IATF 16949 core tools and CSR checklist: APQP, FMEA, control plan, MSA, SPC, PPAP and every customer's requirements, with the evidence auditors look for

Customer-specific requirements: identified, assigned and current

IATF 16949 gives customer-specific requirements their own clause (4.3.2), and the IATF's June 2026 FAQ on documentation (7.5.1.1) extends that to every direct customer. Start here, because every other area inherits its rules from this register.

• Every direct customer of the site is listed, including Tier 1s and vehicle makers that do not publish an IATF CSR document, with the part numbers supplied to each. Evidence: a customer list reconciled with the sales and shipping records for the last twelve months.
• For each customer, the source documents that govern supplier quality are identified: the CSR document, supplier quality manual, quality agreement, drawings and specification notes, and any requirements a Tier 1 passes down. Evidence: a source list per customer, with the Tier 1's written answer on which requirements apply.
• The copy held of each source document is the current revision, with its revision date, where it was obtained and the date it was last checked. Evidence: controlled copies whose revision dates match the customer's site or the IATF CSR page on the day of the audit.
• Each document is broken into individual requirements, and each requirement is mapped to the process that meets it, with the related IATF 16949 clause. Evidence: a register with one row per requirement, not one row per PDF.
• Every register entry has a process owner, and entries where current practice falls short have a dated action. Evidence: owners by role, open actions with dates and closed actions with the changed procedure or setting.
• The processes themselves have changed to match the requirement: the procedure, form, retention setting or work instruction now says what the customer asked for. Evidence: revised documents that cite the customer requirement, and practice on the shop floor that matches them.
• Customer requirements on record retention are applied where they exceed the site default. Evidence: retention periods by record type and customer, and archived records from earlier years that can be produced.
• Requirements that must travel to your own suppliers are passed on and checked. Evidence: supplier agreements or purchase terms carrying the requirement, and supplier audits or monitoring that test it.
• The register is reviewed on a fixed, recorded cycle and whenever a customer issues a revision or a new customer is won, and the result reaches management review. Evidence: a review log, revision comparisons and management review minutes that mention CSR changes.

Customer-specific requirements: managing CSRs in your QMS

Customer portals, scorecards and communication

Many automotive customers publish requirements, scorecards, quality alerts and approval requests through their own supplier systems. Under the IATF Rules 6th Edition, a site that misses the quality or delivery targets in an IATF OEM scorecard is given additional audit time unless it shows verified effective corrective action, so these items affect the audit itself.

• Each customer supplier portal or web system the site must use is listed, with what it carries (requirements, scorecards, alerts, submissions) and a named role with access. Evidence: a portal list with account holders and a deputy, kept current when people leave.
• Portals are checked on a set frequency, and new announcements, revised requirements and quality alerts are logged and routed to an owner. Evidence: a check log and examples of alerts that became actions or register updates.
• Customer scorecards are downloaded and reviewed every period, and every missed quality or delivery target has a recorded action. Evidence: scorecards for the last twelve months with actions, owners and verified results.
• Customer satisfaction is monitored on the customer's own measures, such as delivered part quality, delivery performance, disruptions and field returns, and reviewed by management. Evidence: a performance summary per customer within the management review inputs.
• Complaint responses meet each customer's format and deadlines, and are submitted through the channel the customer specifies. Evidence: recent problem-solving reports with submission dates set against the customer's deadline.
• Any escalation a customer raises against the site is tracked to closure with an action plan. Evidence: the notice, the plan, progress reviews and the customer's confirmation that it is closed.

APQP and launch

Sample the most recent launch, not the best one. The auditor will ask for a part that started production in the current cycle.

• A product and process development process is defined that follows the APQP method or the planning approach a customer specifies, with phases, gates and a cross-functional team, and the edition of each reference manual the customer requires is recorded (AIAG issued the third edition of its APQP manual and a first edition of its Control Plan manual in 2024, and some customers still name earlier editions). Evidence: the launch procedure, a team list for a recent part and the manual editions noted in the CSR register.
• Manufacturing feasibility was assessed and recorded before the quotation or nomination was accepted. Evidence: a feasibility review signed by the functions involved.
• The customer's drawings, special characteristics and applicable CSRs were captured as inputs at the start of the project. Evidence: an input list for the sampled part, linked to the CSR register.
• A timing plan agreed with the customer is tracked, and each gate review records open risks, decisions and owners. Evidence: the timing plan and gate review records for the sampled part.
• Lessons learned from earlier launches, complaints and field returns were reviewed at the start of the project. Evidence: a lessons learned review cited in the kick-off or the first gate.

FMEA

Check the FMEA against the process that runs today, not the process that was quoted.

• A design FMEA exists where the site is design responsible, and a process FMEA exists for every part or part family made, in the method and format each customer requires. Evidence: an FMEA register by part family showing the method used and the customer requirement behind it.
• Each PFMEA follows the actual process flow, step by step, and was built by a cross-functional team rather than copied from another part. Evidence: a process flow diagram whose steps match the PFMEA, with team names by role.
• Special characteristics from the customer and from the site's own analysis are identified in the PFMEA with the customer's symbols. Evidence: matching special characteristic marks on the drawing, PFMEA, control plan and work instruction.
• High-risk causes have actions with owners and dates, and closed actions are reassessed. Evidence: action records and the revised risk ranking after implementation.
• PFMEAs are updated after complaints, field returns, internal nonconformities and process changes. Evidence: a revision history in which recent complaints appear as new or revised causes.

Control plan

Annex A of IATF 16949 sets the phases and elements of the control plan (A.1 and A.2). Walk to the workstation with the controlled copy in hand.

• A control plan exists for each part or part family at the right phase (prototype, pre-launch or production) and contains the elements the standard and the customer require. Evidence: control plans with their phase, revision and customer approval where the customer requires it.
• The PFMEA, the control plan and the work instruction for the sampled part agree with one another on characteristics, methods, frequencies and reactions. Evidence: the three documents side by side, with the same revision logic.
• Every control in the plan has a defined reaction plan, and operators can explain it. Evidence: reaction plans at the workstation and records of reactions used, such as quarantine tags.
• Error-proofing devices named in the control plan are verified at the frequency stated. Evidence: verification records using known bad parts, with the result and the action on failure.
• Job set-ups are verified as the control plan requires (8.5.1.3): first-off parts are checked, and where it applies first-off and last-off parts are compared and retained, before the run is released. Evidence: set-up verification records for the current shift, with the person who released the run and the parts or results retained.
• Temporary changes of process controls, such as a bypassed sensor or an alternative inspection, are approved, time-limited and listed. Evidence: the list of approved alternative controls, the risk analysis behind each and verification records while in use.
• The control plan is revised when the process, a gauge, a reaction plan or a customer requirement changes. Evidence: revision dates that line up with the change records.

Measurement system analysis

IATF 16949 asks for statistical studies on each type of inspection, measuring and test equipment system identified in the control plan (7.1.5.1.1). Start from the control plan, not from the gauge room.

• Every gauge or measuring system named in the control plan has a current MSA study suited to its type, variable or attribute. Evidence: a cross-reference from the control plan to the study for each measuring system.
• Acceptance criteria follow the reference manual or the customer's requirement, and gauges that fail have a recorded decision. Evidence: criteria in the MSA procedure and actions or customer approvals for failed studies.
• Studies are repeated when the gauge, method, operator population or process changes. Evidence: a study plan with triggers and repeat studies after recent changes.
• Gauges are calibrated or verified, and laboratories used for calibration meet the external laboratory requirements. Evidence: calibration records traceable to national or international standards and the laboratory's accreditation scope.
• When a gauge is found out of calibration, the effect on parts already shipped is assessed and the customer told where required. Evidence: out-of-calibration investigations with the product risk decision.

SPC and process capability

The standard expects manufacturing processes to be monitored for capability and performance (9.1.1.1). The control plan decides which characteristics are charted.

• Characteristics to be monitored statistically are chosen from the special characteristics, the PFMEA and the customer's requirements, and the choice is visible in the control plan. Evidence: control plan lines that state the statistical method and frequency.
• Initial capability studies were completed before approval, on the production process at production rate. Evidence: capability studies in the PPAP file, dated and tied to the production equipment.
• Ongoing capability or performance is reviewed against the customer's targets, with actions where it falls short. Evidence: periodic capability reports and the actions or containment that followed.
• Charts are live at the line, and every out-of-control signal has a recorded reaction. Evidence: charts from the current shift, with reaction notes for points outside the limits or trends.
• The statistical method and manual edition the customer expects are confirmed and applied. Evidence: the customer requirement in the CSR register and the method used in the SPC procedure.

PPAP, approval and change

The product approval process (8.3.4.4) follows each customer's rules. Most findings here are about changes made after approval.

• Every part supplied in production has a current customer approval at the submission level and in the format the customer specifies: the AIAG PPAP manual, VDA Volume 2 production process and product approval, or the customer's own procedure. Evidence: a PPAP status list by part number, with the customer's approval record for each.
• The full approval file is retained even where the customer asked only for a partial submission. Evidence: complete files for sampled parts, kept for the retention period the customer requires.
• Changes to product, process, location, tooling or sub-supplier are notified to the customer and approved before shipment where the customer requires it. Evidence: change requests with the customer's approval dated before the change went live.
• Layout inspection and functional verification are carried out at the frequency the control plan or the customer defines. Evidence: layout results for sampled parts, with the date and the results against the drawing.
• Purchased parts and materials carry their own approval from your suppliers where the customer or your procedure requires it. Evidence: supplier approval records for components of the sampled part.
• Any deviation or concession is authorised by the customer before nonconforming or altered product is shipped, and its expiry is tracked. Evidence: concession records with the customer's authorisation, quantity or date limits and the closure.

Competence, problem solving and internal audit

These items test whether the chain above keeps working after the consultants and the launch team have gone.

• Core tools competence is defined for each role that uses them: engineers, quality staff, supervisors and setters. Evidence: a competence matrix with the core tools named per role.
• People in those roles have evidence of competence, including on-the-job training where it applies. Evidence: training and assessment records for the people the auditor chooses.
• Internal auditors are competent in the core tools and in the CSRs of the customers they audit. Evidence: internal auditor competence records covering core tools and the customer requirements in scope.
• The manufacturing process audit covers all processes on all shifts over the three-year cycle and tests the PFMEA, control plan and CSR links on the floor. Evidence: the audit programme by process and shift, and reports that sample core tools records.
• Product audits (9.2.2.4) check finished parts against the drawing, the specification and the packaging and labelling requirements at the stages and frequency the site has defined, or the customer requires. Evidence: a product audit plan by part family and recent reports with the actions they triggered.
• Complaints follow the documented problem-solving process (10.2.3), and the lessons feed back into the FMEA, the control plan and the next launch. Evidence: closed problem-solving reports with verified effectiveness and the revised documents they triggered.
• Core tools and CSR performance reaches management review, including cost of poor quality, field failures and customer scorecards. Evidence: management review inputs and the decisions taken on them.

IATF 16949 internal audit: system, process and product audits