IATF 16949 and the quality system

A supplier cannot sell a part to a vehicle manufacturer on the strength of the part being good. It has to demonstrate that the system that made the part is capable of making the next hundred thousand the same way. That is what IATF 16949 is, and almost everything in it follows from that one shift of attention.

An auditor at a shop floor workstation with a clipboard and a tablet, reviewing a control plan pinned at the station alongside the operator, with a rack of finished parts and a torque tool display in view and the process flow chart posted on the pillar behind. — The audit happens at the station, not in the office. The question is whether what is posted here is what actually happens.

It is a supplement, not a replacement

Three layers, and the outer one usually bites hardest. A supplier serving four manufacturers is running four overlapping sets of rules.

IATF 16949 contains only the automotive additions. For everything underneath — context, leadership, planning, competence, operations — it refers to ISO 9001. So:

You cannot be certified to IATF 16949 alone.
A gap analysis against IATF 16949 by itself is incomplete.
The two documents are read side by side, which is why the clause numbering matches.

The additions themselves are where the automotive character lives: product safety, embedded software, layered process audits, supplier development, contingency planning, and a far heavier emphasis on prevention than on inspection.

Scope, including the places nothing is made

Remote supporting functions — design, purchasing, sales, engineering — cannot be excluded from the audit scope. Decisions taken there determine whether the product conforms, so a certificate that covered only the machines would be misleading.

Such locations are audited as part of the manufacturing site they support, rather than certified separately. A design office cannot hold its own IATF certificate.

The five core tools, as a chain

The tools are usually listed. They are better understood as a sequence, because each one consumes the output of the last.

Each tool consumes the output of the one before it. Take one out and the next has nothing to work from.

Tool	Question it answers
APQP	What has to happen, in what order, before we can ship?
FMEA	What could go wrong, and which of those matter most?
Control plan	For each of those, what control, how often, and what do we do when it triggers?
MSA	Can we trust the measurement the control plan relies on?
SPC	Is the process actually capable, and is it staying that way?

Pull one out and the next has nothing to work from. A control plan with no FMEA behind it is a list of checks somebody thought of; SPC on a measurement system that has never been through MSA is charting the gauge as much as the process.

The things that get raised in audits

Not the exotic clauses. The same handful, every time:

Management review without decisions. The specified inputs are presented, nothing is decided, no resource is allocated. The agenda was satisfied and the requirement was not.
Complaints closed on containment. Sorting and shipping good parts protects the customer; it is not corrective action, and the effectiveness verification step exists to catch exactly this.
Documents that do not match the floor. A control plan revision that the station never received.
Error proofing verification not recorded — see error proofing and traceability.
CSRs not demonstrably deployed into the actual procedures.

Suppliers who are not certified

The standard makes the organisation responsible for what it buys, including from suppliers too small to be certified. What is expected is a documented development path — monitoring, escalation, a target — not a blanket refusal to buy and not an unmonitored exemption.

Special status, and why concealing it is worse

When a customer formally notifies a quality or delivery problem, the supplier is on special status. That has certification consequences: the certification body must be told and may bring forward or extend an audit.

Not disclosing it is itself a serious finding, because the standard requires the status and the associated performance data to be available. The instinct to keep it quiet until it is resolved converts a process problem into a certificate problem.

What to take away

IATF 16949 is a supplement to ISO 9001 — both apply, and it cannot be certified alone.
Customer specific requirements sit above the standard and are auditable.
Remote supporting functions are in scope and cannot hold their own certificate.
The five core tools form a chain: APQP, FMEA, control plan, MSA, SPC.
A control plan with no FMEA behind it is just a list of checks.
Management review needs decisions and resources, not just the agenda.
Containment is not corrective action. Effectiveness has to be verified.
Layered process audits trade depth for frequency and management presence.
Uncertified suppliers need a development path, not an exemption.
Special status must be declared; concealing it is its own finding.
A certificate and a scorecard measure different things and can disagree.