The Operating Review › Industries › Aerospace and defense › Proposal

What we would go looking for

These are patterns that recur in an aerospace and defense manufacturer, written as things to look for. They are not findings from a named engagement.

1. A NIST SP 800-171 self-assessment score submitted to SPRS with a plan of action behind it that was written to close the gap on paper rather than in the network.
2. ITAR-controlled technical data on a shared drive that is segregated in the policy and reachable in practice.
3. Indirect rate structure built around a program that ended, with the overhead still allocated across work that cannot carry it.
4. Build-to-print parts quoted from standards set several revisions ago, so reported margin by part number is a well-formatted guess.
5. Long-lead material bought against a forecast that moved, sitting as inventory no program will absorb.

The sequence

Five weeks for one operating unit. More units run in parallel rather than in series, so a group does not take five times as long.

• Week 1
  Intake and reconciliation9 requests written for an aerospace and defense manufacturer, alongside the 107 covering the operating spine. We tell you which findings the gaps will limit before any fieldwork starts.
• Weeks 2–3
  Full pass, not a sampleEvery part in scope is read rather than sampled.
• Week 4
  Quantification and challengeEach finding sized, and put to whoever owns it before it is written down.
• Week 5
  Report and walkthroughThe written report, ranked by annual value and by how hard each finding is to act on.

What each week actually involves, what arrives at the end of it, and how we behave while we are in there — written down once rather than repeated on every sector's proposal.

What we need from you

5 core requests written for an aerospace and defense manufacturer, inside the full intake. Anything you do not have can be skipped with a reason — skipping narrows what the review can conclude, and we tell you where before the work starts rather than after.

• Contract register: type, prime, period and value — Firm-fixed-price, cost-plus and T&M carry entirely different exposure.
• Indirect rate structure and provisional billing rates — Overhead, G&A and any fringe pools, with the basis for each.
• AS9100 certificate, last audit report and open findings — Including surveillance audit dates.
• NIST SP 800-171 assessment, SPRS score and POA&M — The score as submitted, and the evidence behind the controls claimed met.
• ITAR registration, export licenses and technical data controls — Including how ITAR-controlled data is segregated in practice, not in policy.

If any of this is already happening

The review is always worth doing and rarely urgent. It becomes urgent when something else is happening — and if one of these is, the sequence above compresses to fit it.

• A CMMC assessment date, which converts a security question into a revenue question
• A prime's supplier scorecard slipping
• A DCAA audit or a questioned cost
• An acquisition approach, where ITAR and CUI handling become diligence items
• A program ending and the overhead built around it staying

Who needs to be in the room

• Signs it: President or CFO
• Will resist it: The quality director, who reasonably fears a second audit — worth telling them what the review is for before they hear it from somewhere else.
• Has been asking for it: The contracts manager, and whoever owns the SPRS score

What it costs

Priced by operating unit — an entity, a location, or a business the accounts are kept separately for. The second unit costs less than the first because by then the intake is built, the chart of accounts is understood and the patterns are known.

Read first, if you would rather

• Aerospace and defense — where loss concentrates
• How the review works
• Ordering terms