MoD Customer Audit: How Defense Manufacturers Prepare for Buyer Inspection (2026)

An MoD customer audit is an inspection of a manufacturer by the customer itself or its authorized representative, conducted before contract award or during contract execution. The goal is simple: verify that the manufacturer is actually capable of fulfilling a defense order consistently, not just holds nicely printed paperwork. In practice, in 2026 such an audit for Ukrainian defense manufacturers is conducted by a representative of the Ministry of Defense of Ukraine, the State Defense Order (ДОТ), Ukroboronprom, or a foreign MoD in the case of direct export contracts — German Bundeswehr, Lithuanian MoD, Polish MON, Canadian DND.

This is a fundamentally different format from an ISO 9001 or AQAP 2110 certification audit. A certification audit answers the question «does your management system meet the standard's requirements». A customer audit answers a different one — «are you specifically, with this staff, this equipment, and these buildings, capable of fulfilling specifically this contract, with specifically these products, in specifically these deadlines». The first looks at the system. The second — at actual capability.

By the way, having an AQAP 2110 certificate doesn't exempt you from a customer audit. The certificate is a strong argument that reduces inspection scope and gives the customer baseline trust, but the MoD makes its final decision based on its own inspection. That's the specifics of the defense industry — the customer always reserves the right to inspect the supplier directly.

The circle of those who fall under an MoD customer audit in 2026 covers practically the entire Ukrainian defense industry. If you're planning serious deliveries, get ready — it's only a matter of when they'll come to you.

First, manufacturers participating in ДОТ tenders for contracts above a certain volume. Here a customer audit is part of supplier qualification, and without a positive verdict the contract won't be signed, even if your bid won on price. In practice, the threshold depends on product type: for ammunition and complex systems a customer audit is required from small contracts, for simpler positions — from larger volumes.

Second, existing MoD suppliers after substantial changes in product, processes, or production site. Launched a new workshop — expect an inspection. Changed the supplier of critical components — expect an inspection. Moved from one drone model to the next generation — expect an inspection. The customer doesn't treat a previous positive verdict as a permanent indulgence.

Third, new manufacturers of drones, UAVs, unmanned ground vehicles (UGV), unmanned surface vessels (USV), FPV interceptors, ammunition, optics, communication systems, and EW. This segment is growing fastest, and this is where the MoD actively inspects suppliers — from small startups that grew out of Brave1 to serial productions of hundreds of people. If you need a deeper breakdown, we have a separate drone manufacturer certification guide with a full roadmap.

Fourth, suppliers to foreign customers. An export contract with Polish MON, Lithuanian MoD, Canadian DND, or through NSPA is almost always accompanied by an audit by the customer or its authorized representative. A foreign MoD sends an inspection team or delegates the inspection to an accredited national body — the format depends on the agreement.

Frequency varies too. For serial suppliers on long-term contracts, customer audits happen regularly — annually or every 18 months. For one-time contracts — once before execution starts. For higher-risk contracts (new products, complex output) — additionally during execution itself, in a progress audit format.

An MoD customer audit isn't a formal reading of procedures — it's a deep check of the manufacturer's actual capability to fulfil the contract. The auditor doesn't ask «what is written», they ask «show me how you do this every day». Six blocks form the core of the inspection — every experienced military inspector knows them, and all of them are checked in every audit.

1. Change and configuration control of the product. The first block where most manufacturers fail. The customer wants to see: is the product baseline fixed, how does the change procedure work, who approves changes and how, how is status accounting maintained — a log of all versions. For a drone manufacturer this means a documented register of firmware, hardware revisions, component swaps. For an ammunition manufacturer — control of the powder lot, casing, fuze, with full history of formulation changes.

2. Material and lot traceability. The second critical block. The auditor takes a random finished product from your warehouse and asks to break it down into components, each — to supplier, lot, acceptance date. Then runs a reverse check: takes a specific lot of a component (e.g. a particular battery lot) and asks to show which products it went into, where those products are now, and when they were delivered to the customer. If there's a break anywhere along the chain — critical nonconformity.

3. Incoming inspection and supplier management. The third block. What happens to components when they enter your warehouse? Is there incoming inspection of critical characteristics, are there records of its results, how are nonconforming lots handled, how is the approved supplier register maintained, is there periodic supplier evaluation with recorded audit reports. The customer is especially attentive to subcontractors — because 70% of quality problems in defense production originate there.

4. Nonconformity and corrective action management (CAPA). The fourth block. The auditor asks to see the nonconformity log for the last 6-12 months. Looks at: are all of them actually recorded (not just the «convenient» ones), is root cause analysis done, are corrective actions implemented, is their effectiveness verified. For critical nonconformities — a formal report in 8D, Ishikawa or Fault Tree Analysis format.

5. Process stability. The fifth block, and here the inspection moves to gemba — to the shop floor. The auditor wants to see that processes are stable all the time, not just for the inspection. Are set parameters maintained (soldering temperature, tightening torques, test regimes), are there records from equipment (not just operator logbooks), are measuring instruments calibrated, are deviations tracked on SPC charts. Any «general preparation for the audit» is spotted instantly.

6. Personnel competence and documentation. The sixth block. Are competence requirements documented for operators of critical processes (welders, solderers, test equipment setters), are there training records, is periodic evaluation done, do internal auditors have formal competence. In practice the auditor may chat with a random operator — and within 5 minutes understand whether the person knows what they're doing or just mechanically repeats an instruction.

We've put together a practical checklist — 30 items across six blocks that you need to have ready before the inspector arrives. This is the minimum without which it's better not to start an MoD customer audit. Each item isn't paper for paper's sake, but a real record that confirms the system actually works.

• Quality policy with direct reference to the defense sector and approved by top management
• Process map of production with control points identified
• Document register with versions and last review dates
• Document change control procedure with approval matrix
• Confidential documentation handling regulation (DRM, access control)

• Production logs with operator signatures and time stamps
• Acceptance test protocols for each lot or series
• Intermediate inspection protocols at critical operations
• Equipment records (logs of soldering stations, thermal profiles, test rigs)
• Process route cards with actual operation completion marks

• Serial numbers on all finished products with a register in ERP or PLM
• Travelers from the first operation through to test
• Batch tracking of critical components linked to serial numbers
• Shipment register linked to customer and delivery date
• Reverse tracking procedure (recall procedure) with simulation training

• Approved supplier list (ASL)
• Supplier contracts with references to technical and quality requirements
• Periodic supplier evaluation (every 6-12 months) with records
• Audit reports of critical-component suppliers (at least one per year)
• Supplier claims log and their response

• Nonconformity log for the last 12 months covering all cases (not just «convenient» ones)
• RCA reports in 8D or Ishikawa format for critical nonconformities
• Corrective action log with responsibles and deadlines
• Records of corrective action effectiveness verification after 30/90 days
• Nonconformity trend analysis with quarterly review

• Competence matrix for critical roles (operators, inspectors, auditors)
• Orders authorizing operators to perform critical processes
• Training protocols with participant signatures and result evaluation
• Periodic competence evaluation records (every 12-24 months)
• Internal auditor certificates with proven competence in defense standards

Across hundreds of projects a stable preparation model has emerged that works both for a 30-person drone manufacturer and a 500-person serial ammunition plant. Five stages, which you can walk fully on your own — or with consultants who know where others tend to break. In total, the path from start to audit itself takes 5-9 weeks, depending on the starting point.

The team walks through a checklist across all six blocks and records actual gaps: what already works, what's documented on paper but isn't executed, what's missing entirely. Risk is rated separately for each block — how critical the nonconformity will be if the inspector finds it. Output: a report with a prioritized action list and a realistic plan. An external readiness diagnostic works well here, because in-house teams often don't see obvious gaps — they're used to how it is.

The longest and most resource-intensive stage. Launching or strengthening the processes that got red status in the diagnostic: building traceability, setting up CAPA, writing the change control procedure, supplier evaluation. For many manufacturers this means standing up a real ERP for the first time, or at least a version-controlled Excel logbook. Often at this stage management system implementation is engaged — to avoid reinventing the wheel and burning months looking for solutions that were standardized long ago.

Once processes are running, you need to assemble evidence of their work. This stage is often underrated: «we have everything, the auditor will come and we'll show it». In practice the inspector has 5-15 minutes to find each record, no more. If your traceability lives in three spreadsheets that the accountant hunts for half an hour, the auditor will conclude «no system». So stage three is record structuring, quick-access catalogue, and staff training on rapid evidence retrieval. If you're planning regular audits, in parallel it's worth thinking about annual support of the system.

External consultants or internal auditors run a full-audit mode pass across all six blocks — staff interviews, record checks, nonconformity simulation, traceability test. They identify residual gaps that weren't caught in the diagnostic and give time to close them before the real inspector arrives. This stage saves the most nerves and money — passing the simulation a week before the audit is significantly cheaper than redoing everything after a failure. Audit support typically covers this block.

The MoD customer audit itself lasts from one day (for a small manufacturer with simple product) to three-five days (for serial production with broad nomenclature). The consultant is on-site with the client's team — helps phrase answers correctly, not volunteer extra information, quickly produce requested records. After the audit — processing of observations, formulating a corrective action plan, preparing replies to the customer. At this stage it helps to have someone next to you who has seen dozens of such audits and knows how best to close each category of observation.

Across hundreds of projects, a clear list of mistakes emerges that repeat over and over. Knowing them upfront, you can save months of preparation and avoid blowing a contract after a failed audit.

1. «Documentation for the audit» instead of real work. The classic trap: two weeks before the audit the team sits down to write nice procedures that didn't exist before. The MoD auditor isn't a certification auditor checking documentation against a standard. They're an inspector who asks operators direct questions and watches how production actually runs. The mismatch between freshly written procedure and actual practice is spotted in 10 minutes on the shop floor.

2. Mismatch between document versions and actual production. On the foreman's desk — a 2023 instruction. In quality's safe — a 2024 version. On the server — a 2025 version. The process engineer works by a verbal arrangement with the shop manager. That's a guaranteed path to a critical nonconformity, because the auditor checks the document actually being used at that moment.

3. Traceability in words, without records. A very common scenario: «of course, we know where every component lot ended up, it's all under control». The auditor picks a specific lot — and within 30 minutes it turns out there are no records, just one operator's memory. Traceability without formalized records doesn't exist for the auditor. If you're planning AQAP 2110, this becomes critical — under that standard traceability is mandatory (more in our complete AQAP 2110 guide).

4. Subcontractors without evaluation and control. «We've worked with this supplier for 5 years, they're trusted». On document request — no contract with technical requirements, no supplier evaluation, no audit report, no procedure for handling defective lots. The MoD customer doesn't accept «trust by acquaintance» as a quality system. Without a formalized Approved Supplier List and supplier control procedure, the audit fails on block three.

5. Nonconformities without root causes. The nonconformity log exists, but the «cause» column reads «operator error» and «corrective action» reads «held additional briefing». That's not CAPA, that's fiction. The auditor in that case asks: «what percentage of your nonconformities in the last 6 months were operator errors?» If 80% — that means a root cause investigation system doesn't exist.

The most critical of these five is the first. The other four can be fixed in 2-4 weeks. «Documentation for the audit» can't be fixed, because the inspector sees it in 10 minutes and loses trust in the entire system for the rest of the audit.

Companies with an implemented ISO 9001 system, and especially with an AQAP 2110 certificate, pass MoD customer audits substantially more easily. It's not magic — it's a shared evidence base. All six blocks of a customer audit already operate inside the AQAP 2110 system: change and configuration control, traceability, subcontractor control, CAPA, process stability, personnel competence — these are almost verbatim the requirements of Edition D Version 1. If your quality system is still a work in progress, start with the complete ISO 9001 certification guide: it covers the baseline that AQAP builds on.

In practice this means three things. First, preparation shrinks from 5-9 weeks to 2-3 weeks — mainly only the evidence documentation and pre-audit simulation stages are needed. Second, an MoD auditor seeing an AQAP 2110 certificate from an accredited CB (Bureau Veritas, TÜV, DNV, BSI) reduces the depth of inspection for blocks covered by certification scope. Third, the internal audits you run for AQAP 2110 can be integrated with customer-audit preparation — same checklist, same staff, same rhythm.

That said, an AQAP 2110 certificate doesn't fully exempt you from a customer audit. The MoD always reserves the right to check actual capability. But the difference between «came and found 15 critical nonconformities» and «came and confirmed what they saw in the certification verdict» is the difference between contract collapse and contract success.

On economics: for a manufacturer planning both AQAP 2110 and regular customer audits, integrated preparation is 30-40% cheaper than two separate cycles. More on budget — in our breakdown of AQAP 2110 certification cost. Ekontrol has been a Bureau Veritas partner since 2014, and we traditionally bundle preparation for certification and customer audits into one project — it's just common sense.