Automotive Supplier Quality: Meeting OEM Requirements Guide

By Josh Brook on October 23, 2026

automotive-supplier-quality-meeting-oem-requirements-guide

For an automotive supplier, passing the IATF 16949 audit is only the starting line. Each OEM adds its own customer-specific requirements, its own PPAP and audit expectations and its own scorecard, and a bad quarter can bring controlled shipping or a hold on new business. Most quality teams track all of this in spreadsheets, portals and email. This guide explains what OEMs ask for and how to keep it visible in one place before a customer has to escalate. See it on a live supplier board in a short supplier quality demo.

AUTOMOTIVE QUALITY PACK · OEM REQUIREMENTS

Know Where You Stand With Every OEM Before They Tell You

The iFactory Automotive Quality Pack keeps your CSR matrix, PPAP, layered process audits, traceability and customer scorecards in one system. AI watches the signals together and alerts you when escalation risk is rising.

OEM B scorecard · Plant 2Risk rising
Rolling 3 months · illustrative values
PPAPLPA8DCSR rev. checked
Delivered PPM38 · target 25
On-time delivery99.2%
Open concerns2 · one 8D past D4 date
LPA, Line 4Same torque finding 3 times
Escalation risk alert sent to the quality manager
OEM QUALITY REQUIREMENTS

Three Layers of Requirements on Every Part You Ship

An automotive QMS is built in layers. IATF 16949 sets the common base for the whole sector. The core tool manuals from AIAG and VDA explain how to plan, approve and control a process. On top sit each customer's own requirements, which often decide what an auditor or a supplier quality engineer actually checks. Sort out which layer each rule comes from with our automotive quality team.

Layer 1
IATF 16949The sector QMS standard, used with ISO 9001. The same for every customer.
Layer 2
Core toolsAPQP, PPAP, FMEA, control plans, MSA and SPC from AIAG, or VDA volumes for German OEMs.
Layer 3
Customer-specific requirementsEach OEM's additions and changes. They differ by customer and are revised often.
CSR MATRIX

Customer-Specific Requirements, Mapped in One Matrix

IATF 16949 clause 4.3.2 says customer-specific requirements shall be evaluated and included in the scope of your QMS. Most suppliers do this with a CSR matrix: one row per requirement, one column per customer, and a pointer to the procedure that meets it. The IATF Global Oversight site publishes CSRs for its member OEMs, including GM, Ford, Stellantis, BMW, Mercedes-Benz and Volkswagen, and they are revised regularly. The rows below are a generic illustration, so always work from the current CSR documents. Build your own matrix in a CSR mapping session.

Requirement topic
Customer A
Customer B
Customer C
Where we meet it
Part approval
AIAG PPAP, Level 3
Own PPAP requirements
VDA 2 PPA
Launch procedure QP-07
FMEA method
AIAG-VDA handbook
AIAG-VDA handbook
AIAG-VDA handbook
FMEA procedure QP-05
Layered process audits
Required, set checklist
Required
Not stated
LPA plan by line
Problem solving format
8D in customer portal
8D, set response times
8D
Concern procedure QP-12
Escalation notices
Tell certification body of special status
Customer portal only
Supplier manual
Escalation procedure QP-14
Record retention
Per CSR
Per CSR
Per CSR
Records matrix QP-02
PPAP REQUIREMENTS

The 18 PPAP Elements and the 5 Submission Levels

The AIAG PPAP manual, 4th edition, lists 18 elements that show your process can make the part to drawing at rate. The customer decides how many are submitted. Level 3 is the usual default, and some OEMs now publish their own PPAP requirements, so check the CSR first. Ask our PPAP specialists how a submission is assembled.

1Design records
2Engineering change documents
3Customer engineering approval
4Design FMEA
5Process flow diagram
6Process FMEA
7Control plan
8Measurement system analysis
9Dimensional results
10Material and performance tests
11Initial process studies
12Qualified lab documentation
13Appearance approval report
14Sample production parts
15Master sample
16Checking aids
17Customer-specific requirements
18Part submission warrant
Level 1
Warrant only
Level 2
Warrant, samples and limited data
Level 3
Warrant, samples and complete data. The usual default
Level 4
Warrant and other items the customer defines
Level 5
Complete data reviewed at your plant
AIAG AND VDA CORE TOOLS

Two Toolkits, One Shared FMEA

North American OEMs mostly follow the AIAG manuals, while German OEMs work from VDA volumes. The two now share one FMEA method: the AIAG-VDA FMEA Handbook from 2019 uses a seven-step approach and Action Priority in place of the old RPN. AIAG also made the control plan a standalone manual, CP-1, in 2024, which adds a safe launch phase. Plan a mixed customer base in a core tools review.

AIAG path · GM, Ford, Stellantis
  • APQP manual for launch planning
  • PPAP 4th edition for part approval, plus OEM PPAP CSRs
  • AIAG-VDA FMEA Handbook for DFMEA and PFMEA
  • CP-1 control plan, with safe launch controls
  • CQI-8 for layered process audits
VDA path · German OEMs
  • VDA 2 PPA for production process and product approval, now risk based
  • VDA 6.3 process audit, elements P2 to P7 scored, P1 for potential analysis
  • VDA 6.3 rating: A at 90% or more, B at 80 to 89%, C below 80%
  • Same AIAG-VDA FMEA Handbook
  • Customer portals for approvals and concerns

See Escalation Risk Before the Customer Does

iFactory reads your scorecards, open concerns, LPA findings and PPAP status together. When the signals stack up for one customer, it alerts the quality manager and shows what to close first.

Plant 2 · Quality manager and iFactory
Quality managerWhy is OEM B flagged this week?
iFactoryPPM is above target two months running, one 8D is past its D4 date, and LPAs on Line 4 found the same torque issue three times.
Quality managerWhat do we close first?
iFactoryThe 8D. Its root cause points to the same torque step, so verifying it should also clear the LPA finding.
AUTOMOTIVE SUPPLIER QUALITY BEST PRACTICES

Layered Process Audits That Find Problems Early

A layered process audit is a short, frequent check that the key controls are in place while the work runs. AIAG's CQI-8 guideline, now in its 2nd edition, describes audits by several layers of management, from line supervisors to senior leaders, with frequency rising the closer the auditor is to the floor. The cards below show a typical cadence, not a CQI-8 rule; your customer may set its own. The best checklists come from your PFMEA and control plan, and findings are closed fast. Set up your audit layers with our support team.

Shift
Line supervisorsShort checklist on high-risk steps, error-proofing and work instructions, every shift
Week
Area and quality managersSame core questions plus reaction plans, gauges and containment, on a weekly cycle
Month
Plant leadershipFewer questions, focused on repeat findings and whether actions really closed
Rotate
Question rotationQuestions follow recent concerns and PFMEA high priorities, so the audit stays fresh
CONTROLLED SHIPPING LEVEL

The Escalation Ladder Every Supplier Wants to Stay Off

When quality slips, OEMs escalate in steps. Names and rules differ by customer, but the pattern is similar. In Controlled Shipping Level 1, the supplier adds its own extra inspection, separate from production. In Level 2, a third party approved by the customer inspects, at the supplier's cost. GM's CSR asks suppliers to tell their certification body within 5 business days of CS2 or a New Business Hold, and a hold leads to suspension of the IATF certificate. Review your exposure in an escalation risk review.

1Scorecard warningPPM, delivery or warranty off target
2Formal concern8D requested with response dates
3Controlled shipping 1Supplier's own extra inspection and data
4Controlled shipping 2Third-party inspection, paid by the supplier
5New Business HoldNo new programs until the issue is resolved
Typical exit evidence

Customer and Tier 1 instructions commonly ask for a confirmed root cause, a set period with no recurrence, the fix applied to similar parts, PFMEA and control plan revised, and written exit approval from the customer.

AUTOMOTIVE SUPPLIER QUALITY SOFTWARE

The Scorecard Measures OEMs Watch

IATF 16949 asks you to monitor customer satisfaction through indicators such as delivered part quality, customer disruptions, field returns and warranty, delivery performance and customer notifications on quality or delivery. OEM scorecards report the same themes, each with its own formula and weighting. PPM is defective parts divided by parts shipped, times one million. Track them all together with help from our scorecard specialists.

Delivered PPMRejected parts per million shipped, by customer and plant
Customer disruptionsLine stops, yard holds and sorts at the customer plant
Warranty and field returnsClaims and returns traced to your parts
Delivery performanceOn-time, complete shipments, plus premium freight
Concern response8D steps closed on time against the customer's dates
Special statusAny controlled shipping or hold now open
TRACEABILITY

Trace a Suspect Lot in Minutes, Not Days

When a concern arrives, the first question is how many parts are suspect. Good traceability keeps that number small. IATF 16949 expects a traceability plan based on product risk, and safety parts often need traceability down to the individual part. Each part or lot should link back to material, process and checks, and forward to the shipment. Test a trace on your own data in a traceability demo.

01
MaterialSupplier lot, heat or batch, and the incoming certificate
02
ProcessMachine, tool, key parameters, shift and operator
03
ChecksIn-process results, gauge used, LPA and first-off checks
04
ShipmentContainer, ship notice, customer plant and date
8D PROBLEM SOLVING

What Every 8D Record Should Hold

The 8D method began at Ford in the 1987 Team Oriented Problem Solving manual, and Ford's Global 8D later added a D0 step for preparation and emergency response. AIAG's CQI-20 guide covers effective problem solving more broadly. Most OEMs still ask for an 8D on every formal concern. Ask our support team for an 8D template.

D1 · TeamOwner and cross-functional members
D2 · ProblemWhat, where, when, how many, against spec
D3 · ContainmentSuspect lots, sort results, clean point
D4 · Root causeOccurrence and escape causes, verified
D5 · Chosen fixPermanent action and proof it works
D6 · ImplementDone, validated, containment ended
D7 · PreventPFMEA, control plan, similar parts
D8 · CloseCustomer approval and team recognition
AUTOMOTIVE SUPPLIER QUALITY EXAMPLES

Three Situations Where Linked Data Changes the Outcome

These are illustrations of typical situations, not case studies. Your own CSRs and procedures decide the real response. Walk through a recent concern in a concern review.

CSR revision published
Gap found in the matrixA customer revises its CSR. The changed row is flagged, the owner is asked to check the procedure and the matrix records the date.
Repeat LPA finding
Linked to an open concernThe same torque check fails on three audits. It is matched to an open 8D, so the fix is verified at that step.
Field claim on one date code
Scope set by traceabilityThe trace shows which tool and material lot were used, so containment covers those lots instead of a full month.
AUTOMOTIVE SUPPLIER QUALITY COST AND ROI

A Time Worksheet With Assumed Inputs

The largest gains, avoiding controlled shipping or a hold, are hard to price and should not be inflated. Start with the time your team spends finding records. Every input below is assumed, so replace each one with your own figures. Our team can help you build the full case.

Formal concerns per year12, assumed
Hours per concern spent finding trace and audit records16, assumed
LPAs per month and paperwork minutes each120 and 10, assumed
Concern search time per year12 × 16 = 192 h
LPA paperwork per year120 × 10 × 12 ÷ 60 = 240 h
Hours to review against your own baseline192 + 240 = 432 h per year

Multiply the hours you can actually save by your loaded labour rate. Then add tighter containment scopes, fewer late 8D steps and less premium freight, using your own history.

TURNKEY AI DEPLOYMENT

Quality Records, AI Alerts and NVIDIA Server in One Package

iFactory delivers the Automotive Quality Pack as a turnkey bundle. A pre-configured NVIDIA AI server ships racked and ready with the escalation risk models and quality workflows pre-loaded, so plant data stays on site. You rack it, plug in power and Ethernet, and the AI is live. To scope it for your plants, request a turnkey quote.

What's Included
  • Pre-configured NVIDIA AI edge server, racked and ready
  • CSR matrix with revision tracking per customer
  • PPAP workspace for all 18 elements and 5 levels
  • LPA checklists by layer, with mobile audits
  • Lot and part traceability linked to MES data
  • Scorecard and 8D tracking with escalation risk alerts
  • 24×7 remote monitoring of models and hardware
Live in 6–12 weeks
Wk 1–4
Map and Connect

CSRs mapped for your top customers, MES and ERP data connected, server installed.

Wk 5–8
Load and Pilot

Open PPAPs, concerns and LPA plans loaded, one plant runs the new workflow.

Wk 9–12
Go-Live and Training

Risk alerts switched on, quality and plant teams trained, scorecards reviewed monthly.

HOW iFACTORY FITS

Supplier Quality Built Around Your OEMs

iFactory keeps every customer's requirements and every signal in one place, so your team spends time fixing problems instead of finding records. Our support team can walk you through a pilot plan.

1
Keeps the CSR matrix current. Each customer's requirements are mapped to your procedures and owners.
2
Runs PPAP and LPA. Submissions, audit layers and findings are tracked to closure.
3
Traces lots and parts. Material, process, checks and shipments are linked for fast containment.
4
Alerts on escalation risk. AI reads scorecards, concerns and audits together and warns early.
1000+
Industrial clients running iFactory
99.9%
Platform uptime for multi-shift plants
6-12 wks
From racked server to live risk alerts
FREQUENTLY ASKED QUESTIONS

What Quality Managers Ask About Meeting OEM Requirements

What are customer-specific requirements in IATF 16949?
They are each customer's additions to IATF 16949 and the core tools. Clause 4.3.2 requires them to be evaluated and included in the scope of your QMS. IATF member OEMs publish theirs on the IATF Global Oversight site, and other customers usually set them out in supplier manuals or portals.
What is the difference between CS1 and CS2?
In Controlled Shipping Level 1, the supplier adds its own extra inspection, separate from production, to stop defects reaching the customer. In Level 2, a third party approved by the customer does the inspection at the supplier's cost. Exact rules vary by OEM, so check each CSR.
What is a New Business Hold?
It stops a supplier from being awarded new business until a serious quality issue is resolved. Under GM's CSR, the supplier must notify its certification body, which suspends the IATF 16949 certificate until a special audit confirms the fix.
Which PPAP level should we expect?
Level 3 is the usual default, with the warrant, samples and complete supporting data. The customer can ask for any level, and some OEMs publish their own PPAP requirements, so the CSR decides.
Do German OEMs accept AIAG PPAP?
Usually they expect VDA 2 PPA and VDA 6.3 process audits instead. The FMEA method is shared through the AIAG-VDA handbook. Many suppliers keep both paths in the same system.
Is there an implementation guide for getting started?
Start with your two or three largest customers. Build the CSR matrix for them, load open PPAPs, concerns and LPA plans, then connect traceability and scorecards. Our support team can share a step-by-step implementation guide.

Stay Ahead of Every OEM Scorecard

Keep CSRs, PPAP, LPAs, traceability and scorecards in one system, and let AI warn you when escalation risk rises. Delivered turnkey and live in 6 to 12 weeks.

Example supplier quality board · Plant 2
CSR matrixMapped for every active customer
PPAP and LPAOpen items tracked to closure
TraceabilityLot and part links ready
ScorecardsRead together with concerns
Escalation risk flagged early, by customer

Share This Story, Choose Your Platform!