IATF 16949 Audits: What Goes Beyond ISO 9001

Updated 30 September 2026. This article has been rewritten and now rests entirely on primary sources from the IATF, VDA and the OEMs. Several earlier statements were corrected along the way: the 12-month surveillance interval is an option, not a requirement; the percentage thresholds for VDA 6.3 grading have been removed because they cannot be verified from free sources; and what was created in 1999 was ISO/TS 16949, not IATF 16949.

Anyone moving from ISO 9001 into automotive supply routinely underestimates how much extra audit work IATF 16949 brings. Not because the management system is different, but because the automotive standard tightens things exactly where it matters on the shop floor: which audits exist, how often, on which shifts — and by whose method.

What IATF 16949 is

IATF 16949 is not a standalone standard; it supplements ISO 9001 and is only applied together with it. The International Automotive Task Force first created ISO/TS 16949 in 1999 to harmonise the different assessment and certification systems in the global automotive supply chain; after editions in 2002 and 2009, IATF 16949:2016 replaced that specification [1]. The first edition was published in October 2016 [3] and absorbed a number of previously customer-specific requirements into the text [1].

The second edition has been announced for mid-2027, with its transition ending alongside the ISO 9001 transition [9]. What that means for planning is covered in IATF 16949, 2nd edition.

Three audit types instead of one

ISO 9001 knows one internal audit type. IATF 16949 distinguishes three in 9.2.2.2 to 9.2.2.4, each with its own rhythm [2][3][10]:

Three clarifications from the IATF matter most in practice:

• Not every audit has to cover every shift. A process can be audited on shifts one and two, including handover, in one year, and on shift three the next — as long as all shifts are covered within three years [3].
• Three years is the floor, not the norm. If a manufacturing process fails to meet any relevant requirement — statutory, customer, process or internal — it has to be audited more often than every three years [3].
• Frequency needs a justification. For the system audit, the IATF explicitly requires the organization to be able to justify the audit frequency assigned to its processes [2].

A product audit is more than a dimensional check: it can cover dimensional, functional and material requirements, on finished or partially finished product, including packaging and labelling [3]. A layout inspection under 8.6.2 — the complete measurement of all dimensions on the design record — is limited to dimensions [3].

The certification audit under Rules 6th Edition

How certification bodies audit IATF 16949 is governed not by the standard but by the IATF Rules. The 6th edition was published in April 2024 and has applied since 1 January 2025 [4]. The IATF’s freely available clarifications contain several points that affect suppliers directly [5]:

• At least 30 percent of audit time on the manufacturing floor. If not enough manufacturing processes are running during the planned audit to achieve that, the audit has to be postponed — not shortened.
• Surveillance interval. Alongside the existing intervals, a 12-month rhythm is possible where the certification body and the organization agree to it; the total of surveillance audit days must still equal the initial audit days.
• Lead times. The audit date is confirmed at least 90 calendar days ahead, the audit plan sent at least 14 calendar days ahead, and at least 20 calendar days lie between the stage 1 and stage 2 audits.

Assessment: the 30 percent rule changes preparation more than anything else. Schedule the certification audit in a week with a plant shutdown or stocktake and you risk a postponement.

VDA 6.3: the standard for process audits

IATF 16949 prescribes no method for the process audit; it requires the customer’s [3]. In the German context that usually means VDA 6.3. The volume was first published in 1998 and revised in 2010 and 2016; the current version is the 4th edition of January 2023 [6]. According to VDA, the following have remained the same across editions [6]:

• the structure of process elements, of which P2 to P7 apply depending on the audit, and the turtle model for describing processes,
• the scoring model for individual questions with 10, 8, 6, 4 or 0 points,
• the A, B and C classification of the overall result and the downgrading rules.

New in the 2023 edition are, among other things, software aspects in the question catalogue, requirements on purchasing activities in P3 and P4, more precise auditor qualification and guidance on remote audits; the questions of particular importance (the “*-questions”) were partly redefined. The chapter on the audit process was dropped because ISO 19011 covers it [6]. One VDA note matters for multi-year comparisons: results under the 2023 edition are not directly comparable with those under the 2016 edition [6].

Assessment: anyone tracking process audit results as a metric over several years should mark the change of VDA edition in the series — otherwise a change of method looks like a change in performance.

Layered process audits: mandatory through the customer

Layered process audits (LPA) — short, recurring checks of standardised work by several levels of the hierarchy — are not part of IATF 16949. They become binding through customer requirements. General Motors requires, in its customer-specific requirements for 9.2.2.3, an internal LPA process led by competent managers, including among other things [7]:

• a schedule with frequency and locations,
• layers that include different levels of employees up to top management,
• a trigger on the causing process whenever customer complaints or rejections occur,
• findings that are recorded and measured for improvement, with an action plan for anything that cannot be corrected during the audit,
• questions reviewed periodically to target the organization’s weaknesses,
• LPA as part of verifying corrective actions.

On top of that, GM requires annual assessments of certain special processes against the current AIAG CQI standards and an annual QMS gap assessment per manufacturing location [7].

Customer-specific requirements: where it really gets stricter

The IATF publishes the customer-specific requirements (CSRs) of the participating OEMs in one place [8]. They make individual clauses more specific or go beyond them — GM’s LPA requirement is one example, Ford’s 8D rules with a 24-hour response and an 8D after 15 calendar days another [8]. System audits under 9.2.2.2 have to sample these requirements too [2].

Whether an 8D report is mandatory is therefore also the customer’s decision; IATF 16949 10.2.3 requires a problem-solving process, not a specific method. Details are in the article on the 8D report per VDA Band 8D.

What this means for the audit programme

From an ISO 9001 starting point, the programme grows in three directions:

1. Three audit types, three cycles. System, process and product audits each need their own planning and a coverage overview across the three-year cycle.
2. Shifts and handovers as a planning dimension. For each manufacturing process it must be traceable which shifts were audited when.
3. Justified frequency, not calendar. Document the rationale for each process’s frequency — the IATF explicitly requires it [2], and three years is only acceptable for low-risk, compliant processes [3].

Add to that a maintained list per customer of the CSRs in force and their revision, because those documents change independently of the standard. How to build an audit programme in general is covered in the audit programme planning guide; the ISO 9001 9.2 requirements are summarised in the internal audit checklist.

Where qportal fits

In qportal, audit types and rating schemes are master data: a process or product audit can run as its own audit type with its own question catalogue, and rating options can carry point values. Every audit hangs off a programme, every finding off an audit criterion, and findings lead via 5 Whys or 8D to actions with an effectiveness review. To be plain about it: a ready-made VDA 6.3 catalogue with A/B/C grading and downgrading rules, and shift planning in the audit programme, are not part of the product today. More on the IATF 16949 and audit management pages.

Conclusion

IATF 16949 does not change the principle of auditing, but it changes pace and depth: three audit types with a three-year cycle as the floor, all shifts, justified frequencies, a certification audit with at least 30 percent shop-floor time — and above all that the customer requirements that make methods like VDA 6.3, 8D or layered process audits binding in the first place. Read the standard without your customers’ CSRs and you know half of it.

Sources

1. IATF: IATF 16949:2016 — About. On the origins of ISO/TS 16949 (1999, 2002, 2009) and its replacement by IATF 16949:2016. https://www.iatfglobaloversight.org/iatf-169492016/about/ (accessed 2026-09-30)
2. IATF: IATF 16949:2016 — Sanctioned Interpretations (SIs). Status November 2025, including SI 14 on clause 9.2.2.2. https://www.iatfglobaloversight.org/wp/wp-content/uploads/2025/11/IATF-16949-SIs-Nov-2025.pdf (accessed 2026-09-30)
3. IATF: IATF 16949:2016 — Frequently Asked Questions (FAQs). Status June 2026, including FAQs 19 and 28 on 9.2.2.3, FAQs 20 and 22 on 9.2.2.4, FAQ 21 on 8.6.2. https://www.iatfglobaloversight.org/wp/wp-content/uploads/2026/06/IATF-16949-FAQs_June-2026.pdf (accessed 2026-09-30)
4. IATF: Rules for achieving and maintaining IATF recognition, 6th Edition — Sanctioned Interpretations. Status June 2026; states publication (April 2024) and effective date (1 January 2025). https://www.iatfglobaloversight.org/wp/wp-content/uploads/2026/06/IATF-Rules-6th-Edition_Sanctioned-Interpretations-June-2026.pdf (accessed 2026-09-30)
5. IATF: Rules 6th Edition — Certification Body Q&A Session, 19 November 2024. Q&A document, December 2024; sections 5.1.1, 5.2, 5.7.2 and 6.2.9. https://www.iatfglobaloversight.org/wp/wp-content/uploads/2024/12/Rules-6th-QA-Document_English-December-2024.pdf (accessed 2026-09-30)
6. VDA QMC: Band 6 Teil 3 — Prozessaudit (VDA 6.3 process audit). 4th revised edition, January 2023; product page with summary of changes. https://webshop.vda.de/QMC/de/band-06-teil-03_ausgabe-2023_de (accessed 2026-09-30). The volume itself is paid.
7. General Motors: Customer Specific Requirements for IATF 16949. Effective 2025-10-30, clauses 9.2.2.2 and 9.2.2.3. https://www.iatfglobaloversight.org/wp/wp-content/uploads/2025/10/IATF-16949-GM-Customer-Specific-Requirements-October-2025.pdf (accessed 2026-09-30)
8. IATF Global Oversight: Customer Specific Requirements (index), including Ford Motor Company, Customer Specific Requirements for IATF 16949:2016, effective June 2026. https://www.iatfglobaloversight.org/oem-requirements/customer-specific-requirements/ (accessed 2026-09-30)
9. IATF Global Oversight: IATF Stakeholder Communiqué, REF 005: IATF 16949 2nd edition update information. July 2026. https://www.iatfglobaloversight.org/wp/wp-content/uploads/2026/07/Stakeholder-Communique-SC-2026-005_IATF-16949-2nd-Edition-status.pdf (accessed 2026-08-24)
10. IATF: IATF 16949:2016 — Automotive Quality Management System Standard. First edition, October 2016. Paid; consulted for clauses 9.2.2.2 to 9.2.2.4 and 10.2.3, paraphrased.

Consultancy, certification-body and content-marketing pages are not cited. IATF 16949 and the IATF Rules are paid documents; requirements are evidenced here through the IATF’s freely published interpretations, FAQs and Q&A documents and paraphrased. Where this text goes beyond the documented evidence, it is marked as an assessment.