IATF 16949 Internal Audit Checklist (Downloadable)
By the IgeraIndustria Quality & Compliance Team · October 2026 · 12 min read
An IATF 16949:2016 internal audit checklist must cover three audit types, not one: a quality management system (QMS) audit across the ISO 9001-based clauses 4 to 10, a manufacturing process audit, and a product audit. It also has to test the automotive-specific requirements (APQP, PPAP, FMEA, MSA, SPC and the control plan) and every applicable customer-specific requirement (CSR). Use it to self-assess before a certification body audit, not as a substitute for the standard's own text.
Why IATF 16949 needs more than an ISO 9001 checklist
IATF 16949:2016 is the automotive quality management standard published by the International Automotive Task Force. It is built on ISO 9001 and is used together with it: it adds automotive-specific requirements on top of the same clause structure (clauses 4 to 10). Organizations certified to it must also meet the customer-specific requirements of each OEM they supply. A generic ISO 9001 checklist therefore misses a large share of what an automotive auditor will test. If you need the base layer first, start with our ISO 9001 internal audit checklist, and see ISO 9001 vs IATF 16949 for the differences in detail.
The standard is also unusual in how it frames internal auditing. Rather than a single annual audit, it expects an audit programme built around three categories of audit, each with its own scope, method and auditor competence. Those categories shape the second half of this checklist.
The three internal audit types IATF 16949 expects
| Audit type | What it checks | Clause |
|---|---|---|
| QMS audit | Conformity of the whole QMS to the standard and to CSRs, using the process approach | 9.2.2.2 |
| Manufacturing process audit | Whether each production process is effective and runs as defined in the PFMEA, control plan and work instructions | 9.2.2.3 |
| Product audit | Conformity of finished product to specified requirements at appropriate stages of production and delivery | 9.2.2.4 |
The audit programme itself sits under 9.2.2.1. Practitioner sources describe a coverage expectation of the full QMS and all manufacturing processes within a three-year cycle, with audit activity every year. Treat that as guidance to confirm against the standard and your certification body, because the exact wording and your customers' CSRs can set tighter rules. Auditors are also expected to be competent for the audit type they perform, which is addressed in the support clauses.
The core tools and where they sit in the audit
The five core tools are not separate standards; they are the evidence trail the clauses expect. Auditors look for them to be linked, not merely present.
- APQP (advanced product quality planning): the cross-functional planning framework behind product and process development, mainly tested under clause 8.
- PPAP (production part approval process): evidence that the process can make conforming parts at rate, submitted to the customer where required. See PPAP and control plans explained.
- FMEA: the failure-mode analysis (design and process) that should drive the control plan. See FMEA documentation for industry.
- MSA (measurement system analysis): proof that gauges used for acceptance are adequate, tested under clause 7.1.5.1.1.
- SPC (statistical process control): ongoing monitoring of process stability and capability, with a reaction when signals appear.
The most common trace is circular: a customer complaint should lead to a PFMEA update, then a control plan update, then a changed gauge or SPC chart. If one link is missing, you have a finding.
The checklist: clause groups, evidence and rating
Use the right-hand column to rate each line as Conform (C), Minor (Mi) or Major (Ma). As a working convention, a minor is an isolated lapse that does not put the system at risk, and a major is a requirement that is absent or systemically ineffective, or that puts product conformity or a customer requirement at risk. Define these levels in your own audit procedure before you start. Questions are paraphrased, not quoted from the standard.
Clause 4 — Context of the organization (including customer-specific requirements)
| Audit question | Expected evidence | Conform / Minor / Major |
|---|---|---|
| Is the QMS scope defined, with the sites and processes included and any exclusions justified? | Scope statement, site list, process map | ☐ C ☐ Mi ☐ Ma |
| Are customer-specific requirements (CSRs) identified for every customer and included in the QMS scope? | CSR register per customer, mapping of each CSR to a procedure or control | ☐ C ☐ Mi ☐ Ma |
| Are the interactions of processes defined, including inputs, outputs, owners and performance indicators? | Process interaction map, process owner matrix, KPI definitions | ☐ C ☐ Mi ☐ Ma |
| Are remote or supporting functions (design centre, warehouse, distribution) assigned to the sites they support? | Site and function matrix, supporting-function agreements | ☐ C ☐ Mi ☐ Ma |
Clause 5 — Leadership
| Audit question | Expected evidence | Conform / Minor / Major |
|---|---|---|
| Has top management defined and communicated the quality policy and measurable objectives, including product and process targets? | Signed policy, objectives with owners, communication records | ☐ C ☐ Mi ☐ Ma |
| Are process owners assigned, and do they understand the performance of their process? | Appointment records, process KPI reviews | ☐ C ☐ Mi ☐ Ma |
| Is there evidence that top management reviews customer scorecards and complaint data, and acts on them? | Scorecards, minutes, assigned actions | ☐ C ☐ Mi ☐ Ma |
| Are responsibilities for product conformity and customer-requirement authority defined? | Job descriptions, escalation procedure, stop-ship authority | ☐ C ☐ Mi ☐ Ma |
Clause 6 — Planning
| Audit question | Expected evidence | Conform / Minor / Major |
|---|---|---|
| Are risks and opportunities identified and linked to actions, including risk analysis for key process dependencies? | Risk register, action tracking | ☐ C ☐ Mi ☐ Ma |
| Are contingency plans defined for events such as supply interruption, equipment failure or loss of utilities, and are they tested? | Contingency plans, test or review records | ☐ C ☐ Mi ☐ Ma |
| Are quality objectives measurable, with a plan for how they will be achieved? | Objective plan, monthly performance data | ☐ C ☐ Mi ☐ Ma |
Clause 7 — Support
| Audit question | Expected evidence | Conform / Minor / Major |
|---|---|---|
| Are competence requirements defined and verified for roles affecting product quality, including internal auditors? | Competence matrix, training records, auditor qualification records | ☐ C ☐ Mi ☐ Ma |
| Is measurement system analysis (MSA) applied to the gauges and test equipment listed in the control plan? | MSA studies, gauge R&R results, acceptance criteria | ☐ C ☐ Mi ☐ Ma |
| Are calibration and verification records maintained for all monitoring and measuring equipment, including employee-owned or customer-owned gauges? | Calibration register, certificates, out-of-tolerance impact assessments | ☐ C ☐ Mi ☐ Ma |
| Is documented information controlled, including customer standards and specifications, with a check for the latest revision? | Document register, customer-standard review log, revision-change records | ☐ C ☐ Mi ☐ Ma |
| Are awareness, work environment and housekeeping controlled where they affect product conformity? | Training matrix, area inspections, work instructions | ☐ C ☐ Mi ☐ Ma |
Clause 8 — Operation: planning, customer requirements and design
| Audit question | Expected evidence | Conform / Minor / Major |
|---|---|---|
| Is the product realization plan documented, with a cross-functional approach (APQP or equivalent) and defined milestones? | APQP timeline, team records, gate reviews | ☐ C ☐ Mi ☐ Ma |
| Are customer requirements reviewed and feasibility confirmed before commitment? | Contract-review and feasibility records | ☐ C ☐ Mi ☐ Ma |
| Are design and development inputs, outputs, verification and validation controlled, including special characteristics? | Design review minutes, special characteristics list, validation reports | ☐ C ☐ Mi ☐ Ma |
| Is the process FMEA (PFMEA) maintained, linked to the control plan and updated after changes, escapes and complaints? | PFMEA, control plan, revision history, link to complaint data | ☐ C ☐ Mi ☐ Ma |
| Does the control plan cover the required phases, reflect special characteristics and list reaction plans? | Control plans per product family, reaction plan evidence | ☐ C ☐ Mi ☐ Ma |
| Is the production part approval process (PPAP) completed and the customer's approval obtained where required? | PPAP packages, customer approvals, submission level records | ☐ C ☐ Mi ☐ Ma |
Clause 8 — Operation: purchasing and production
| Audit question | Expected evidence | Conform / Minor / Major |
|---|---|---|
| Are suppliers selected, monitored and developed according to risk, with the customer's directed-buy requirements respected? | Supplier register, scorecards, supplier audit and development plans | ☐ C ☐ Mi ☐ Ma |
| Is production controlled with work instructions, set-up verification, and preventive and predictive maintenance? | Set-up approval records, maintenance plans, tooling records | ☐ C ☐ Mi ☐ Ma |
| Is statistical process control (SPC) applied where required, with defined reactions to out-of-control signals? | SPC charts, capability studies, reaction records | ☐ C ☐ Mi ☐ Ma |
| Are identification and traceability maintained, including for nonconforming and suspect product? | Traceability tests, labelling, quarantine records | ☐ C ☐ Mi ☐ Ma |
| Are changes to process, product or supplier controlled, validated and, where required, approved by the customer? | Change requests, validation results, customer approval records | ☐ C ☐ Mi ☐ Ma |
| Is nonconforming product contained, with controls for rework, repair and customer concession or deviation? | NCR records, rework instructions, concession approvals | ☐ C ☐ Mi ☐ Ma |
Clause 9 — Performance evaluation
| Audit question | Expected evidence | Conform / Minor / Major |
|---|---|---|
| Are manufacturing process performance and capability monitored against the plan, with trends analysed? | Capability data, scrap and yield reports, trend analysis | ☐ C ☐ Mi ☐ Ma |
| Is customer satisfaction measured using customer scorecards and delivery, quality and special-status data? | Scorecards, escalation status, response records | ☐ C ☐ Mi ☐ Ma |
| Does management review include the required inputs, such as cost of poor quality, process effectiveness, field returns and customer feedback? | Management review minutes with data, assigned and tracked actions | ☐ C ☐ Mi ☐ Ma |
| Are internal audits scheduled by risk and performance, and do they cover the QMS, manufacturing processes and product? | Audit programme, audit reports, finding status | ☐ C ☐ Mi ☐ Ma |
Clause 10 — Improvement
| Audit question | Expected evidence | Conform / Minor / Major |
|---|---|---|
| Is there a structured problem-solving method, with containment, root cause, corrective action and a check for recurrence? | 8D or equivalent reports, root-cause evidence, effectiveness checks | ☐ C ☐ Mi ☐ Ma |
| Are lessons learned fed back into the PFMEA, control plan and design standards? | Updated PFMEA and control plan, lessons-learned log | ☐ C ☐ Mi ☐ Ma |
| Are warranty and field failures analysed and escalated into corrective action? | Warranty data analysis, returns analysis, linked actions | ☐ C ☐ Mi ☐ Ma |
| Is continual improvement planned and tracked rather than reactive? | Improvement plan, project records, KPI progress | ☐ C ☐ Mi ☐ Ma |
Manufacturing process and product audit block
These two audits are done on the shop floor, not in the office. Pick a process, follow it through, and compare what you see with the PFMEA, control plan and work instruction. Sample every shift where the process runs.
Manufacturing process audit (9.2.2.3)
| Audit question | Expected evidence | Conform / Minor / Major |
|---|---|---|
| Does the audit cover the process inputs, the process steps, the outputs and the supporting resources, as defined in the process map? | Process map, audit notes, observed inputs and outputs | ☐ C ☐ Mi ☐ Ma |
| Is the operator following the current work instruction, and is it consistent with the control plan? | Work instruction revision, control plan, direct observation | ☐ C ☐ Mi ☐ Ma |
| Are the set-up verification and first-off checks carried out and recorded? | Set-up sheets, first-off approval records | ☐ C ☐ Mi ☐ Ma |
| Are the controls and reaction plans in the control plan actually in use, including on every shift? | Shift-by-shift observations, completed check sheets | ☐ C ☐ Mi ☐ Ma |
| Are the PFMEA failure modes and detection controls reflected on the line? | PFMEA row traced to a physical control | ☐ C ☐ Mi ☐ Ma |
| Are special characteristics monitored as specified, and is the gauge used the one listed? | Special characteristics list, gauge ID check, MSA reference | ☐ C ☐ Mi ☐ Ma |
| Is nonconforming product segregated, identified and recorded at the point of production? | Quarantine area, red-tag records, NCR log | ☐ C ☐ Mi ☐ Ma |
Product audit (9.2.2.4)
| Audit question | Expected evidence | Conform / Minor / Major |
|---|---|---|
| Is the audit plan based on customer-specified or internally defined characteristics, at appropriate stages? | Audit plan, sampling basis, customer requirements | ☐ C ☐ Mi ☐ Ma |
| Does the finished product meet dimensional, functional, appearance and packaging requirements? | Inspection results, test records, packing check | ☐ C ☐ Mi ☐ Ma |
| Are the test and inspection methods the same as those validated for PPAP, and is the equipment calibrated? | PPAP reference, calibration status | ☐ C ☐ Mi ☐ Ma |
| Are the product findings fed back into containment and corrective action? | NCR, 8D or equivalent link, PFMEA update | ☐ C ☐ Mi ☐ Ma |
Customer-specific requirements: the prompt every auditor should use
CSRs are the clause most often under-audited because they live in different places for each OEM. For every customer you supply, ask the following during the audit and record the answers:
- Which version of the customer's CSR document is in force, and where is it stored under document control?
- Has each CSR been mapped to a procedure, process or record, and who owns it?
- When the customer changes its CSRs or portal rules, how are you informed and how is the change deployed?
- What is the current customer scorecard status, and is any special status (such as a controlled-shipping stage) active?
- Are there customer-specific rules on PPAP submission level, change approval, labelling or approved supplier lists?
What certification bodies will look at: IATF Rules, 6th edition
Certification is governed by the IATF Rules, now in the 6th edition. Certification bodies publish summaries of what changed. The points consistently reported include a surveillance cycle of two audits in three years, at 12-month intervals with a tolerance of about three months, and tighter eligibility rules for extended manufacturing sites. Because the exact obligations and how they apply to your certificate depend on your contract and certification body, confirm them directly with your certification body and the official IATF documents instead of relying on a summary. Whatever the cycle, an effective internal audit programme should keep you ready for these external audits.
Common mistakes that surface in audits
- Audit programmes that only audit the QMS: the process and product audits are missing or thin.
- PFMEA and control plan out of sync: a complaint or escape was closed but neither document was updated.
- MSA that does not match the gauges in use: studies exist for old gauges, but the line uses another.
- CSRs not mapped to controls: the register lists them, but nobody can show where each is implemented.
- One shift audited: night and weekend shifts run differently and are never observed.
- Problem solving without effectiveness checks: an 8D is closed without confirming the problem stopped. For wording of findings, see writing nonconformities that close first time, and for audit failure patterns, why ISO 9001 audits fail.
Turning the checklist into an audit-ready habit
The slowest part of an IATF audit is not choosing the questions, it is finding the evidence: the latest control plan revision, the PPAP approval, the CSR page that applies to this part. Teams lose hours in shared drives, and auditors notice. A small factory can start with the 30-person factory internal audit checklist, and the automotive supplier quality documentation hub shows how to organize the document set.
This is the gap IgeraIndustria is built to close. Your quality team can ask a direct question, such as "which control plan revision applies to this part?" or "what does the customer manual say about change approval?", and get an answer sourced from your own documents with the exact source cited. The traceability an IATF auditor tests for is available on the spot. Sister checklists are available for ISO 13485 and ISO 17025.
Make your automotive QMS instantly searchable
IgeraIndustria connects your control plans, PFMEAs, PPAP files, customer manuals and audit history, so any question gets an answer with an exact source before the auditor asks it.
Discover IgeraIndustriaFrequently asked questions
How often must IATF 16949 internal audits be carried out?
The standard requires an internal audit programme covering the QMS, manufacturing processes and product. Practitioner guidance describes full coverage of the QMS and of all manufacturing processes within a three-year cycle, with audits each year, but your customers' CSRs or your certification body may require more. Base the frequency on risk and performance, and confirm it in your audit procedure.
Is IATF 16949 an ISO standard?
No. It is published by the International Automotive Task Force and is built on, and used together with, ISO 9001. It adds automotive-specific requirements to the ISO 9001 structure, and certification is issued by IATF-recognized certification bodies under the IATF Rules.
What is the difference between a manufacturing process audit and a product audit?
A manufacturing process audit examines how a process is run: the inputs, controls, work instructions and reaction plans. A product audit examines the finished product against its specification. Both are required in addition to the QMS audit, and each should feed back into the PFMEA and control plan.
What are customer-specific requirements and how do I audit them?
CSRs are additional requirements set by individual OEMs, on top of the standard. Audit them by listing every CSR document in force, mapping each to a process or record, and sampling evidence of implementation. Review them again whenever a customer revises its documents.
Who can perform an IATF 16949 internal audit?
Auditors must be competent for the audit type they perform, and should be independent of the area they audit. Many organizations qualify separate system, process and product auditors and keep records of their qualification.
Can this checklist replace the IATF 16949 standard?
No. The questions here are paraphrased summaries to guide a self-assessment. Obtain the current standard, your certification body's criteria and every applicable CSR, and treat those as authoritative.
How should audit findings be rated?
Define your own criteria for minor and major findings in your audit procedure. A common convention treats a major as an absent or systemically ineffective requirement, or a risk to product conformity, and a minor as an isolated lapse. Link every finding to your problem-solving process and verify effectiveness.
Important notice
This article is a practical self-assessment aid and does not constitute certification, legal or regulatory advice. It is not a substitute for the full text of IATF 16949:2016, the IATF Rules, or your certification body's and customers' own requirements. Clause references are provided for orientation and questions are paraphrased; always verify the exact wording against the current published documents.
Summary
- IATF 16949:2016 builds on ISO 9001 clauses 4 to 10 and adds automotive requirements, so an ISO 9001 checklist alone is not enough.
- Plan three internal audit types: QMS, manufacturing process and product audits.
- Test the links between APQP, PPAP, FMEA, MSA, SPC and the control plan, not just their existence.
- Map every customer-specific requirement to a control and an owner, and confirm certification rules with your certification body.
- Making your documents instantly searchable with exact citations turns audit preparation into a routine check.
Last updated: October 2026 | Reference: IATF 16949:2016 — Quality management system requirements for automotive production and relevant service parts organizations | Author: IgeraIndustria Quality & Compliance Team | IgeraIndustria. This checklist is a summary aid; where it differs from the current published standard or your certification body's requirements, those sources take precedence.