IATF 16949:2016 is the automotive quality management standard that every Tier 1 and Tier 2 supplier to major OEMs must maintain. It builds on ISO 9001:2015 and adds automotive-specific requirements — manufacturing process audits, product audits, layered process audits, PPAP, and production part approval processes — that go significantly beyond what ISO 9001 alone requires. This checklist gives U.S. automotive suppliers a structured, clause-mapped internal audit framework covering the key IATF 16949 requirements that registrars and OEM customer-specific requirements (CSRs) most frequently cite as nonconformances.
Major OEM Customer-Specific Requirements
IATF 16949 Cl. 4.3.2 requires organizations to identify and consider all applicable customer-specific requirements in the QMS. Each major OEM publishes its own CSR document that supplements IATF 16949 with additional requirements specific to their supply chain. Failure to identify, document, and flow down applicable CSRs is one of the most common major nonconformances in IATF 16949 surveillance audits.
Requires Ford-specific PPAP requirements, 8D corrective action format, FMEA reference manuals, and specific LPA frequency commitments. Ford Q1 preferred supplier status has additional QMS performance requirements.
Specifies AIAG FMEA 4th or 5th edition, GP-12 early containment, MQS reporting, and specific statistical process control requirements for Significant Product Characteristics.
References AIAG/VDA FMEA methodology, specific PPAP submission levels by commodity, and Supplier Quality Assurance Manual requirements for new product launches and engineering changes.
Requires specific APQP timing milestones, formel Q capability requirements, and BMW-specific product audit frequencies. Assembly supplier requirements include traceability to VIN level.
Digitize IATF 16949 Audits — All Three Types, One Platform
iFactory runs system, process, and product audits with clause-mapped checklists, auto-generated NCRs, and corrective action tracking — built for automotive Tier 1 and Tier 2 suppliers. Book a demo to see it on your automotive QMS.
Three Mandatory IATF 16949 Audit Types
IATF 16949 Cl. 9.2.2.1 requires three distinct types of internal audit — not just a system-level QMS audit. Each type has a different scope, frequency requirement, and evidence standard. Organizations that only conduct system-level audits and omit process or product audits are non-compliant with Cl. 9.2.2.1, regardless of how thorough their system audit is.
Verifies QMS conformance to IATF 16949 and ISO 9001 requirements across all clauses. Conducted annually at minimum. Covers all applicable standard requirements and applicable customer-specific requirements.
Evaluates the effectiveness of all manufacturing processes. Each process audited at a frequency commensurate with process risk. Uses process-specific checklists covering inputs, controls, outputs, and records.
Checks product conformance to customer requirements at appropriate stages of production and delivery. Requires sampling from production or warehouse inventory and checking against engineering specifications.
IATF 16949 Automotive-Specific Requirements
IATF 16949 adds over 60 automotive-specific sub-clauses and notes to the ISO 9001 framework. The table below focuses on the requirements that are most frequently cited as nonconformances in IATF 16949 third-party surveillance audits and OEM customer assessments — the areas where automotive suppliers consistently under-perform relative to the standard.
| Clause | Requirement | Key Audit Questions | Evidence Required |
|---|---|---|---|
| Cl. 4.3.2 | Customer-Specific Requirements | Are all applicable OEM CSRs identified, documented, and flowed down to relevant processes? | CSR register, process controls referencing CSR requirements |
| Cl. 6.1.2.1 | Risk Analysis | Has FMEA been conducted and linked to the control plan? Are high-RPN items actively controlled? | PFMEA, DFMEA (if applicable), control plan cross-reference |
| Cl. 8.3 | Product & Process Design | Are APQP phases documented? Are design reviews conducted with records? Is DFMEA current? | APQP phase records, design review minutes, DFMEA |
| Cl. 8.5.1.1 | Control Plan | Does the control plan cover all PFMEAs and special characteristics? Is it current and at the machine? | Current control plan, revision history, special char. coverage |
| Cl. 8.5.2 | Total Productive Maintenance | Is a documented TPM system in place? Are OEE targets set and tracked? | PM schedules, OEE records, predictive maintenance program |
| Cl. 8.6.1 | Conformance of Product at Delivery | Is there objective evidence that all conformance checks required by the control plan were completed before shipment? | Inspection records, signed traveler, CoC |
| Cl. 8.6.2 | Layout Inspection | Is a full dimensional layout performed per PPAP requirements at the frequency specified in CSRs? | Layout inspection report, frequency documentation |
| Cl. 8.6.5 | Statutory & Regulatory | Are all applicable statutory and regulatory requirements identified and communicated to relevant supply chain? | Regulatory requirement register, supplier communication records |
| Cl. 8.7.1.4 | Controlled Shipping | If controlled shipping is active, is CS1 or CS2 properly documented and executed per OEM requirements? | Controlled shipping records, containment effectiveness evidence |
| Cl. 9.1.1.1 | Manufacturing Process Monitoring | Are statistical methods applied to process control? Are control chart signals acted upon per documented OCAP? | SPC charts, OCAP records, process capability indices |
PPAP & Production Part Approval Checklist
Production Part Approval Process (PPAP) per AIAG standards is a requirement for most IATF 16949 suppliers and virtually all OEM customer-specific requirements. The PPAP submission level (1 through 5) is defined by the customer for each part. Internal auditors must verify that the PPAP package is complete at the correct submission level and that the warrant is signed by authorized quality personnel.
Engineering drawing at the approved revision level, including all notes and referenced specifications.
Design FMEA current at the drawing revision. All high-RPN items addressed with recommended actions.
Complete process flow from receiving through shipment including all operations, rework loops, and inspection points.
Process FMEA linked to the process flow and control plan. Special characteristics identified and cross-referenced.
Covers all special characteristics from PFMEA. References correct measuring equipment. Reaction plans defined for out-of-control conditions.
Gauge R&R completed for all measurement systems used for special characteristics. Results within acceptable limits.
Full dimensional layout on required number of samples. All characteristics measured and recorded as actual values against nominal + tolerance.
All material and functional test results meet engineering specification. Test reports reference correct specification revision.
Process capability indices meet customer requirements (typically Cpk ≥ 1.67 for special characteristics at PPAP).
PSW completed with correct submission level, signed and dated by authorized quality representative. Deviation disposition if applicable.
Major OEM Customer-Specific Requirements
IATF 16949 Cl. 4.3.2 requires organizations to identify and consider all applicable customer-specific requirements in the QMS. Each major OEM publishes its own CSR document that supplements IATF 16949 with additional requirements specific to their supply chain. Failure to identify, document, and flow down applicable CSRs is one of the most common major nonconformances in IATF 16949 surveillance audits.
Requires Ford-specific PPAP requirements, 8D corrective action format, FMEA reference manuals, and specific LPA frequency commitments. Ford Q1 preferred supplier status has additional QMS performance requirements.
Specifies AIAG FMEA 4th or 5th edition, GP-12 early containment, MQS reporting, and specific statistical process control requirements for Significant Product Characteristics.
References AIAG/VDA FMEA methodology, specific PPAP submission levels by commodity, and Supplier Quality Assurance Manual requirements for new product launches and engineering changes.
Requires specific APQP timing milestones, formel Q capability requirements, and BMW-specific product audit frequencies. Assembly supplier requirements include traceability to VIN level.
Digitize IATF 16949 Audits — System, Process & Product
iFactory runs all three IATF 16949 audit types digitally — with clause-mapped checklists, layered process audit scheduling, and auto-generated NCRs. Book a demo to see it on your automotive processes.
APQP Phase Gate Audit Checklist
Advanced Product Quality Planning (APQP) is the structured new product development process that connects customer requirements to PPAP submission. IATF 16949 Cl. 8.3 requires design and development planning — for most automotive suppliers this means executing APQP phases with documented phase gate reviews. Internal auditors must verify that APQP evidence exists and is current for all active new product programs.
Voice of customer captured. Design goals, reliability targets, and preliminary bill of material defined. Preliminary process flow and product/process special characteristics identified. Program timing plan approved by customer.
DFMEA completed and reviewed. Design verification plan and report (DVP&R) executed. Prototype builds completed. Engineering drawings released at correct revision. Design review records retained.
PFMEA completed and linked to control plan. Packaging standards defined. Process flow diagram finalized. Measurement system analysis plan developed. Operator process instructions drafted.
Production trial run completed. Measurement system analysis (Gauge R&R) completed. Initial process capability study (Cpk) meets customer requirements. Production part approval (PPAP) submitted and customer-approved.
Reduced variation documented. Customer satisfaction data collected. Delivery and service experience evaluated. Lessons learned captured and fed back into future APQP programs.
Layered Process Audit Requirements
Layered Process Audits (LPA) are required by most OEM customer-specific requirements — including Ford, GM, Stellantis, BMW, and others — and are considered a best practice under IATF 16949 Cl. 9.2.2.1. LPAs involve multiple levels of management auditing production processes at defined frequencies, with findings tracked and trended to identify systemic issues before they reach the customer.
Daily audits at the workstation. Verifies setup, tooling, visual aids, and critical process parameters are in place and correct at shift start.
Weekly audits covering a broader set of processes. Verifies operator compliance with standard work, control plan adherence, and in-process inspection execution.
Monthly audits with technical depth — SPC compliance, measurement system calibration status, tooling condition vs. maintenance schedule, and process capability trends.
Quarterly audits demonstrating management engagement. Focuses on systemic findings, corrective action effectiveness, and strategic quality objectives alignment.
Why IATF 16949 Suppliers Fail Surveillance Audits
The patterns that produce IATF 16949 surveillance nonconformances are predictable. Most are not caused by quality failures in the products — they are caused by QMS administration failures that are entirely preventable with disciplined execution.
The control plan must be present at the point of use — at the machine or workstation where the operation is performed, at the current revision. A control plan filed in a binder in the quality office, or an outdated version at the machine, is a nonconformance against Cl. 8.5.1.1. Auditors check this by walking to the machine and asking the operator to show the control plan.
IATF 16949 Cl. 4.3.2 requires customer-specific requirements to be identified and considered in the QMS. Most suppliers receive CSRs from multiple OEMs and tier-1 customers, but fail to document which CSRs apply, which processes they affect, and how they are incorporated into the control plan and work instructions. This is one of the most common findings in Ford Q1, GM Supplier Quality, and Stellantis supplier audits.
Measurement System Analysis (MSA/Gauge R&R) is required for all measurement systems used on special characteristics. The most common gap: a new gauge is introduced, it is calibrated, but no Gauge R&R study is performed to demonstrate the measurement system is capable. A calibrated gauge is not necessarily a capable measurement system — MSA and calibration are different requirements addressing different risks.
IATF 16949 Compliance Requires Execution Discipline, Not Just Documentation
Passing an IATF 16949 surveillance audit does not mean your QMS is performing — it means your QMS is documented and evidence of execution exists at the time of the audit. The automotive supply chain holds suppliers to a higher standard: products must conform, processes must be capable, and the QMS must produce objective evidence of both, continuously, between audit cycles.
Digital audit and quality management platforms close the gap between the QMS as documented and the QMS as practiced. When LPAs are scheduled and executed through a digital platform, when control plan compliance is verified daily, when PPAP records are linked to production lot data, and when NCRs are tracked to closure with effectiveness verification — your IATF 16949 compliance becomes a live operational reality rather than an annual audit preparation exercise. Book a demo to see how iFactory supports your IATF 16949 audit program.
IATF 16949 Audit Checklist — 30 Items
Use this checklist for IATF 16949 system, process, and product audits. Each row maps to a clause or automotive requirement.
| # | Checklist Item | Type | Priority | Photo | Required | Critical |
|---|---|---|---|---|---|---|
| 1 | All applicable OEM customer-specific requirements (CSRs) identified and documented | Pass/Fail | High | — | ✓ | ✓ |
| 2 | CSR requirements flowed down to relevant processes — control plans reference CSR | Pass/Fail | High | — | ✓ | ✓ |
| 3 | QMS scope covers all applicable IATF 16949 requirements — exclusions justified | Pass/Fail | High | — | ✓ | ✓ |
| 4 | FMEA linked to control plan — high-RPN items actively controlled | Pass/Fail | High | ✓ | ✓ | ✓ |
| 5 | Risk analysis (FMEA) current — revised when process or design changes occur | Pass/Fail | High | — | ✓ | ✓ |
| # | Checklist Item | Type | Priority | Photo | Required | Critical |
|---|---|---|---|---|---|---|
| 1 | Control plan current at production workstation — covers all special characteristics | Pass/Fail | High | ✓ | ✓ | ✓ |
| 2 | Process flow diagram finalised and matching actual production routing | Pass/Fail | High | — | ✓ | ✓ |
| 3 | PFMEA current and linked to control plan — special characteristics cross-referenced | Pass/Fail | High | — | ✓ | ✓ |
| 4 | TPM system documented — OEE targets set and tracked per Cl. 8.5.2 | Pass/Fail | Med | — | ✓ | — |
| 5 | Conformance evidence complete before product release — CoC signed by QC | Pass/Fail | High | — | ✓ | ✓ |
| 6 | Full dimensional layout performed at PPAP-required frequency per CSR | Pass/Fail | High | ✓ | ✓ | ✓ |
| 7 | SPC applied to critical process parameters — OCAP documented for each chart | Pass/Fail | High | — | ✓ | ✓ |
| 8 | Cpk ≥ 1.33 for standard, ≥ 1.67 for special characteristics — data on file | Numeric | High | — | ✓ | ✓ |
| 9 | Controlled shipping (CS1/CS2) records current if active per OEM requirement | Pass/Fail | Med | — | ✓ | — |
| 10 | Nonconforming product segregated immediately — SCAR issued for systemic failures | Pass/Fail | High | ✓ | ✓ | ✓ |
| # | Checklist Item | Type | Priority | Photo | Required | Critical |
|---|---|---|---|---|---|---|
| 1 | Design records at correct revision — DFMEA current (if applicable) | Pass/Fail | High | ✓ | ✓ | ✓ |
| 2 | Dimensional results on file — all characteristics at actual values vs. nominal | Numeric | High | — | ✓ | ✓ |
| 3 | MSA/Gauge R&R completed for all special characteristic measurement systems | Pass/Fail | High | — | ✓ | ✓ |
| 4 | Initial process study (Cpk) meets customer requirements at PPAP submission | Numeric | High | — | ✓ | ✓ |
| 5 | Part Submission Warrant (PSW) signed by authorized quality representative | Signature | High | — | ✓ | ✓ |
| # | Checklist Item | Type | Priority | Photo | Required | Critical |
|---|---|---|---|---|---|---|
| 1 | LPA schedule documented — Level 1/2/3/4 frequencies defined and followed | Pass/Fail | High | — | ✓ | ✓ |
| 2 | Level 1 (operator/team lead) LPA completion rate meets defined target | Pass/Fail | High | — | ✓ | ✓ |
| 3 | Management level (Level 3/4) LPA records current and available | Pass/Fail | High | — | ✓ | ✓ |
| 4 | LPA findings documented with corrective actions assigned and tracked | Text | High | — | ✓ | ✓ |
| 5 | LPA results trended — systemic findings escalated to quality management | Pass/Fail | Med | — | ✓ | — |
| # | Checklist Item | Type | Priority | Photo | Required | Critical |
|---|---|---|---|---|---|---|
| 1 | System audit, process audit, and product audit all conducted per Cl. 9.2.2.1 | Pass/Fail | High | — | ✓ | ✓ |
| 2 | Internal audit program risk-stratified — high-risk processes audited more frequently | Pass/Fail | High | — | ✓ | ✓ |
| 3 | Management review inputs include quality metrics, customer feedback, CAPA status | Pass/Fail | High | — | ✓ | ✓ |
| 4 | Corrective actions from previous audits verified as effective — NCRs closed | Pass/Fail | High | — | ✓ | ✓ |
| 5 | Customer scorecards reviewed — PPM, warranty, and delivery trends analysed | Pass/Fail | Med | — | ✓ | — |
Frequently Asked Questions
What is the difference between IATF 16949 and ISO 9001?
ISO 9001:2015 is the foundational quality management system standard applicable to any industry. IATF 16949:2016 is an automotive sector supplement that incorporates all of ISO 9001 and adds over 60 automotive-specific requirements — including PPAP, APQP, FMEA requirements, layered process audits, manufacturing process audits, product audits, and customer-specific requirement management. IATF 16949 certification requires ISO 9001 conformance as a baseline. A company can be ISO 9001 certified without IATF 16949 certification, but IATF 16949 certification inherently includes ISO 9001 conformance.
Are layered process audits required by IATF 16949?
IATF 16949 Cl. 9.2.2.1 requires manufacturing process audits but does not specify layered process audits by name. However, LPAs are explicitly required by most OEM customer-specific requirements — including Ford's Q1, GM's Supplier Quality requirements, and Stellantis's supplier standards. Since IATF 16949 Cl. 4.3.2 requires organizations to incorporate applicable customer-specific requirements into the QMS, LPAs are effectively mandatory for any supplier to these OEMs. Even where not explicitly required by a CSR, LPAs are recognized by IATF assessors as a best-practice mechanism for demonstrating Cl. 9.2.2.1 conformance.
How frequently must PPAP be resubmitted?
PPAP resubmission is required when a product or process change occurs that could affect form, fit, function, performance, or reliability. Specific triggers include: changes to material or raw material supplier, changes to the manufacturing process or location, tooling changes that affect product characteristics, and corrections to a previous nonconformance. The applicable customer-specific requirements define the specific triggers and required submission levels. Most OEM CSRs also require periodic PPAP revalidation — typically an annual dimensional layout — even without a process change.
What happens if an IATF 16949 surveillance audit finds a major nonconformance?
A major nonconformance in an IATF 16949 surveillance audit requires a documented corrective action plan submitted to the certification body within a defined timeframe (typically 60 days). The corrective action must include root cause analysis, the specific actions taken, and evidence of implementation. A follow-up audit may be required to verify effectiveness. Multiple major nonconformances or failure to close a major nonconformance within the required timeframe can result in suspension or withdrawal of IATF 16949 certification, which has direct contractual consequences with OEM customers requiring certification as a condition of supply.
How can digital audit software support IATF 16949 compliance?
Digital audit platforms support IATF 16949 compliance by ensuring all three required audit types are scheduled, executed, and documented consistently. For layered process audits, digital platforms enforce frequency requirements, record completion rates, and trend findings across layers and time periods. For system and process audits, clause-mapped checklists ensure full coverage and produce traceable records. NCRs generated from audit findings are tracked to closure with effectiveness verification — meeting Cl. 10.2 requirements. Book a demo to see how iFactory supports your IATF 16949 audit program specifically.
Run IATF 16949 Audits — System, Process, Product & LPA
iFactory loads your IATF 16949 clause checklists, schedules LPAs across all levels, tracks findings to closure, and auto-generates the documented information your registrar needs. Book a 30-minute demo and we will walk through your automotive audit program.
