Automotive and mobility · ISO and GRC consulting
ISO certification for automotive and mobility suppliers that carmakers and Tier 1 buyers can nominate with confidence.
Win and keep automotive business with the certificates and labels your customers put in their supplier requirements: IATF 16949 for the plant, TISAX for their confidential data and prototypes, and the safety and cybersecurity evidence behind vehicle electronics. Sterling's expert and experienced consultants build it with your teams. We ensure successful certification for our clients.
- One all-inclusive proposal, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard
- Expert and experienced automotive quality, information security and engineering consultants, advising on management systems since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an accredited body audits and decides
- Ready for nominationAn IATF 16949 certificate at each manufacturing site, recorded in the IATF database, before the sourcing decision.
- Labels on the portalTISAX labels at the objectives and level your customer asked for, shared through the ENX portal.
- Engineering evidenceSafety and cybersecurity processes your engineers run, with the work products a customer or assessor reviews.
- One system per plantQuality, environment and safety run as one system, so shifts, audits and scorecards are not handled three times.
What automotive and mobility is asked for
The certificates and labels automotive customers write into their supplier requirements.
Most automotive suppliers start with IATF 16949, because vehicle manufacturers and Tier 1 buyers ask for it before they nominate a supplier. It is applied with ISO 9001, and with the core tools your customers expect in every launch: APQP, the control plan, PPAP, FMEA, MSA and SPC. Suppliers that hold a customer's drawings, prototypes or test vehicles are then asked for TISAX labels. Electronics and software suppliers add ISO 26262 for functional safety and ISO/SAE 21434 for cybersecurity, and vehicle manufacturers need the certificates of compliance behind UN Regulations No 155 and 156. ISO 14001 and ISO 45001 complete the picture for the plant.
Why now
Why automotive suppliers are asked for certification now.
The request usually arrives with a sourcing decision, a portal deadline or a scorecard. These are the pressures behind it.
- Customers nominating suppliersVehicle manufacturers and Tier 1 buyers ask for IATF 16949 before they nominate a supplier for a new part. Without the certificate, the quotation often does not reach the sourcing decision.
- Supplier portal deadlinesTISAX requests arrive with objectives, a level and a date in the customer's supplier portal. The labels are valid for three years, so renewal comes round on a fixed clock.
- Type approvalUnder Regulation (EU) 2019/2144, EU type approval of new vehicle types without protection against cyberattacks has been refused since 6 July 2022, and registration prohibited since 7 July 2024. Manufacturers pass that pressure to their suppliers.
- Scorecards and complaintsUnder the IATF Rules, additional audit time applies where a site misses an IATF OEM quality or delivery target. A red scorecard or a major complaint is often what starts the work.
- Requirements passed down the chainEach customer adds its own customer-specific requirements, and Tier 1s decide what they pass down to their sub-tier suppliers. Several plants and several customers soon mean several ways of working.
- Editions on the moveISO 9001:2026 is published, the second edition of IATF 16949 is planned for mid-2027, VDA ISA2027 applies to TISAX assessments ordered from 1 January 2027, and ISO 26262's third edition is in draft.
Scope and evidence
What an automotive auditor looks for, and the records that answer it.
Six areas where automotive audits and assessments go further than a general quality audit, with the evidence auditors and assessors typically ask to see.
| Requirement area | What it looks like in automotive and mobility | Evidence auditors ask for |
|---|---|---|
| Customer-specific requirements | Each customer's manual, portal rules, response times and retention periods brought into the system and mapped to processes and owners | A customer requirements register, current revisions and records showing each requirement met |
| Launching a new part | Advanced product quality planning from quotation to production, with feasibility, the design and process FMEAs and the approval your customer requires | APQP files, PPAP submissions and approvals, and control plans linked to the process FMEA and work instructions |
| Process control on every shift | Control plans followed at the line, gauges fit for the tolerance, capability monitored and set-ups verified, day and night | MSA studies, calibration certificates, SPC charts, set-up records and manufacturing process audits covering all shifts |
| Problem solving and warranty | Containment within the days the customer allows, a verified root cause, error-proofing and field failures fed back into the FMEAs | 8D reports or the customer's format, effectiveness checks, warranty analysis and scorecards with actions |
| Customer data and prototypes | Drawings, test vehicles, parts under confidentiality and personal data protected to the level the customer's TISAX objectives set | A self-assessment against the VDA ISA at target maturity, access and physical security records, and supplier controls |
| Safety and cybersecurity engineering | Functional safety scaled by ASIL, threat analysis and risk assessment for vehicle electronics, and processes for monitoring and responding to cyberattacks | Safety plans and the safety case, threat analyses, confirmation reviews and assessment records for each project |
The evidence your auditor asks for depends on your products, your customers and the scheme. We confirm the list in the gap analysis and build only the records your processes and customers need, in Effivity from the first workshop.
The engagement
What happens between the first call and the certificate.
The steps below follow an IATF 16949 certification, the route most automotive suppliers start with. For TISAX the same work ends in an assessment by an ENX-approved audit provider and labels on the ENX portal, not a certificate.
- 01Define what the certificate needs to cover.Confirm activities, sites, headcount, customer expectations and the intended certification scope.
- 02Gap analysis: review the current system against the requirements.The gap analysis identifies what is missing, preserves effective practice and agrees actions, owners, dates and resources.
- 03Implement and collect meaningful evidence.Put controls into use, train the relevant people and keep the records that show how the system operates.
- 04Audit, review and address the findings.Internal audit and management review evaluate implementation; findings are raised by us first and closed with evidence.
- 05Complete the independent assessment.The certification body's Stage 1 readiness review, then the Stage 2 audit; respond to any findings and await its decision.
- 06Maintain the system after certification.Monitoring, internal audits, reviews and improvement continue, alongside the body's surveillance audits and three-yearly recertification.
What you receive
Everything a working, certifiable system needs. Nothing to pay for separately.
- Scope and gap analysis reportThe scope of the certificate and every shortfall against the standard, with an owner and a date.
- Implementation planMilestones, responsibilities, the weekly session calendar and the target audit window.
- The documented management systemPolicies, processes, procedures, forms and records on Sterling's template sets, tailored to your operation.
- Effivity workspace, configuredDocuments, registers, audits, actions, training records and management review in one place, included at no additional cost.
- Trained peopleAwareness e-learning for everyone, practitioner courses for the people who run the system, internal auditor training for your audit team, as applicable to your standard, with Certificates of Completion.
- Internal audit and management reviewProgramme, checklists, report, corrective actions closed with evidence, and a management review record with decisions.
- Certification readinessCertification bodies compared and their accreditation checked, Stage 1 and Stage 2 preparation, and support until the certificate is issued.
- The Sustain™ calendarThe year after certification planned: surveillance dates, internal audits, refreshers, new-hire training and any transition to a revised edition.
Effivity · included with the engagement
Your system runs in software from the first workshop.
Effivity is the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures it within the agreed scope, so evidence accumulates as people do their work and the certification auditor reviews a live system rather than a binder. Sterling consulting clients get their subscription included with the engagement, at no additional cost.
ISO & GRC softwareSterling Academy · included with the engagement
Your people learn the standard, not just the forms.
E-learning with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online, with progress by department for the certification audit. Sterling consulting clients get preferential course access and special pricing, including complimentary awareness training for their people as part of the engagement.
Contact us about Academy accessStandards
Standards for Automotive and mobility
- IATF 16949IATF 16949 certification consulting for automotive part makers: defect prevention, less variation and waste, prepared for an IATF-recognised body's audit.
- TISAXTISAX Assessment certification consulting for automotive suppliers: information security prepared for the TISAX assessment and labels shared with customers.
- ISO 9001ISO 9001 certification consulting: a quality management system built with your people, evidence prepared and support until an accredited body certifies you.
- ISO 26262ISO 26262 Functional Safety certification consulting for vehicle E/E systems: an ASIL-scaled safety lifecycle and safety case ready for independent assessment.
- ISO 14001ISO 14001 certification consulting: aspects, impacts and compliance obligations controlled, with support until an accredited body certifies you.
- ISO 45001ISO 45001 certification consulting to prevent work-related injury and ill health, with an OH&S system built with your people and audit-ready, in 60+ countries.
- ISO/SAE 21434ISO/SAE 21434 Automotive Cybersecurity certification consulting: vehicle cyber risk managed from concept to decommissioning, with R155 CSMS evidence.
Automotive and mobility client experience
Client letters on file, available on request.
Signed client letters are available on request. The client feedback wall lists every letter by standard.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions automotive and mobility clients ask before they engage us.
The specific answers for your organisation come from the discovery call. These are the general ones.
Which certification should an automotive supplier get first?
Start with what your customer has written into the supplier requirements or the quotation. For most parts manufacturers that is IATF 16949, built on ISO 9001. Suppliers that receive drawings, prototypes or test vehicles are usually asked for TISAX as well, and electronics or software suppliers for ISO 26262 or ISO/SAE 21434 evidence. We map your customers' requests in the gap analysis and plan the order so that one system carries them all.
We are a sub-tier supplier. Does IATF 16949 apply to us?
It can. IATF 16949 is relevant to sites that manufacture automotive production, service, replacement or accessory parts, from Tier 1 down to the sub-tiers. Whether your site is eligible depends on what you make and where it goes, and the IATF-recognised certification body confirms it against the IATF Rules. If your Tier 1 customer asks for ISO 9001 plus its own requirements instead, we build the system so that moving to IATF 16949 later is a step, not a restart.
Can IATF 16949, ISO 14001 and ISO 45001 run as one system?
Yes. The plant has one set of processes, one management team and one set of shifts, so we build one integrated system with shared document control, internal audits, management review and corrective action. IATF 16949 is certified under its own scheme by an IATF-recognised body, so how and when the audits are combined is confirmed with your certification body. Effivity keeps the evidence for all three standards in one workspace.
Our customer has asked for TISAX labels in its supplier portal. Where do we start?
Start with the exact assessment objectives and level in the request, because they set the scope, the catalogues and the effort. We then run a gap analysis against the VDA ISA, bring each control to target maturity and prepare the self-assessment. An ENX-approved audit provider conducts the assessment, and the labels are shared with your customer on the ENX portal. Assessments ordered from 1 January 2027 follow VDA ISA2027.
Do UN Regulations No 155 and 156 apply to suppliers?
The regulations apply to vehicle manufacturers, who need a certificate of compliance for their cybersecurity and software update management systems from an approval authority. Suppliers feel them through their customers: UN R155 requires the manufacturer to manage dependencies with contracted suppliers and service providers, so suppliers are asked for cybersecurity evidence, often processes built on ISO/SAE 21434. Rules outside the EU are confirmed market by market.
How long does automotive certification take?
It is measured in months, because the system has to run long enough to produce evidence. IATF 16949 typically takes 9 to 18 months, less for a site already certified to ISO 9001 with the core tools in use. A TISAX programme typically takes 4 to 9 months, and an ISO 26262 or ISO/SAE 21434 management system 6 to 12 months. The gap analysis turns these ranges into a plan against your customer's date.
Does Sterling carry out the IATF audit or the TISAX assessment?
No. Sterling does not certify, assess or approve. IATF 16949 certificates are issued only by certification bodies recognised under the IATF scheme, TISAX assessments are conducted by ENX-approved audit providers, and UN R155 and R156 certificates of compliance come from approval authorities. Our expert and experienced consultants build the system with your teams, prepare the evidence and support you through the audit or assessment and after it.
Talk to a consultant
Plan certification for your automotive and mobility operation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice