IATF 16949 internal audit: how to run system, process and product audits across every shift

What does IATF 16949 require of internal audit?

An IATF 16949 internal audit is your plant checking itself from three angles: whether the management system works, whether each manufacturing process runs the way the control plan says, and whether the finished part meets every requirement the customer set. ISO 9001 supplies the base, a planned programme of audits that are objective and impartial, with results reported to the managers responsible and nonconformities corrected. IATF 16949 then splits that base into three audit types, each with its own coverage rule.

The clause-by-clause picture of the whole standard sits in our guide to IATF 16949 requirements; this guide stays with how the three audits are planned, staffed, conducted and closed.

How do you build a three-year audit programme?

The programme is a map of what gets audited, when, by whom and why. Start from the list of QMS processes and the list of manufacturing processes, then add the part families that product audits will sample. Each line on the map gets a priority drawn from evidence rather than habit: customer complaints and scorecard results, internal and field failures, previous audit findings, process changes, new launches and the special characteristics in your PFMEAs.

Three years is the outer limit, not the target. A process with a warranty return last quarter, a new press line or a customer on a controlled-shipping watch belongs near the front of the queue. The plan must never leave a shift out: the night shift runs the same control plan with fewer engineers around.

The table below is Sterling's recommended pattern for the first year at a two-shift site with one main product line. It is an example to adapt, not a rule of the standard.

Who can audit: competence and independence

IATF 16949 sets a dedicated requirement for internal auditor competency in 7.2.3, on top of the ISO 9001 condition that audits stay objective and impartial. In practical terms, a system auditor needs to understand the automotive process approach and the customer-specific requirements that apply to your site; a process auditor must be able to read a PFMEA and a control plan and judge whether the reaction plan would work at three in the morning; a product auditor must know the drawing, the gauges and the acceptance criteria. Working knowledge of the core tools runs through all three roles, and the IATF treats core tools auditing as a required competency in its own scheme.

Independence is simpler to state than to arrange on a small site. Nobody audits their own work, so the moulding supervisor audits assembly and the quality engineer who wrote the control plan does not audit the line it controls. Record how each auditor's competency was established and maintained.

The tools themselves are explained in the core tools guide, and the customer rules auditors check against in customer-specific requirements.

How are system, process and product audits conducted?

The system audit

Take one process at a time and follow it end to end: its inputs, outputs, owner, measures, risks and the records it produces. Trace one customer requirement from the CSR register to the record that proves it was met.

The process audit

Stand at the line with the control plan and the PFMEA open. Check that the characteristics listed are the ones being measured, at the frequency stated, with the gauge named and a valid measurement study behind it. Ask the operator what happens when a reading goes out of limits, then compare the answer with the reaction plan. Check first-off and last-off records and the bypass list, then repeat on the other shifts.

The product audit

Pull parts that have passed every check and measure them again, independently, against the full drawing and specification: dimensions, material, appearance, function, packaging and labelling. Its value is catching what routine checks miss.

Sampling, findings and follow-up

Pick records from different months, shifts and part numbers, and choose some yourself rather than taking the folder you are handed.

Every finding states three things: the requirement, the objective evidence and the gap between them. "Control plan requires hourly bore check; night shift records on 14 and 15 August show four-hourly entries" can be acted on. "Control plan not followed" cannot. Link each one to the process owner who will close it.

Closure runs through the documented problem-solving process required by 10.2.3, whether that is 8D or your customer's own format: containment where product is at risk, a verified root cause, corrective action, and a check some weeks later that the fix held. Audit results, open findings and their trend are then inputs to the management review, alongside the cost of poor quality, warranty and field data required by 9.3.2.1.

How does the internal audit differ from the certification audit?

Your internal audit runs on your risks and your timetable. The certification audit is carried out by an IATF-recognised certification body under the IATF Rules, 6th Edition, starting with an on-site stage 1 readiness assessment and followed at least twenty calendar days later by the stage 2 audit with production running. Its findings come with fixed response deadlines: fifteen calendar days for the first response to a major nonconformity and sixty for a minor one.

The two meet in one place. The certification body examines your internal audit programme as part of its audit, so gaps in shift coverage, auditors without evidence of competency or findings left open for months become its findings too. The full certification sequence is set out in IATF 16949 certification under the Rules.

What records prove the programme works?

• The three-year programme, showing every QMS process, every manufacturing process on every shift and the product audit plan, with the risk reasoning behind the order.
• Completed reports with the sample taken, the evidence seen and each finding written as requirement, evidence and gap.
• Problem-solving records showing root cause, action and verified effectiveness for each finding.
• Auditor competency records and the independence assignment for each audit.
• Management review minutes that discuss audit results and decide something about them.

Which of these are mandatory documented information and which are simply good practice is covered in IATF 16949 documentation.

IATF 16949 internal audit: questions buyers ask