_1762866128417-DS2_OO1j.png)
What IATF 16949 requires
IATF 16949 is the standard for quality management systems in the automotive industry. It is published by the International Automotive Task Force (IATF), a group of vehicle manufacturers and national associations such as AIAG and VDA. Most OEMs require an IATF 16949 certificate from their production suppliers.
IATF 16949 is not a standalone standard: it supplements ISO 9001:2015 with automotive-specific requirements and can only be applied together with it. On top come the customer-specific requirements (CSRs) of each OEM, which are part of the certification audit. Under the IATF rules, certification is carried out only by certification bodies recognised by the IATF.
Additional requirements compared with ISO 9001
| Topic | Clause | What it is about |
|---|---|---|
| Product safety | 4.4.1.2 | Documented processes for safety-related products and processes |
| Customer-specific requirements | 4.3.2 | Evaluate CSRs and include them in the QMS |
| Contingency plans | 6.1.2.3 | Supply continuity when equipment, suppliers, IT or staff fail |
| Competence and awareness | 7.2, 7.3 | Qualification, on-the-job training, internal auditors |
| Product development | 8.3 | APQP, FMEA, control plan, PPAP |
| Supplier management | 8.4 | Supplier selection, development and monitoring |
| Production | 8.5 | Control plan, set-up verification, preventive maintenance |
| Internal audits | 9.2.2 | QMS, manufacturing process and product audits |
| Problem solving | 10.2.3, 10.2.4 | Structured problem solving, error-proofing |
The core tools at a glance
IATF 16949 assumes the use of proven methods, often referred to as core tools. Which specific manuals apply is frequently defined by the customer-specific requirements – for example AIAG or VDA volumes.
| Method | Purpose |
|---|---|
| APQP / product development | Structured planning of product and process up to production approval |
| FMEA | Identify and assess risks in design and process, e.g. per the AIAG-VDA handbook |
| Control plan | Characteristics, inspections and reaction plans for series production |
| PPAP / PPA | Evidence to the customer that product and process are ready for production |
| MSA | Demonstrate the suitability of measurement systems |
| SPC | Monitor processes statistically and demonstrate capability |
How docxpert supports automotive suppliers
Keeping customer-specific requirements under control
Every OEM publishes its own additional requirements – for example on complaint response times, problem-solving formats, first article procedures, traceability or supplier portals. IATF 16949 requires you to evaluate these requirements and include them in your QMS. Auditors check whether your customers' CSRs are known, current and implemented.
- Keep an overview of all customers and the applicable CSR documents with their revision level.
- For each requirement, define where it is implemented in the QMS – procedure, form or process.
- Check regularly for new editions and evaluate changes.
- Inform and train affected employees about relevant changes.
The "Customer-specific requirements (CSR)" template in docxpert structures this overview and is mapped to clause 4.3.2.
Three types of internal audit
While ISO 9001 only requires an internal audit in general terms, IATF 16949 clause 9.2.2 distinguishes three audit types, all of which must be planned in a risk-based audit programme:
| Audit type | Clause | Subject |
|---|---|---|
| QMS audit | 9.2.2.2 | All QMS processes including customer-specific requirements, within three years |
| Manufacturing process audit | 9.2.2.3 | All manufacturing processes across all shifts within three years, often per VDA 6.3 |
| Product audit | 9.2.2.4 | Products at appropriate stages of production and delivery, often per VDA 6.5 |
Internal auditors must demonstrate their competence – including knowledge of the core tools, customer-specific requirements and the process approach to auditing. In docxpert you keep the audit programme, reports and auditor qualifications in one place; findings are tracked as CAPAs.
Practical tips
- Take 8D deadlines seriously: many OEMs expect containment within 24 hours and a root cause analysis within a few days. Record your customers' deadlines.
- Use lessons learned: findings from complaints feed into the FMEA and product development of new projects.
- Test contingency plans: the standard requires periodic testing of contingency plans for effectiveness, for example through simulations.
- Plan process audits: every manufacturing process must be covered in the audit cycle; a three-year audit programme provides an overview.
Learn more about the industry on the Automotive page and in the 8D report guide.
Frequently asked questions
Do I also need ISO 9001 for IATF 16949?
IATF 16949 supplements ISO 9001 and is always applied together with it. There is no separate ISO 9001 certificate required as a prerequisite – the IATF certificate covers both.
Can docxpert handle APQP and PPAP?
docxpert provides a product development template covering APQP, PPAP, FMEA and the control plan and controls the related documents. FMEA work and measurement data analysis happen in specialised tools.
How do I handle 8D reports in docxpert?
With the "Nonconformity & 8D report" template and CAPA management. The eight disciplines are documented, actions are tracked and effectiveness is checked.
What are customer-specific requirements?
Additional requirements an OEM sets for its suppliers beyond IATF 16949 – such as complaint handling, first article inspection or traceability. They are part of the certification audit.
Is there an automatic gap analysis for IATF 16949?
There is currently no dedicated IATF requirement catalogue. The ISO 9001 gap analysis covers the base requirements, and the 27 templates show their mapping to IATF clauses.
Does docxpert support VDA 6.3?
You can plan and document VDA 6.3 process audits with the audit programme and audit report templates. docxpert does not currently include a dedicated VDA 6.3 question catalogue.
How should a supplier maintain customer-specific requirements?
Keep a controlled overview by customer and product family rather than scattering requirements across emails and project folders. Record the source, applicable revision, affected processes, owner and evidence showing implementation. When a customer notice arrives, assess whether it changes documents, inspection plans, approvals, suppliers or metrics. Treat a change as complete only after affected functions have been informed and implementation is evidenced. If requirements conflict, clarify precedence and interpretation with the customer before making a local interpretation binding. Define how superseded requirements are withdrawn as well. This discipline helps maintain consistent implementation across sites or programmes and lets teams explain the basis for decisions during internal or customer audits.