IATF 16949 First-Time Certification: The 6 Most Common Failures

The Six Most Common IATF 16949 Stage 2 Failures

1. Customer-specific requirements not identified or implemented. CSRs from subscribing OEMs (VW Group, Stellantis, GM, Ford, BMW Group, Toyota) are mandatory for suppliers to those customers. Organisations that have not downloaded, reviewed and gap-assessed their customers' current CSRs will have gaps that auditors specifically assess. This is the most common single finding across failed first-attempt IATF 16949 audits.
2. APQP not demonstrably applied. Advanced Product Quality Planning is required by IATF 16949 Section 8.3. Auditors assess whether APQP was applied to recent new product introductions — not whether an APQP procedure exists. Evidence of APQP milestone reviews, DFMEA and PFMEA development integrated with the design timeline, and customer approval of APQP outputs is required.
3. PFMEA and control plan inconsistencies. Process FMEA and the production control plan must be consistent: every special characteristic in the PFMEA must appear in the control plan with an appropriate monitoring method and reaction plan. Auditors cross-reference these documents systematically. Inconsistencies — especially for special characteristics — generate major findings.
4. SPC not implemented for special characteristics. Statistical Process Control for special characteristics is an IATF 16949 requirement. Many organisations have SPC capability in principle but have not applied it to characteristics designated special in their control plans. Current Cpk data demonstrating process capability for special characteristics must be available.
5. PPAP not completed for all active production parts. Production Part Approval Process submissions must be completed for all parts produced for IATF 16949-regulated customers. PPAP records must be current and maintained for the part life. Incomplete PPAP records for active parts is a consistent Stage 2 finding.
6. Internal audit does not cover all IATF 16949 requirements. The internal audit programme must cover all IATF 16949 requirements — including automotive-specific clauses and all applicable CSRs — within the audit cycle. An ISO 9001 internal audit programme extended with automotive labels but without genuine IATF 16949 expertise consistently misses automotive-specific requirements.

The CSR Compliance Gap — Most Common Root Cause

Customer-specific requirement non-compliance is the dominant finding category because most organisations underestimate the volume and specificity of CSR requirements. VW Group CSRs run to over 100 pages covering every aspect of the supply relationship. Stellantis, GM and Toyota CSRs each have specific requirements for APQP milestone approval, PPAP submission levels, and warranty management that differ from each other and from the IATF 16949 baseline.

The root cause is typically not ignorance of the requirement — it is the absence of a systematic CSR gap assessment conducted by someone who has read the actual CSR documents rather than a summary. The fix is straightforward: download current CSRs from iatfglobaloversight.org, conduct a systematic gap assessment for each OEM customer, and integrate findings into your QMS documentation.