AS9120B · Clause 4.3

AS9120B scope exclusions: what a distributor can exclude, and how to justify it.

Most AS9120B scope statements get this wrong in one of two directions. Some “exclude” clauses that were never in AS9120B to begin with. Others exclude a requirement the business plainly performs, under a one-line justification that restates the company's job title.

This page goes through what clause 4.3 actually allows, which clauses a stockist distributor can defend as not applicable, which ones it usually can't, and how to write the justification. Written by a practicing aerospace QMS auditor.

First, what the standard actually says

AS9120B doesn't say “exclusions”. It says applicability.

Annex A.5 is explicit that the standard no longer refers to exclusions. Clause 4.3 does the work instead, and it sets three conditions.

  1. The scope is documented and maintained. It states the types of products and services the QMS covers.
  2. Every requirement determined not applicable carries a justification. One per requirement, not one blanket sentence at the end.
  3. The decision can't touch conformity. You can only claim conformity to the standard if the requirements you set aside don't affect your ability, or your responsibility, to make sure what you deliver conforms and to enhance customer satisfaction.

The third condition is the one an auditor tests. The practical version is a single question: if we applied this requirement, would it change whether the part we ship is the part the customer ordered, in the condition they ordered, with the paperwork they're owed? If the honest answer is “possibly”, the requirement applies.

Not restricted to clause 8 — but that's where it lives

Clause 4.3 speaks of “any requirement of this International Standard”. The old ISO 9001:2008 rule confining exclusions to one clause is gone. In practice, though, clauses 4, 5, 6, 9 and 10 describe how any organization runs a management system, and a justification for setting one of them aside is very hard to write. Nearly every defensible determination sits in clause 8, plus the conditional monitoring-and-measuring requirement in 7.1.5 discussed below.

Before you exclude anything

Check it's in AS9120B at all.

The single most common error in a distributor's scope statement is justifying the exclusion of a requirement AS9120B doesn't contain. It happens because the scope was adapted from an AS9100D or AS9110C template, and it tells an auditor exactly that.

8.1.1 · 8.1.3

Marked (Not Used)

Operational risk management and product safety are AS9100D and AS9110C clauses. AS9120B keeps the numbers, so the rest of clause 8 lines up with its siblings, and marks both (Not Used). Product safety still appears as something to consider when determining requirements, in the note under 8.1(a), but not as a clause of its own.

8.1.6

Not in the standard

Installation of approved parts is AS9110C, for maintenance organizations. There is no 8.1.6 in AS9120B.

8.5.1.2 · 8.5.1.3 · 8.5.1.4

Not in the standard

Special processes, production process verification (the first article inspection clause) and new capability evaluation belong to AS9100D and AS9110C. Under 8.5.1, AS9120B has only 8.5.1.1, control of equipment, tools and software programs.

None of these needs a justification, because none of them was ever a requirement. On an AS9101 Form 2 process matrix they carry the applicability letter for AS9120 before any evaluation happens — how Form 2 separates applicability from conformity.

The one the standard anticipates

Design and development, 8.3 — usually defensible, but not automatically.

AS9120B puts a note directly under 8.3 pointing to 4.3 and Annex A.5, and A.5 says it plainly: distribution organizations may not typically need design and development, but ISO 9001:2015 extended design and development to services, so the clause stays in the standard and the organization determines whether it applies.

That second half is what a thin justification misses. “We don't design parts” covers product. It says nothing about services. If the business develops something new for a customer against their requirements — a kitting program, a packaging and preservation specification, a managed-inventory arrangement built to a contract — ask whether that is design and development of a service before calling 8.3 not applicable. Often it isn't; but the justification should show the question was asked.

What distributors try to exclude

And usually can't.

Each of these turns up on distributors' scope statements. Each is usually a finding waiting to happen, for a reason that's in the clause's own text.

7.1.5

Monitoring and measuring resources

This requirement is conditional by its own wording: it applies when monitoring or measuring is used to verify that product conforms. If receiving inspection uses a caliper, a thread gauge or a counting scale, it applies to those. If nothing is measured at all, say so specifically — and check that's still true of the receiving bench.

8.5.1.1

Equipment, tools and software programs

“We have no production equipment” is the usual justification, and it answers the wrong question. The requirement covers equipment, tools and software used to automate, control, monitor or measure processes. A distributor's inventory system controls traceability and lot status; a label printer carries identification. Read it against what you actually run before setting it aside.

8.5.3

Customer and external-provider property

Consigned stock. Customer-owned parts returned for credit or investigation. Customer drawings and specifications. The standard's note includes intellectual property and personal data. A distributor with none of these is unusual.

8.5.5

Post-delivery activities

The lettered list (a) to (f) is what you consider when deciding how much post-delivery activity is needed — AS9120B adds (f), product and customer support. Then comes a flat requirement: when problems are detected after delivery, act, including investigation and reporting. A suspect part found after it shipped is that case exactly.

8.1.2

Configuration management

Written “as appropriate to the organization”, which scales it — it does not remove it. Shipping the revision and condition the customer ordered, and documentation that matches the part, is configuration control for a distributor.

8.5.1

“As applicable” is not a 4.3 exclusion

8.5.1's list of controlled conditions opens with “as applicable”. Process validation under (f), for instance, may have nothing to act on in a pure stockist. That is the clause scaling itself, not a scope determination, and it doesn't belong on the scope statement as an exclusion of 8.5.1.

And never these

Counterfeit parts prevention (8.1.4), suspected unapproved parts prevention (8.1.5), identification and traceability (8.5.2) — including the split-product records AS9120B adds — preservation and shelf life (8.5.4), and release with the accompanying documentation (8.6). These are what AS9120B is for. A scope statement that sets one aside has usually misread its own business.

Writing the justification

Five parts, and none of them is the job title.

  1. The fact. What the organization does and does not do, in terms an auditor can check on the floor.
  2. The consequence. Why the requirement therefore has nothing to act on.
  3. The adjacent control. Where the nearby risk is handled instead, if there is one — for example, a special process a customer order requires is bought from an approved source and controlled under 8.4.
  4. The obligation check. That no customer contract or regulatory requirement obliges the activity anyway.
  5. The trigger. The change that would make the requirement apply again, so the next management review knows to look.
Won't hold

8.3 — “Not applicable. We are a distributor.”

Restates the company's category. Says nothing about services, nothing about customer requirements, and gives the auditor nothing to verify.

Holds

8.3 — a justification with all five parts

“The organization purchases and resells parts built to the original manufacturer's design and approved data, and does not create or modify product designs. Services are limited to order fulfilment, storage, preservation and shipment to established procedures; no service is developed to a customer's specification. No current contract or regulatory requirement obliges design activity. This determination is reviewed at management review, and immediately if a kitting, modification or customer-specified service program is proposed.”

The justification lives in the scope, which is maintained documented information. It's worth keeping it next to the determination it supports rather than in a separate memo, and revisiting both whenever the business changes what it sells — the new product line is when a stale exclusion turns into a finding.

How JBird handles it

An applicability assessment, not a paragraph.

JBird lists the clause 8 requirements for the standards you've selected — a distributor that selects AS9120B isn't offered clauses AS9120B doesn't have. Marking a requirement Not Applicable opens a required justification field, and it stays flagged until one is written. Where a requirement is a lettered list you can set aside individual items, which leaves the clause Partially Applicable rather than pretending it is all or nothing. The scope statement is generated from that assessment, so the document and the record can't disagree.

Common questions

What distributors ask about scope exclusions.

Can an AS9120B distributor exclude clauses from its QMS?

Yes, with conditions. Clause 4.3 lets an organization determine that a requirement is not applicable, provided the scope gives a justification for it and the decision does not affect the organization's ability or responsibility to ensure its products and services conform and to enhance customer satisfaction. AS9120B no longer uses the word "exclusions" for this — Annex A.5 calls it applicability — but auditors and distributors still say it.

Which clauses can a stockist distributor usually justify as not applicable?

Design and development, clause 8.3, is the one AS9120B itself anticipates: Annex A.5 says distribution organizations may not typically need it, and leaves the decision to the organization. Because design and development also covers services, the justification has to address services as well as product.

Do I need to justify excluding operational risk, product safety or installation of approved parts?

No. In AS9120B, 8.1.1 and 8.1.3 are marked (Not Used), and installation of approved parts, special processes, production process verification and new capability evaluation do not appear at all. There is nothing to determine not applicable. Listing them as exclusions in a scope statement usually means it was written from an AS9100D or AS9110C template.

Can a distributor exclude 8.5.3 customer property or 8.5.5 post-delivery activities?

Rarely. Consigned stock, customer-owned returns, customer drawings and customer personal data are all customer property under 8.5.3. And 8.5.5 requires action, including investigation and reporting, when a problem is found after delivery — a suspect part discovered after it shipped is exactly that.

What does a good scope exclusion justification look like?

It states what the organization does and does not do, explains why the requirement therefore has nothing to act on, says where any adjacent risk is controlled instead, confirms no customer or regulatory requirement obliges the activity, and names the change that would make the requirement apply again. "We are a distributor" is not a justification; it is a job title.

AS9120B, AS9100D, AS9110C and AS9101 are published by SAE International and the IAQG. This page explains the requirements in our own words; it does not reproduce the standards, and you need your own licensed copies. JBird is an independent product and is not affiliated with, endorsed by, or accredited by the IAQG, SAE or ISO.

Pilot program

We're looking for a handful of shops to build this with.

45 modules are already built and working. Pilot organizations get the system at no cost during development, direct input on what gets built next — there is a Report a Problem button on every screen, and it goes to a register we work through — and a migration path when the IA9100 revision lands.