OASIS database (IAQG): supplier registration step by step

To get registered in the IAQG OASIS database, an aerospace supplier is audited by an accredited certification body to AS/EN 9100, 9110 or 9120; appoints an OASIS administrator before certification; and lets the certification body enter the certificate (public "Tier 1" data) and the audit results (private "Tier 2" data) in OASIS. The supplier then manages its own users and decides who may see its audit details, with one important limit: aviation, space and defence customers and authorities must get access on request unless the supplier can justify refusing. There is no route for a company to list itself.

This guide sets out the steps, who does what, what it costs and the mistakes that delay a listing.

What is OASIS, and why do customers check it?

OASIS, the Online Aerospace Supplier Information System of the International Aerospace Quality Group (IAQG), is the register of suppliers certified under the IAQG scheme to the 9100-series quality management standards. The OASIS guidelines manual explains that it was built to give easy access to aerospace quality management system data, and that it also lists the national accreditation bodies, the certification bodies and the authenticated aerospace experienced auditors.

For a buyer at an aerospace or defence company, OASIS answers two questions in a minute: does this supplier hold a valid 9100-series certificate issued under IAQG rules, and how have its audits gone? A certificate PDF from a supplier can be outdated or not issued under the scheme at all. An OASIS record cannot be entered by the supplier, which is why buyers trust it.

The system has been rebuilt since that manual was written, so screens and menu names differ, but the roles and the logic described below are the same. Your certification body will show you the current screens when it sets up your administrator.

Who enters what in OASIS?

OASIS is built in layers. The older OASIS guidelines manual, published by the Spanish aerospace association TEDAE, describes the chain, which still explains the logic:

The manual notes that a certification body cannot enter supplier data until its accreditation body has entered it, and that in some countries a national aerospace industry association reviews or enters data before it is published. Each level can only act on the data it is responsible for.

The practical consequence: choose an accredited aerospace certification body. A body that is not in OASIS cannot put you there, however good its audit.

What are Tier 1 and Tier 2 data?

BSI's client guide to the IAQG scheme rules explains the split that AS/EN 9104/1 requires:

The certification body uploads both, together with supporting documents defined by AS/EN 9101, such as audit reports, the process effectiveness assessment report, nonconformity reports, the QMS matrix report and the audit plan.

Certified suppliers must, according to the same guide:

• allow the certification body to provide both Tier 1 and Tier 2 data to OASIS;
• give their aviation, space and defence customers and authorities access to their Tier 2 data on request, unless there is a justification such as competition, confidentiality or a conflict of interest;
• notify those customers immediately if they lose their certification;
• notify the certification body of significant changes, such as address, ownership, key management, headcount, scope or customer contract requirements.

DQS sets out the same duties in its aerospace annex, where the client agrees to allow audit data to be entered into OASIS and to give customers and authorities access to its Tier 2 data.

OASIS registration, step by step

Step 1: choose the right standard and an accredited certification body

The 9100 series has three main standards: AS/EN 9100 for organisations that design or manufacture, AS/EN 9110 for maintenance organisations and AS/EN 9120 for distributors. DQS lists them, applied together with AS/EN 9101, which sets the audit requirements. Ask each certification body you consider whether it is accredited for your standard and listed in OASIS. Our guide on AS9100 certification for a small company covers what the standard itself asks.

Step 2: agree your certification structure

DQS notes that every client must be identified under one of the five certification structures defined in AS9104/1 or EN 9104-001. In plain terms, this records whether you have one site, several sites or a central function with sites, and it determines how your certificate and sites appear in OASIS. Settle it in the quotation stage; changing it later means modifying the certificate.

Step 3: appoint an OASIS administrator before the initial audit ends

This is the step most small companies miss. BSI requires an OASIS database administrator and supplier representatives to be appointed before the initial audit is completed; DQS says the administrator must be identified and entered in OASIS before certification. The two roles:

Name a deputy as well. BSI warns that it cannot upload and publish your certificate, at initial certification, recertification or modification, without an active administrator, and that it may suspend certification or delay recertification if you fail to keep one.

Step 4: create the user accounts

Your certification body sets up the administrator; once in place, the administrator can add or change administrators and supplier representatives under "Manage" then "Organization Users", according to BSI.

Step 5: audit and certification

The certification body audits you to the chosen standard. Nonconformities must be closed in time: DQS gives 60 days from the nonconformity report, after which certification can be suspended without advance notice. BSI also notes that the AS/EN 9101 documentation takes more audit time than earlier versions, typically an extra half day to a day and a half per auditor depending on size and complexity.

Step 6: the certification body publishes your record

After a positive certification decision, the certification body enters your certificate and audit data in OASIS. From then on, your company appears in the certified supplier search with its certificate details, and Tier 2 data is available to those you authorise.

Step 7: keep the record alive

• Grant view access to customers who ask for it; BSI notes that view-only access can be granted to any IAQG OASIS user.
• Keep company data current. BSI says the certified organisation is responsible for the correctness of its organisation data in OASIS, whoever enters it, while the certification body is responsible for audit and certification data.
• Log in regularly: BSI says OASIS accounts go inactive after 18 months without activity.
• Replace the administrator immediately when that person changes role or leaves.

What does an OASIS listing cost?

The IAQG charges for database entries, and certification bodies usually pass the fees on. BSI's guide lists the rates it applies:

BSI notes that these rates include a $50 processing fee it may charge. They come on top of the certification body's own audit fees, so ask for both in the quotation.

What else does an OASIS-listed supplier sign up to?

Being in the IAQG scheme brings duties beyond OASIS itself. BSI's guide lists several that surprise first-time suppliers:

• Audit reports to customers. You must provide copies of audit reports and related records to customers and potential customers on request, unless a reasonable business justification is agreed with the certification body. You can do this through OASIS or by sending the report directly.
• Witnessed audits. As AS/EN 9104/1 requires, you must permit access by regulatory authorities, accreditation body representatives, other party assessors, customer representatives or IAQG member manufacturers, who may join the audit team as observers. Refusing a witnessed audit by an accreditation body can lead to withdrawal of the accredited certificate.
• Regulator issues. You tell the certification body about any notification or revocation from a regulator, such as a civil aviation authority, that may affect your quality system.
• Auditor rotation. The certification body assigns and rotates aerospace auditors as AS/EN 9104/1 requires.

DQS adds two more: you disclose your top five customers before each registration and each later audit, and an unresolved customer complaint can trigger a short-notice audit, completed within 90 calendar days of the complaint.

Changing certification body later is possible, but BSI notes that a transferring client must grant the new body access to its OASIS records, so it can review earlier audit and nonconformity reports and check that all previous nonconformities were closed. Your OASIS history follows you.

How do buyers use OASIS, and how should you?

A buyer typically searches certified suppliers by name, country or certification body, and by standard. The manual describes the search options, including filters by standard and a choice between "starts with" and "contains" when searching by name. If the buyer has been granted access, it can also see the assessment history and audit details.

Use the same search for your own purposes:

• Check competitors and partners. Who in your region holds AS/EN 9100 for your type of work?
• Check your own suppliers. If you subcontract special processes or parts for aerospace work, verify their certificates in OASIS rather than relying on a PDF.
• Check certification bodies and auditors. OASIS lists accredited certification bodies and authenticated aerospace auditors.

Common mistakes

• Choosing a certification body that is not accredited for aerospace. Your certificate will not appear in OASIS.
• No administrator at the end of the initial audit. The certificate cannot be published.
• One administrator and no deputy. When that person leaves, the record is stuck.
• Refusing Tier 2 access without a reason. The rules expect access for customers and authorities on request.
• Forgetting to tell customers about a lost certificate. The notification must be immediate.
• Letting accounts lapse. Accounts go inactive after 18 months without activity.

Where does FADEC fit?

FADEC brings together aerospace, space and defence companies in Flanders. Members compare notes on certification bodies, audit preparation and customer requirements. See membership, or contact us. If certification is part of a wider plan to supply a prime, read our guide on getting introduced to Airbus procurement, which lists the quality requirements Airbus names.

Quick answers

What is the OASIS database? The Online Aerospace Supplier Information System of the IAQG: an online list of suppliers certified or registered under IAQG rules to the 9100 series, with the accreditation bodies, certification bodies and authenticated aerospace auditors.

Can a supplier register itself in OASIS as certified? No. The certification body that audited the supplier enters the certificate and audit data. The supplier appoints an OASIS administrator, who manages company data, users and access to audit results.

What does an OASIS listing cost? BSI's client guide lists the IAQG fees it passes on as $750 for each initial certification, recertification and transfer audit and $350 for each certificate modification, including a $50 processing fee, plus IAQG digital innovation fees.

Who can see my audit results in OASIS? Certificate data (Tier 1) is public. Audit results, nonconformities and scores (Tier 2) are private; the supplier grants access and must give it to its aviation, space and defence customers and authorities on request unless it can justify refusing.

What happens if my OASIS administrator leaves? Appoint a new one at once. BSI says it cannot upload a certificate without an active administrator, and that OASIS accounts go inactive after 18 months without activity.