered across QMS, MES, ERP, PLM, safety management systems, and spreadsheets. Review cadence and quality are constrained by:

    • Integration gaps: If nonconformances, CAPA, maintenance data, and supplier performance are not linked to the risk register, reviews rely on manual compilation and expert memory, which slows frequency and can miss systemic risks.
    • Legacy tools: Older QMS or risk tools might not support easy re-prioritization or trending, so organizations gravitate to quarterly or annual reviews simply because it is operationally manageable.
    • Validation and change control: Introducing or modifying digital risk tooling in aerospace often requires validation, qualification, and formal change control. This is one reason why full replacement of legacy risk tools is rare; incremental integration and overlay approaches are more realistic.
    • Downtime and data availability: MES or ERP downtime, data quality issues, or delayed batch uploads can impact when risk analyses are credible. Some sites time reviews around known data availability windows.

    Because full system replacement is difficult in long-lifecycle aerospace environments, many organizations end up with a hybrid model: the “official” risk register in a QMS or governance tool, supplemented by operational risk views derived from MES, maintenance, or supplier data. Review cadence must acknowledge this split and ensure both views are reconciled.

    Minimum practical expectations

    Given typical aerospace risk, traceability, and compliance obligations, it is difficult to justify reviewing an enterprise or site-level risk register less frequently than:

    • Quarterly for formal, documented review of significant operational, quality, safety, and cybersecurity risks, with evidence of updated status and actions.
    • Immediately after major events, such as significant escapes, accidents or serious incidents, large-scale rework or scrap, critical supplier failure, or material OT/IT security events.

    Some organizations choose monthly formal reviews during high-risk periods (e.g., industrialization, certification, first article for new programs, major facility moves), then relax to quarterly once the risk profile stabilizes.

    Practical ways to operationalize the cadence

    For leadership teams in manufacturing, quality, and IT/OT, a workable approach is to:

    • Define clear triggers that force an out-of-cycle update, such as yield drops beyond a threshold, repeated NCRs on a key characteristic, or changes to critical software or OT assets.
    • Align reviews with existing forums such as management review, internal process audits, safety boards, and cyber risk committees, so risk register updates leverage work already being done.
    • Use stratified views: keep one master risk register but maintain filtered views for production, MRO, supply chain, and IT/OT, so each function can review at an appropriate cadence without fragmenting the source of truth.
    • Link to data where possible: even partial integration with MES, QMS, and supplier data helps focus reviews on risks that are actually moving.
    • Document rationale: when the cadence or scope of review is adjusted (e.g., from monthly to quarterly), record the justification and supporting evidence, since this is often probed in audits and customer reviews.

    Ultimately, the right frequency is the least intensive cadence that still gives leadership early warning of deteriorating conditions, within the constraints of existing systems, validation requirements, and resource limits.

  • How should organizations respond when they identify a suspect counterfeit part?

    Organizations should respond to a suspect counterfeit part through a structured, documented process that protects safety, preserves traceability, and aligns with their quality management system (QMS) and contractual / regulatory obligations. The details will depend on sector, contracts, and system maturity, but the core steps are consistent.

    1. Immediate containment and segregation

    As soon as a part is suspected (not just confirmed) to be counterfeit:

    In practice, this connects to non-conformance management when teams need to turn the answer into repeatable execution habits.

    • Stop use and installation of the specific unit and any associated lot / batch.
    • Physically segregate the suspect parts in a clearly identified, access-controlled quarantine area.
    • Block inventory and work orders in ERP/MES so operators cannot consume the material by mistake (e.g., status change to blocked/hold).
    • Identify potential spread using available genealogy: other lots, work orders, serials, or customers that may have received the same material.

    The goal is to prevent further use while preserving evidence and traceability, not to immediately scrap material.

    2. Open a formal nonconformance / incident record

    Treat suspect counterfeit parts as formal nonconformances, even before confirmation:

    • Create an NCR or equivalent record in the QMS/NCR system with traceable identifiers (lot, serial, PO, work orders, supplier, operator, machine, date, etc.).
    • Document how the suspicion arose (inspection finding, performance anomaly, supplier notification, customer alert, industry advisory).
    • Attach objective evidence (photos, measurements, documents, labeling and packaging details, test results).

    This record becomes the backbone for internal investigation, supplier interaction, and any regulatory or customer reporting.

    3. Preserve evidence and avoid uncontrolled rework

    Do not alter or destroy evidence prematurely:

    • Retain original packaging, labels, and paperwork (COCs, test reports, shipping labels, invoices).
    • Control access to the suspect parts so that they cannot be mixed back into stock or modified by well-meaning operators.
    • Log all handling of the suspect material in your traceability systems (ERP/MES/QMS) to maintain a robust audit trail.

    Uncoordinated scrapping or rework can break the chain of evidence, complicate supplier recovery, and weaken your position in any dispute or audit.

    4. Notify internal stakeholders quickly

    Internal communication usually matters more than initial technical certainty:

    • Quality / QMS owner for NCR control and investigation leadership.
    • Supply chain / purchasing for supplier communication and any stop-ship or stop-buy decisions.
    • Manufacturing / operations for work stoppages, routing changes, or material substitutions.
    • Engineering and design authority to assess technical risk, fit/function, and possible field impact.
    • Program management / account management if key customers or programs may be affected.

    Most regulated plants formalize this notification through predefined workflows in their QMS or via controlled deviation / MRB processes.

    5. Engage the supplier through controlled channels

    Supplier interaction should follow documented procedures and any contractual requirements:

    • Issue a supplier NCR or formal notice with factual, objective information only.
    • Request supporting documentation such as detailed COC, traceability to OEM/OCM, test results, and distribution chain records.
    • Coordinate return or further testing only under a documented plan that preserves evidence and chain of custody.
    • Avoid informal resolutions (e.g., quick credits or replacements) without a documented position on whether the material is confirmed or suspected counterfeit.

    If the supplier is an authorized distributor or OEM, their counterfeit control program may define specific steps. For brokers or gray-market sources, you may need more extensive verification and risk mitigation.

    6. Assess risk to in-process and fielded product

    With containment in place, organizations need a structured risk assessment:

    • Identify where parts were used using as-built genealogy from MES/ERP/QMS: work orders, serial numbers, ship sets, customers.
    • Determine potential impact on safety, reliability, mission/flight-worthiness, and regulatory status.
    • Involve engineering and, where required, the design authority for technical assessment and any need for analysis, test, or teardown.
    • Evaluate field exposure: units in service, at distributors, or at MRO providers.

    This assessment will drive decisions on rework, enhanced inspection, field campaigns, or customer notifications. In highly regulated environments, the applicable authority, OEM, or prime contractor may have specific requirements for such evaluations.

    7. Decide disposition under MRB / equivalent governance

    Disposition decisions must go through the appropriate review board (e.g., MRB) or delegated authority:

    • Do not return suspect counterfeit parts to service, even if they appear functional, unless a higher-level authority explicitly approves with documented justification.
    • Consider destructive testing or enhanced verification for a sample if this will materially improve confidence and supports decision-making.
    • Document final disposition (scrap, return to supplier, retain for evidence) with clear instructions on physical destruction when applicable.
    • Ensure ERP/MES status matches physical reality so quarantined or scrapped parts cannot be accidentally re-issued.

    For confirmed counterfeit parts, many organizations require irreversible destruction and photographic or witness evidence, consistent with contracts and local regulations.

    8. Determine external reporting and customer communication

    Whether and how you report externally depends on your sector, contracts, and regulatory environment. Common cases include:

    • Customer notification when impacted parts may exist in customer inventory or fielded equipment.
    • Prime/OEM notification where flow-down requirements or quality clauses mandate disclosure of counterfeit suspicions.
    • Industry or regulatory databases / reporting channels where applicable, as required by local law, sector guidance, or specific contracts.

    Legal and compliance teams should be involved in drafting communications. This content should be factual, traceable to your records, and avoid claims you cannot substantiate.

    9. Strengthen controls to prevent recurrence

    After immediate containment and disposition, organizations should treat the event as an input to continuous improvement, not just a one-time anomaly:

    • Perform a structured root cause analysis (e.g., 8D, fishbone, 5-Whys) that considers both internal and supply chain contributors.
    • Review supplier approval and monitoring: approved distributor lists, broker use policies, and supplier scorecards.
    • Update receiving and inspection controls: enhanced verification steps, sampling plans, and training on counterfeit indicators.
    • Strengthen traceability in ERP/MES/QMS so that future incidents can be traced and contained quickly.
    • Review contract language around counterfeit risk, documentation, and recourse with suppliers.

    The outcome should be documented changes to procedures, training, and where appropriate, digital system configuration. These changes must follow your change control and validation processes, especially in regulated environments.

    10. Brownfield system considerations

    Most plants operate with mixed legacy and modern systems, which affects how this process works in practice:

    • Multiple systems: Counterfeit-related holds may require updates in ERP (inventory status), MES (work order holds), and QMS (NCR/CAPA). If integrations are weak, manual reconciliation and clear ownership are essential.
    • Partial traceability: Some facilities can only trace to batch level rather than serial. In those cases, containment zones will be wider, with more conservative risk assumptions.
    • Paper travelers and manual records: Where digital travelers or genealogy are limited, you may need manual record reviews and physical inspections to identify affected units.
    • Change control burden: Tightening controls (e.g., new inspection steps in MES, new receiving workflows, extra data capture for traceability) often requires formal validation and documented change control. Full system replacements just to address counterfeit risk rarely succeed because of the qualification and downtime burdens; incremental, well-isolated improvements are typically more realistic.

    Each site should define a pragmatic process that fits its system landscape, recognizing that high counterfeiting risk with low traceability may require more conservative containment and customer communication strategies.

    11. Clarifying limits and local dependencies

    The exact response requirements can vary significantly:

    • By regulation and sector: Aerospace, defense, and medical devices often have sector-specific guidance, contract clauses, or mandated reporting paths for suspect counterfeit parts.
    • By position in the supply chain: Primes and OEMs may demand immediate notification and joint investigation, while lower-tier subcontractors may be guided more directly by purchase order terms.
    • By data maturity: Plants with well-integrated QMS/ERP/MES can perform tight, targeted containment; those with fragmented data may need to broaden the scope of holds and inspections.

    Organizations should codify their counterfeit response in controlled procedures, train relevant personnel, and periodically drill the process so that when a suspect part is identified, the response is disciplined, traceable, and defensible in audits and customer reviews.