#1- Document Exceptions to Your QMS
Too many companies make exceptions to things under unusual circumstances, but fail to document them. If your procedure says that nonconforming product is to be identified with a red tag, and you decide to allow use of yellow tags due to a temporary shortage of red tags, DOCUMENT who authorized the exception when. An AS9100 auditor has no way of knowing that someone authorized the exception unless it is documented. Management can authorize exceptions to any aspect of their QMS as long as it does not violate an AS9100 requirement. (E.g., even though you could authorize an exception to the type NCP tag your procedure calls out, you could not authorize not identifying NCP at all, since the AS9100 standard requires you to identify it.)