IATF 16949: IATF 16949 – Tutorial (about 60 minutes)

IATF 16949 is the quality management system standard of the automotive industry. It adds automotive-specific requirements to ISO 9001 so that suppliers of parts and processed materials for road vehicles prevent defects, reduce variation and waste along the supply chain, and keep improving. Quality managers, plant and process engineers, supplier-quality staff, internal auditors and launch teams at automotive suppliers all work with it every day. After this tutorial you will be able to explain what the standard requires and why, read its structure, see how it shapes daily work in a plant, and understand how third-party certification works.

Free tutorial · about 60 minutes · 7 lessons · 4 diagrams · then a 25-question knowledge check and a certificate.

Course overview

Edition and status: the current edition is IATF 16949:2016, Quality management system requirements for automotive production and relevant service parts organizations, the first edition, published in October 2016 by the International Automotive Task Force (IATF). It cancelled and replaced ISO/TS 16949:2009. It is not a stand-alone standard: it supplements ISO 9001:2015 and must be used together with it. The IATF keeps it current through Sanctioned Interpretations (SIs, most recently issued and revised in November 2025) and Frequently Asked Questions (FAQs, most recently revised in June 2026). Certification runs under the Rules for achieving and maintaining IATF recognition, 6th edition, which became effective on 1 January 2025. A revision is under way: the IATF started work on "Revision 2" in October 2024, and its Stakeholder Communiqué of July 2026 names five priorities (simplification and clarity, software quality, lower-tier supply chain management, launch management, and customer-specific requirements) and plans publication for mid-2027, with dates described as indicative. The end of the transition to the new edition is to be aligned with the end of the ISO 9001 transition, because ISO 9001 itself was revised in 2026. This course teaches IATF 16949:2016, the edition against which organisations are certified today. Verified 2026-10-29 on the IATF Global Oversight website and Stakeholder Communiqués SC-2024-006 and SC-2026-005.

Who it is for: engineers, technicians, quality and supplier-quality staff, production supervisors, buyers, project and launch managers, and new internal auditors who join an automotive supplier or who must prepare a plant for its first certification audit.

Prerequisites: none. Knowing the basic idea of a quality management system or ISO 9001 helps, and a feel for manufacturing (drawings, machines, inspection) makes the examples easier to follow.

Learning objectives. After this tutorial:

You will be able to explain why IATF 16949 exists, who owns it and how it relates to ISO 9001.
You will be able to define the key vocabulary, such as customer-specific requirements, special characteristics, control plan and remote support location.
You will be able to navigate clauses 4 to 10 and name the main automotive additions in each.
You will be able to describe how the standard shapes daily work: planning, launch, production control, supplier management and problem solving.
You will be able to outline who is eligible for certification and how the IATF certification cycle and nonconformity handling work.
You will be able to place IATF 16949 next to the core tools, VDA 6.3, Automotive SPICE, AS9100 and ISO 13485.

Lesson 1 – Origins, purpose and scope

Why the automotive industry wrote its own standard

A modern car contains tens of thousands of parts that come from a deep supply chain: a carmaker buys a brake system from a Tier 1 supplier, which buys machined brackets from a Tier 2 supplier, which buys bar stock and heat treatment from Tier 3 companies. A single faulty bracket can stop an assembly line that builds a vehicle every minute, or worse, cause a safety recall that costs millions and damages trust. Carmakers therefore want very high and very consistent quality from every level of that chain.

In the 1980s and 1990s each carmaker solved this problem in its own way. North American manufacturers used QS-9000, German manufacturers used VDA 6.1, French and Italian manufacturers had their own schemes, and suppliers that served several customers were audited again and again against slightly different rule books. This was expensive and added little value. In 1999 the carmakers and their national trade associations, working together as the International Automotive Task Force, published ISO/TS 16949, a common technical specification built on ISO 9001. It was revised in 2002 and 2009. In 2016, after ISO 9001 moved to a new structure, the IATF replaced it with IATF 16949:2016, now published by the IATF itself rather than as an ISO document. All ISO/TS 16949 certificates had to be transitioned to the new standard by September 2018.

Who owns it

The IATF is a group of vehicle manufacturers and national automotive trade associations. In March 2026 it formed a non-profit association under Belgian law (IATF AISBL) based in Brussels. The vehicle manufacturers whose customer-specific requirements are published on the IATF website include BMW Group, Ford, General Motors, Geely, IVECO Group, Jaguar Land Rover, Mercedes-Benz, Renault Group, Stellantis, Volkswagen and Volvo Group; BYD (March 2026) and Chery (June 2026) were announced as new members. The certification scheme is supervised through five oversight offices: ANFIA in Italy, IAOB in North America, IATF France, SMMT Oversight in the United Kingdom and VDA QMC in Germany. These offices recognise certification bodies, qualify auditors and publish the scheme documents, while each manufacturer publishes its own extra requirements for suppliers.

Purpose in one sentence

The standard aims to build a quality management system that delivers continual improvement, puts the emphasis on preventing defects rather than finding them, and reduces variation and waste across the supply chain. Three ideas follow from this aim and run through every clause:

Prevention over detection. Risks are analysed before production starts, controls are planned in advance, and processes are made capable and error-proof instead of relying on inspection to catch bad parts.
Customer orientation. The customer's own requirements, published as customer-specific requirements, become part of the organisation's quality system and are audited.
Supply-chain thinking. An organisation is responsible not only for its own processes but also for developing and monitoring its suppliers, so that requirements flow down to every tier.

Scope: who uses it

IATF 16949 applies to sites where parts or processed materials for automotive customers are manufactured: production parts that go into new vehicles, service and accessory parts, and, under the current certification rules, replacement parts including aftermarket and remanufactured parts that meet the eligibility conditions. "Processed materials" means things such as steel coil, plastic resin, paint or adhesive that are made to an automotive specification. Functions that support the plant but do not manufacture, such as a design centre, a sales office, a corporate headquarters or a distribution warehouse, are included in the audit of the manufacturing site they support; they cannot be certified on their own. Lesson 5 explains the eligibility rules in more detail.

Figure 1 – The document family behind an automotive quality management system and its certification.

Figure 1 is the most important picture in this course. An automotive quality management system (QMS) is not built from IATF 16949 alone. ISO 9001 supplies the base requirements; IATF 16949 adds the automotive ones; each customer's specific requirements add more; and the core tools manuals describe the methods (planning, risk analysis, measurement, statistics and part approval) that the standard expects. Sanctioned Interpretations and FAQs clarify the standard, and the separate IATF Rules govern how certification bodies audit and certify.

Lesson 2 – Key concepts and vocabulary

IATF 16949 uses the vocabulary of ISO 9000 and adds its own definitions in clause 3.1. The terms below are explained in plain language; learn them before reading the structure in Lesson 3.

Quality management system (QMS) – the set of interacting processes, responsibilities, documents and resources an organisation uses to direct and control quality. IATF 16949 states requirements for it; it does not prescribe a particular organisation chart or software.
Customer-specific requirements (CSRs) – interpretations of or additions to the standard that a particular customer publishes, for example a carmaker's rules for part approval, problem-solving formats or sub-tier supplier management. The IATF website lists the CSR documents of its member manufacturers. CSRs that apply to a site are audited as if they were part of the standard.
Special characteristic – a product feature or process parameter that can affect safety, compliance with regulations, fit, function, performance or later processing. Such characteristics are identified by the customer and through the organisation's own risk analysis, marked on drawings, risk analyses and control plans, and given extra controls.
Control plan – a written description of the system used to control a product and its manufacturing process: what is checked, how, how often, with which equipment, and what to do when a result is out of limits. Annex A of the standard lists its minimum content.
Reaction plan – the part of a control plan that tells operators exactly what to do when a characteristic is out of control or a defect is found, such as stopping, segregating suspect parts and informing a supervisor.
Core tools – the family of automotive quality methods: advanced product quality planning (APQP), failure mode and effects analysis (FMEA), measurement system analysis (MSA), statistical process control (SPC) and the production part approval process (PPAP), plus the control plan. The standard expects them unless a customer specifies an equivalent.
Error-proofing – designing a product or process so that a mistake either cannot happen or is detected immediately, for example a fixture that only accepts a part in the correct orientation or a sensor that stops a press if a part is missing. Also known by the Japanese term poka-yoke.
Total productive maintenance (TPM) – a system for keeping machines, tools and gauges able to produce good parts, combining planned, predictive and operator-performed maintenance, with objectives such as equipment effectiveness and time between failures.
Manufacturing feasibility – a documented analysis, done before accepting a contract or a change, of whether the organisation can make the product to all requirements, at the required volume and capability, with its processes, people and suppliers.
Premium freight – extra transport cost caused by late or expedited delivery, for example flying parts to a customer to avoid stopping its line. It is a signal of weak planning or quality and is monitored as part of customer satisfaction.
Remote support location – a place that supports one or more manufacturing sites but does not manufacture itself, such as a design centre, a purchasing office or a headquarters function. It is audited together with the sites it supports.
Second-party audit – an audit performed by a customer of its supplier, or by an organisation of its own suppliers, as opposed to a first-party (internal) or third-party (certification) audit.
Product safety – the set of standards that ensure a product does not cause harm to users or bystanders. IATF 16949 asks for documented processes for safety-related products and processes.
Sanctioned Interpretation (SI) – an official IATF ruling that changes the interpretation of a requirement, usually with an effective date. An FAQ clarifies without changing the requirement.

The process approach and risk-based thinking

Two concepts inherited from ISO 9001 are central. The process approach means managing work as connected processes, each with inputs, outputs, an owner, resources and measures, rather than as separate departments. Automotive auditors often use a "turtle diagram" to summarise one process on a single page (inputs, outputs, who, with what, how, and how measured); the standard does not require the diagram itself, but auditors use the questions it represents. Risk-based thinking means identifying what could go wrong or right and acting in proportion. IATF 16949 makes risk-based thinking concrete through product and process risk analysis (typically FMEA), contingency planning and preventive action.

Customer-oriented processes

Automotive practitioners speak of customer-oriented processes: the chain of activities that directly touch the customer, from market analysis and quotation, through product and process design, production, delivery and invoicing, to warranty and complaint handling. Support processes (training, maintenance, calibration, purchasing) and management processes (planning, review, internal audit) feed them. Mapping these processes and their interactions is usually the first step in building an IATF 16949 system.

Lesson 3 – Structure of the standard

IATF 16949:2016 follows the ten-clause structure that ISO 9001:2015 uses (the ISO high-level structure, now called the Harmonized Structure). Clauses 1 to 3 cover scope, the normative reference and definitions; clauses 4 to 10 contain the requirements. Because the standard is a supplement, it does not reprint ISO 9001 text. Under many ISO 9001 clause headings it simply notes that the ISO requirement applies, and then adds automotive sub-clauses, many of which carry the word "supplemental" in their title. Two annexes follow: Annex A on the control plan and Annex B, a bibliography of automotive references.

Figure 2 – Clauses 4 to 10 arranged on the Plan-Do-Check-Act cycle that both ISO 9001 and IATF 16949 follow.

Clause 4 – Context of the organisation

The organisation defines the scope of its QMS, including supporting functions on site or remote, and identifies which customer-specific requirements apply. The only permitted exclusion is product design and development, and only when the organisation genuinely has no responsibility for product design; manufacturing process design can never be excluded. Two automotive additions stand out: a requirement to ensure that all products and processes, including service parts and outsourced work, conform to requirements, and a sub-clause on product safety. The product safety requirements ask for documented processes covering, among other things, identification of statutory safety requirements, special approval of risk analyses for safety items, training of people involved, traceability and the flow-down of safety requirements to suppliers.

Clause 5 – Leadership

Top management keeps its ISO 9001 duties and gains automotive ones. A corporate responsibility sub-clause asks for policies such as anti-bribery, an employee code of conduct and an ethics escalation (whistle-blowing) policy. Top management must review how effective and efficient the QMS and its processes are (efficiency measures are expected only where they make sense, for example for product realisation processes) and feed the results into management review, and it must name process owners. Personnel responsible for conformity to product requirements must have the authority to stop shipment or production to correct quality problems, and shifts must have people in charge of product quality.

Clause 6 – Planning

Planning adds three practical requirements. Risk analysis must consider at least lessons learned from recalls, product audits, field returns, complaints, scrap and rework, and, since a Sanctioned Interpretation, cyber-attack threats to information technology systems. Preventive action asks for a process to reduce the impact of potential problems, including lessons learned from similar processes. Contingency plans must keep supply going when things go wrong: key equipment failure, interruption of externally provided products, recurring natural disasters, fire, pandemics, utility outages, cyber-attacks, labour shortages and infrastructure problems. The plans must be tested periodically (for cyber risks, for example, by simulating an attack), reviewed at least once a year by a multidisciplinary team that includes top management, and must include notifying the customer when deliveries are affected and checking that product still meets specification after an emergency restart. Quality objectives must also reflect customer requirements and be cascaded to functions and levels.

Clause 7 – Support

Support covers the resources a QMS needs, and the automotive additions are detailed:

Plant and facility planning with a multidisciplinary approach, including evaluation of manufacturing feasibility and capacity and cyber protection of the equipment and systems that support manufacturing.
Measurement system analysis for every type of inspection, measuring and test equipment in the control plan, with calibration records and a defined method for gauges found out of calibration, including assessing parts already shipped.
Laboratory requirements: an internal laboratory needs a defined scope and competence; external laboratories used for inspection or calibration are normally expected to be accredited to ISO/IEC 17025 or accepted by the customer.
Competence and training, including on-the-job training for new or changed jobs and specific competence for internal auditors (the core tools, customer-specific requirements and the automotive process approach) and for second-party auditors.
Employee awareness of their impact on product quality and of the consequences of nonconformity, plus a process to motivate employees.
Documented information: a quality manual is still required (ISO 9001 dropped it), including a document (a table, list or matrix; the format is the organisation's choice) showing where each customer-specific requirement is addressed. Customer engineering standards and changes must be reviewed promptly, within ten working days, and record retention must cover the active life of the product plus a further period.

Clause 8 – Operation

Clause 8 is the largest. It follows the product from inquiry to delivery:

Requirements for products – customer communication in the customer's language and formats, manufacturing feasibility before contract, and identification of special characteristics.
Design and development – a multidisciplinary planning approach, design skills, a section on products with embedded software, design inputs and outputs for both product and manufacturing process, prototype programmes, product approval (normally PPAP), and control of design changes.
Control of externally provided products – a supplier selection process that weighs risk, customer-directed sources, statutory requirements, supplier QMS development (normally starting with ISO 9001 certification), monitoring of supplier performance, second-party audits and supplier development.
Production – control plans, standardised work and operator instructions, verification of job set-ups and of restarts after shutdowns, TPM, management of production tooling, production scheduling, traceability, preservation, and control of changes, including a list of the primary process controls and any approved back-up or alternative methods.
Release of products – layout inspection and functional testing as defined in the control plan, appearance items, statutory conformity, and acceptance at zero defects when sampling by attributes.
Nonconforming outputs – customer authorisation for concessions, handling of suspect product, risk analysis before rework, customer approval before repair, prompt customer notification when nonconforming product has shipped, and rendering scrap unusable.

Clause 9 – Performance evaluation

Manufacturing processes must be studied for capability and stability, with the results recorded, and the organisation must determine which statistical tools apply. Customer satisfaction is measured not only through surveys but through hard indicators: delivered part quality, customer disruptions including field returns, delivery performance including premium freight, and customer notices about quality or delivery problems. The internal audit programme has three layers (see Lesson 4), and management review takes place at least once a year with extra inputs such as the cost of poor quality, process effectiveness and efficiency, and field failures.

Clause 10 – Improvement

Improvement adds four automotive processes: a documented problem-solving process (often in the customer's prescribed format, such as 8D), error-proofing methods decided as part of root-cause analysis, warranty management including analysis of parts where no trouble was found, and analysis of customer complaints and field failures. A supplemental continual improvement clause asks for a documented process with methods and measurable objectives.

Annex A – Control plan

Annex A states the phases of a control plan (prototype, pre-launch and production) and the minimum information it contains, from part and process identification to the characteristics, specifications, measurement techniques, sample sizes and frequencies, control methods and reaction plans. The detailed method is described in the core tools manuals.

Lesson 4 – How it works in practice

Reading the clauses is not enough; the value of IATF 16949 comes from how it changes everyday work. This lesson follows a part through the life of an automotive programme and shows where the standard bites.

Figure 3 – The product lifecycle as IATF 16949 shapes it, with problems feeding back into risk analysis and controls.

Quotation and feasibility

Before committing to a new part, a multidisciplinary team (sales, engineering, quality, production, purchasing, logistics) reviews the customer's drawing, specifications and CSRs. It checks whether the organisation can make the part with the required capability and volume, identifies special characteristics, and records the result. Accepting work that the plant cannot make reliably is one of the most expensive mistakes a supplier can make, and the standard makes this review a formal step.

Planning and launch

Once the business is awarded, the programme runs through advanced product quality planning. The team designs the product (if it is design-responsible) and the manufacturing process, carries out design and process FMEAs to rate and reduce risks, and writes control plans. Measurement systems are analysed so that the data used for decisions can be trusted, and initial process studies show whether the process is stable and capable. The customer then approves the part, usually through PPAP, before series production starts. Many customers also require a launch period with extra inspection and containment; the standard covers such extra controls through the control plan and customer requirements.

Series production

On the shop floor the standard shows up as concrete routines:

Operators work from current, accessible work instructions and the control plan, and record checks at the defined frequency.
Each job set-up is verified, for example by comparing the first part produced with the last part of the previous run, and restarts after planned or unplanned shutdowns are checked.
Machines and tools are maintained under a TPM system with objectives, spare parts for key equipment and records of tool life and repair.
Gauges carry a calibration status, and a gauge found out of calibration triggers an assessment of the parts measured with it.
Nonconforming or suspect parts are identified and segregated; rework requires a risk assessment and approved instructions, and repair needs the customer's approval.
If a planned control cannot run (for example, a camera inspection is broken), the organisation switches to the approved back-up method listed for it and records the period during which it is used. Not every control needs a back-up; the team decides from risk which ones do, and where none exists, suspect output is not released uncontrolled.

Changes

Changes are a major source of defects in the automotive industry. The standard asks for a process that assesses the effect of any change to product, process, supplier or location, verifies and validates it, and gets customer approval when the customer requires it, often through a new PPAP submission. Changes initiated by suppliers are included.

Managing suppliers

The organisation selects suppliers through a risk-based process, sets the type and extent of control in proportion to risk and performance, and monitors indicators such as delivered product conformity, disruptions at the receiving plant (yard holds, stop-ships) and delivery schedule performance. (Premium freight is measured on the organisation's own deliveries to its customers, as part of customer satisfaction.) It must push suppliers to develop their own QMS, normally starting with ISO 9001 certification and moving towards IATF 16949 conformity, unless the customer allows something else. Where risks are high, the organisation audits suppliers itself (second-party audits) and runs supplier development activities. If the customer directs the organisation to buy from a particular source, the organisation still remains responsible for the quality of what it buys.

The three layers of internal audit

Internal audits are the organisation's own early-warning system. IATF 16949 asks for a risk-based programme with three kinds of audit:

QMS audits cover all processes over a three-year calendar cycle, using the process approach, and include sampling of customer-specific requirements.
Manufacturing process audits examine each manufacturing process on all shifts over the same cycle, including how shifts hand over, to verify that the process works as planned and is effective.
Product audits check finished or in-process products at appropriate stages against all specified requirements, such as dimensions, function, packaging and labelling.

Audit frequency is raised when there are internal or external nonconformities or customer complaints. Many carmakers expect the manufacturing process audit to use a specific method, such as VDA 6.3 in the German supply chain.

Problem solving and error-proofing

When a defect reaches the customer, the organisation uses a documented, disciplined problem-solving method: protect the customer through containment, find the true root cause (including why the defect escaped detection), implement and verify corrective action, and spread lessons learned to similar products and processes. Error-proofing is preferred over more inspection whenever it is feasible. Risk analyses and control plans are updated so that knowledge is not lost.

Roles

Top management sets policy, resources and review. Process owners manage their processes and indicators. A quality function coordinates the system but does not own every process. Customer representatives handle CSRs and special characteristics. Internal auditors and second-party auditors need proven competence. Above all, operators are trained to stop and escalate when something is wrong, and they have the authority to do so.

Lesson 5 – Assessment, certification and compliance

Unlike many standards that are certified under general accreditation rules, IATF 16949 certification is run as a closed scheme controlled by the IATF. Only certification bodies recognised by the IATF can issue IATF 16949 certificates, and only auditors qualified through the IATF's auditor development process can perform the audits. The rules for this are in the Rules for achieving and maintaining IATF recognition, currently the 6th edition, which became effective on 1 January 2025. Each certificate is recorded in the IATF database, where its validity can be checked.

Who is eligible

The 6th edition of the Rules clarified eligibility. In short:

The site must manufacture, meaning at least one value-adding transformation such as machining, moulding, casting, heat treatment, plating, painting, soldering or assembly.
The products must be parts or processed materials for homologated vehicles intended to be driven on public roads, such as cars, trucks, buses and motorcycles. Parts only for vehicles that are not homologated for public roads, such as off-highway mining or construction machines, are not eligible.
Production parts, OEM accessory parts and replacement parts (including aftermarket and remanufactured parts that meet the conditions) qualify.
A company that only sorts, inspects, tests, packs or stores parts is not eligible, nor is a company that holds a supply contract but outsources all manufacturing.
Support functions such as design, purchasing or headquarters cannot be certified on their own; they are audited as remote support locations together with the manufacturing sites they support.

A company that is not eligible can still follow IATF 16949 voluntarily or be assessed by its customers, and many such companies hold ISO 9001 certification instead.

Figure 4 – The IATF 16949 certification cycle, from eligibility check to surveillance and recertification.

The certification cycle

Before applying, the organisation needs a working system with records to prove it. Typically it should have run its QMS for a defined period with data, completed a full internal audit cycle and a management review, and be able to show customer performance information. The certification body then performs a two-stage initial audit. The stage 1 readiness assessment checks whether the organisation is ready: scope, documentation, CSRs, process map, internal audits and management review, and key performance data. Serious gaps can delay stage 2. The stage 2 audit is the on-site certification audit of all processes, shifts and remote support locations in scope; its duration is set by the IATF Rules based on the number of employees and other factors, not negotiated freely.

Certificates are valid for three years. Surveillance audits follow, normally every twelve months under the 6th edition of the Rules, and a recertification audit is held before the certificate expires. Special audits can be triggered by events such as serious customer complaints, a customer status change (for example, the customer placing the supplier under special status for poor performance) or changes at the site. Customers can also raise performance complaints about a certified supplier to the certification body, and the IATF watches for them.

Nonconformities

Audit findings are graded as major or minor nonconformities. A major nonconformity is, broadly, a failure that leads to doubt about the system's ability to ensure conforming product, such as the absence of a required process or a breakdown that could let nonconforming product reach the customer. A minor nonconformity is a lapse that does not in itself threaten product conformity. For each finding the organisation must contain the problem, analyse the root cause, including the systemic cause, and implement and verify corrective action within time limits set by the Rules. The certification body reviews the evidence; majors normally require verification, often on site. Unresolved or serious findings can lead to a negative certification decision, or to suspension or withdrawal of an existing certificate.

What auditors look at

Certification auditors use the automotive process approach. They start from customer performance (scorecards, complaints, field returns, premium freight, special statuses) and follow the trail into the processes that should have prevented the problem. They sample CSRs, check that the core tools are used effectively rather than merely filled in, and walk the shop floor on different shifts. The IATF Auditor Guide (5th edition published in November 2024) helps auditors apply this approach consistently.

Compliance beyond the certificate

Holding a certificate is a condition for doing business with most carmakers, but it is not the whole picture. Customers measure their suppliers continuously through scorecards and second-party audits, may require additional process audits, and can escalate a supplier with repeated problems to controlled shipping or new-business hold. A certificate shows that a system exists and works at the time of the audit; customer performance shows whether it keeps working.

Lesson 6 – Worked example

This fictional example ties the lessons together. Keswick Precision is a 420-person company that machines and anodises aluminium brake caliper brackets and steering knuckle parts. It has one plant, a small engineering office in another city and a sales office. It holds ISO 9001 certification. A Tier 1 brake system supplier, its main customer, tells Keswick that from next year all suppliers of safety-relevant parts must hold IATF 16949 certification.

Step 1 – Confirm scope and eligibility

Keswick machines parts for passenger cars that are homologated for public roads, so the plant is eligible. The engineering office designs fixtures and machining processes but no products: product design belongs to the customer. Keswick therefore excludes product design and development, but keeps manufacturing process design in scope. The engineering and sales offices become remote support locations of the plant. The anodising is done in-house, so it is in scope as a special process; the heat treatment of a few parts is outsourced and must be controlled through purchasing.

Step 2 – Gap analysis and plan

A small project team led by the quality manager compares the existing ISO 9001 system with IATF 16949 and the customer's CSRs. Gaps found include: no documented contingency plans, no formal product safety process, measurement system analysis only for a few gauges, internal audits that cover the QMS but not manufacturing processes per shift or products, no tracking of premium freight, and a supplier list without risk-based development. The team writes a twelve-month plan with owners and dates and gets top management to approve the resources.

Step 3 – Build the missing processes

CSR matrix. The team lists every requirement in the customer's CSR document and records where the QMS addresses each one, and adds this matrix to the quality manual.
Process map. Customer-oriented processes (quotation, process development, production, delivery, complaint handling) are mapped with owners, inputs, outputs and indicators.
Risk and safety. Process FMEAs are reviewed with the customer's special characteristics, such as bore diameter and surface treatment thickness. A product safety procedure defines escalation, special approval of the FMEA and control plan for safety items, and traceability by batch.
Contingency plans. Plans cover failure of the five-axis machining centres, loss of the anodising line, a power cut and a shortage of skilled setters. One plan is tested through a tabletop exercise and the lessons are recorded.
Measurement. MSA studies are run for all gauges listed in the control plans; one air gauge shows poor repeatability and is replaced.
Maintenance and tooling. A TPM system with critical spare parts and tool-life records replaces breakdown-only maintenance.
Suppliers. The heat treater and the bar stock supplier are risk-rated; the heat treater, an important process supplier, receives a second-party process audit.
Internal audits. Six employees train as internal auditors, including the core tools and the customer's CSRs, and a three-year programme covering QMS, manufacturing process and product audits begins.

Step 4 – Run, measure and review

Keswick runs the new system for several months and collects data: customer scorecard, internal scrap, premium freight and audit results. The first full management review examines these inputs, including the cost of poor quality, and sets objectives such as halving internal scrap on the knuckle line.

Step 5 – Certification audit

Keswick signs a contract with an IATF-recognised certification body. The stage 1 readiness assessment raises a concern that internal manufacturing process audits have not yet covered the night shift; Keswick completes them before stage 2. During stage 2 the auditors find two nonconformities. The major one: the control plan for a safety-relevant bore specifies a reaction plan, but on the night shift operators had been re-measuring and passing parts instead of segregating them. The minor one: a calibration record for a torque wrench was missing.

Keswick's team contains the major finding by checking the parts in stock and in transit, then uses its problem-solving process. The root cause is that the night shift had been trained by a setter using an old instruction, and the system cause is that training records were not linked to document changes. The corrective actions are an automatic stop on the measuring station when a reading is out of tolerance (error-proofing), retraining, and a link between document changes and training. The certification body verifies the evidence and issues the certificate, which appears in the IATF database.

Step 6 – Living with the system

Eight months later the customer reports anodising stains on a batch. Keswick contains stock within hours, finds that a rinse tank was outside its conductivity limit after a weekend shutdown, adds a check after every restart to the control plan, and updates the process FMEA. At the next surveillance audit the auditor follows this complaint through the process and finds the actions effective. The company's premium freight costs have fallen, and the customer's scorecard has improved.

The example shows the pattern that matters for every IATF 16949 organisation: understand customer requirements, analyse risk before production, control the process with a plan, react quickly and systematically when something escapes, and feed lessons back into the risk analysis and controls.

Lesson 7 – Relationship to other standards and frameworks

IATF 16949 sits in a network of related documents. Some are part of it (ISO 9001), some are methods it calls for (the core tools), and some are parallel sector standards with a similar design. The table compares the most important ones.

Standard or framework	What it covers	Relationship to IATF 16949
ISO 9001	Generic QMS requirements for any organisation	The base. IATF 16949:2016 supplements ISO 9001:2015 and is used together with it; the revision now under way will align with the 2026 edition of ISO 9001.
Automotive core tools (APQP, FMEA, MSA, SPC, PPAP, control plan)	Methods for planning, risk analysis, measurement, statistics and part approval	Required by IATF 16949 and CSRs. The standard says what must be achieved; the manuals say how.
VDA 6.3	Process audit method of the German automotive industry	Often used by customers and suppliers to perform the manufacturing process audits that IATF 16949 requires; not a certification standard.
VDA 6.1	German automotive QMS standard	A predecessor and parallel scheme for some German supply chains; IATF 16949 is the common global standard.
Automotive SPICE	Capability of software and system development processes	Complements IATF 16949 for suppliers that develop software; the planned revision will strengthen software quality requirements.
ISO 26262	Functional safety of electrical and electronic systems in road vehicles	Addresses product safety in design; IATF 16949's product safety clause expects such statutory and customer safety requirements to be identified and controlled.
AS9100 / EN 9100	QMS requirements for aviation, space and defence	Sister sector standard built on ISO 9001 in the same way, with sector-specific additions.
ISO 13485	QMS requirements for medical devices	Another sector QMS standard, focused on regulatory compliance; a company supplying both sectors may hold both certificates.
ISO 14001 and ISO 45001	Environmental and occupational health and safety management	Share the same high-level structure, so many plants run an integrated management system; carmakers' CSRs often ask for them as well.

IATF 16949 versus ISO 9001 in a sentence

ISO 9001 asks an organisation to manage quality through processes and risk-based thinking; IATF 16949 tells an automotive supplier how much rigour that means in its industry: defect prevention through the core tools, defined controls for every characteristic, three layers of internal audit, specific measures of customer satisfaction, and responsibility for the supply chain.

Where the revision is heading

The IATF's published priorities for the next edition show how the standard is expected to change: clearer, simpler text with less variation in interpretation and no duplication of ISO 9001; stronger requirements for embedded software quality; better management of lower-tier suppliers; more emphasis on launch and change management; and work to identify common customer-specific requirements and bring them into the standard where possible. Organisations do not need to wait: each of these areas is already good practice under the 2016 edition.

Common pitfalls and best practices

Common pitfalls

Paper system. Writing procedures to satisfy auditors while the shop floor works differently. Auditors walk the floor on every shift and will find the gap.
Ignoring CSRs. Treating the standard as complete and overlooking the customer-specific requirements, which are audited with the same weight.
Core tools as forms. Filling in FMEAs, control plans and MSA studies to pass PPAP and never updating them after problems or changes.
Inspection instead of prevention. Answering every defect with more inspection rather than finding the root cause and error-proofing the process.
Weak root-cause analysis. Stopping at "operator error" without asking why the system allowed the error and why it escaped detection.
Uncontrolled changes. Changing a tool, material, supplier or location without risk assessment and, where required, customer approval.
Forgetting the night shift and support functions. Running audits and training only on day shift and leaving remote support locations out of the system.

Best practices

Start from customer data. Use scorecards, complaints, field returns and premium freight to decide where to focus improvement and internal audits.
Keep a living CSR matrix. Assign an owner, check for new CSR versions on the IATF and customer portals, and record where each requirement is met.
Link the documents. Keep FMEA, control plan, work instructions and training records consistent, and update all of them after every problem or change.
Error-proof first. Prefer design and process solutions that make defects impossible over detection.
Empower operators. Train people to recognise abnormal conditions, give them the authority to stop, and react quickly when they do.
Develop suppliers. Rate supplier risk, audit important process suppliers and help weak ones improve instead of only sending complaints.
Test contingency plans. Run exercises and learn from real disruptions, not only from documents.

Summary and key takeaways

IATF 16949:2016 is the global automotive QMS standard, published by the International Automotive Task Force; it supplements ISO 9001:2015 and cannot be used alone.
Its aim is continual improvement, defect prevention and reduction of variation and waste in the supply chain.
Customer-specific requirements, the core tools and IATF interpretations are part of the system and are audited.
Clauses 4 to 10 follow ISO 9001; the automotive additions cover product safety, corporate responsibility, contingency planning, MSA and laboratories, supplier development, production controls, three layers of internal audit and structured problem solving.
Certification is a closed scheme: IATF-recognised bodies, qualified auditors, the IATF Rules (6th edition since January 2025) and a public certificate database.
Only manufacturing sites for road-vehicle parts and processed materials are eligible; support functions are audited with the sites they serve.
Revision 2 is in progress, with publication planned for mid-2027; until then organisations certify to the 2016 edition.

Reflection questions

Think of a part your organisation makes or buys. Which of its features would you treat as special characteristics, and what extra controls would you put on them?
Your plant has never tracked premium freight. What would the data tell management, and which processes would you look at first if it were high?
How would you design a three-year internal audit programme for a plant with three shifts and two remote support locations, and how would customer complaints change it?
A customer directs you to buy coatings from a supplier you would not have chosen. How would you still meet your responsibility for the quality of those coatings?
Which of the five priorities announced for the next edition would affect your organisation most, and what could you start improving now under the 2016 edition?