Key takeaways
  • IATF 16949 is not standalone. It applies alongside ISO 9001 and adds automotive-specific requirements on top.
  • It assumes the core tools: APQP, PPAP, FMEA, MSA and SPC. These are expected competencies, not optional extras.
  • Customer-specific requirements are a formal part of the standard, and failing to track them per customer is a common finding.
The part people miss
Customer-specific requirements are auditable

Each OEM publishes its own additional requirements, and the standard obliges you to identify, communicate and comply with them. An otherwise sound system fails audits because nobody maintains a per-customer requirement matrix.

What it adds to ISO 9001

  • Product safety requirements, with defined controls and personnel responsibilities.
  • Risk analysis extended into contingency planning for interruptions in supply.
  • Embedded software controls, including a development assessment for products containing software.
  • Warranty management, including analysis of no-trouble-found returns.
  • Total productive maintenance requirements for manufacturing equipment.
  • Specific requirements for laboratory scope and for internal auditor competence.
  • Layered process audits and a defined manufacturing process audit approach.

The core tools

APQP structures new product introduction. PPAP is the approval evidence pack. FMEA drives risk identification. MSA validates measurement. SPC monitors stability. The standard does not teach these; it assumes you have them and audits their outputs, which is why organisations coming from ISO 9001 alone often underestimate the gap.

Contingency planning

This requirement catches people out. You need documented plans for utility interruptions, labour shortages, key equipment failure, field returns and supplier disruption, and you must test them periodically. A plan that has never been exercised is treated as a plan that does not exist.

Common nonconformities

  • No structured tracking of customer-specific requirements.
  • Contingency plans not tested, or not covering the required scenarios.
  • Internal auditors without demonstrated competence in the core tools and the automotive process approach.
  • Layered process audits not performed at the required layers or frequency.
  • Control plans and FMEAs not updated after process changes.
  • Total productive maintenance limited to reactive work with no predictive element.

Practical preparation

Build a requirement matrix per customer and assign an owner. Run the contingency tests and record them. Make layered process audits a scheduled recurring activity with the results visible, because sporadic evidence is worse than none. And keep the FMEA, control plan and process flow synchronised, since auditors compare all three deliberately.