IATF 16949 Clause 9.2 Internal Audit: Complete Practical Guide

IATF 16949 Clause 9.2 Internal Audit defines the requirements related to internal auditing in the automotive industry. Internal audits help an organization determine whether its Quality Management System (QMS), manufacturing processes and products conform to applicable requirements and whether those requirements are effectively implemented.

In automotive manufacturing, an internal audit is much more than checking whether a procedure, format or record is available.

A document may exist, but the actual process on the shop floor may be different.

For example, an organization may have an approved PFMEA, Control Plan and work instruction for a machining operation. However, if the operator is not following the specified process parameters, the inspection frequency is not being followed, or the reaction plan is not implemented when an abnormal condition occurs, simply having those documents does not demonstrate effective implementation.

This is why internal auditing is important.

A properly planned audit programme should cover the Quality Management System, manufacturing processes and products, with audit priorities determined using factors such as risk, process criticality, internal performance, external performance, process changes and customer complaints.

This guide explains IATF 16949 Clause 9.2 Internal Audit in practical language, including the internal audit programme, QMS audit, manufacturing process audit, product audit, risk-based audit planning, three-year coverage, shift auditing, PFMEA and Control Plan verification, customer-specific requirements, practical audit questions, common mistakes and FAQs.

Important: This article is intended as a practical learning guide. For compliance decisions, always refer to the current applicable IATF 16949 requirements, ISO 9001 requirements, customer-specific requirements and your organization’s approved procedures.

What is IATF 16949 Clause 9.2?

IATF 16949 is the automotive Quality Management System standard used by organizations involved in the automotive supply chain.

Clause 9.2 deals with Internal Audit.

The purpose of internal auditing is to provide an organized method for checking whether the organization’s management system and relevant processes are:

Conforming to applicable requirements
Properly implemented
Maintained
Effective
Performing as intended

The automotive requirements also place specific emphasis on auditing:

Quality Management System processes
Manufacturing processes
Products

Therefore, an automotive organization’s internal audit programme should not focus only on the quality department.

It should consider the complete system and the processes that affect product and process performance.

Why is Internal Audit Important in Automotive Manufacturing?

Automotive manufacturing involves many interconnected processes.

A typical organization may have:

Customer requirements
Product development
APQP
Supplier management
Incoming inspection
Manufacturing
Tooling
Maintenance
Quality control
Laboratory activities
Measurement systems
Training
Corrective action
Customer complaint handling
Final inspection
Packing and dispatch

A weakness in one process can affect another process.

For example:

Poor supplier control → Material variation → Manufacturing problem → Rejection → Customer complaint

Similarly:

Incorrect process parameter → Defective component → Inspection failure → Rework or customer rejection

An effective internal audit can help identify weaknesses before they become larger problems.

Internal Audit Is Not Just Document Checking

One of the most important principles of an effective automotive internal audit is to verify actual implementation.

Consider an automotive component manufacturer producing machined shafts.

The company has:

Approved Process Flow
PFMEA
Control Plan
Work Instructions
Inspection equipment
Trained operators

At first glance, the process may appear to be fully controlled.

However, the auditor should go to the actual process and verify whether the documented controls are being followed.

The auditor may check:

Is the operator following the approved work instruction?
Are the specified machine parameters being maintained?
Are critical characteristics identified correctly?
Is the Control Plan being followed?
Is inspection being performed at the specified frequency?
Are inspection records complete?
Is the reaction plan followed when a defect is detected?
Are previous audit findings effectively closed?
Is the actual process consistent with the PFMEA?
Are changes properly controlled?

This demonstrates an important principle:

An internal audit should verify implementation and effectiveness, not simply the existence of documents.

Clause 9.2.1 and 9.2.2 – Internal Audit Requirements

IATF 16949 Clause 9.2.1 and Clause 9.2.2 contain the applicable internal audit requirements associated with ISO 9001 and additional automotive requirements.

In simple terms, an organization needs to establish, implement and maintain an internal audit programme.

The audit programme should provide evidence that the Quality Management System is:

Conforming to applicable requirements
Effectively implemented
Maintained
Reviewed for effectiveness

The automotive-specific requirements further address:

QMS audits
Manufacturing process audits
Product audits

Therefore, an automotive organization should develop its audit programme by considering both the applicable ISO 9001 requirements and the additional IATF 16949 requirements.

What is an Internal Audit Programme?

An internal audit programme is the planned system used by an organization to determine:

What will be audited
When it will be audited
Who will conduct the audit
Which criteria will be used
How the audit will be performed
How findings will be recorded
How corrective actions will be followed up
How effectiveness will be verified
How the overall programme will be reviewed

The audit programme should cover the organization’s applicable QMS processes, manufacturing processes and products.

It should not be treated simply as a yearly calendar.

A good audit programme should be risk-based and performance-based.

Clause 9.2.2.1 – Internal Audit Programme

Clause 9.2.2.1 addresses the internal audit programme.

The organization needs a documented internal audit process that explains how internal audits are planned, conducted, reported and followed up.

The internal audit programme includes three important types of audits:

Quality Management System audits

Manufacturing process audits

Product audits

The programme should be prioritized based on factors such as:

Risk
Internal performance trends
External performance trends
Process criticality

Audit frequency should also be reviewed and adjusted where appropriate based on relevant changes, internal and external nonconformities and customer complaints.

The effectiveness of the internal audit programme should be reviewed as part of management review.

Documented Internal Audit Process

The organization should define its method for conducting internal audits.

Depending on the organization’s system, the documented procedure may address:

Audit programme preparation
Auditor competency
Auditor independence or objectivity as applicable
Audit planning
Audit checklist preparation
Audit execution
Collection of objective evidence
Finding classification
Audit reporting
Corrective action
Corrective action follow-up
Effectiveness verification
Audit programme review

The procedure should reflect the organization’s actual way of working.

There is little value in having a detailed audit procedure that does not match what auditors actually do.

The Audit Programme Should Cover the Entire QMS

The internal audit programme should provide coverage of the applicable Quality Management System processes.

For example, an automotive organization may have processes such as:

Quality planning
Customer management
Purchasing
Supplier management
Incoming inspection
Production
Maintenance
Calibration
Training
Corrective action
Internal audit
Management review
Final inspection
Product release
Customer complaint handling

The exact process list will depend on the organization’s QMS.

The important point is that the audit programme should not repeatedly focus only on a few familiar departments while leaving other applicable processes outside the audit programme.

Risk-Based Internal Audit Planning

Risk-based planning is an important part of an effective internal audit programme.

Not every process necessarily has the same level of risk.

For example, a critical machining operation producing a safety-related characteristic may require greater audit attention than a process with stable performance and low risk.

Risk-based planning may consider:

Process risk
Process criticality
Customer complaints
Internal rejection
Rework
Scrap
Previous audit findings
Process capability
New equipment
New tooling
Engineering changes
Process changes
Customer performance
Supplier performance
Recurring nonconformities

What is Process Risk?

Process risk refers to the possibility that a process may fail to achieve its intended results or produce nonconforming output.

For example:

A machining process repeatedly produces a critical dimension outside specification.

This represents a process risk.

Another example:

A welding process has repeated defects that have resulted in customer complaints.

This process may require increased audit attention.

A newly installed machine may also require additional attention because the process has changed and the organization may not yet have sufficient historical performance information.

Internal Performance Trends

Internal performance trends are patterns that can be identified from the organization’s own data.

Examples include:

Increasing rejection
Increasing rework
Increasing scrap
Recurring internal nonconformities
Reduced process capability
Repeated machine breakdown
Repeated inspection failures
Increasing downtime
Recurring operator errors

These trends can be used when reviewing the audit programme.

For example, if rejection from a particular manufacturing process has increased for three consecutive months, the organization should consider whether the existing audit frequency remains appropriate.

External Performance Trends

External performance information can also influence audit planning.

Examples include:

Customer complaints
Customer rejection
Customer audit findings
Warranty-related quality information where applicable
Supplier-related quality issues
External performance concerns

Suppose a customer has reported repeated dimensional problems from a particular component.

The organization should consider whether the related manufacturing process, inspection controls and supporting processes require additional audit attention.

Example of Risk-Based Audit Prioritization

Imagine an automotive manufacturer has three important processes.

The CNC machining process has repeated dimensional rejection.

The welding process has recently received a customer complaint.

The packaging process has stable performance with no significant recurring issues.

The organization should use its defined risk and audit-planning method to determine the appropriate audit priority.

The important principle is:

Audit frequency should be based on relevant risk and performance information rather than simply giving every process the same audit frequency.

Software Development Capability Assessment

Where the organization has applicable software development responsibilities, the internal audit programme needs to include software development capability assessments as required by the applicable requirements.

This is particularly relevant for organizations involved in automotive products or systems where software development is part of their responsibility.

The organization should define:

Assessment scope
Assessment method
Required competency
Applicable processes
Records and evidence

The assessment should be appropriate to the organization’s actual software development activities and applicable requirements.

When Should Audit Frequency Be Reviewed?

The audit programme should not remain unchanged simply because an annual calendar has already been approved.

Audit frequency should be reviewed when conditions change.

Important triggers include:

Process changes
New equipment
New tooling
New material
Engineering changes
Internal nonconformities
External nonconformities
Customer complaints
Recurring defects
Significant performance deterioration

Practical Example

Suppose an organization changes the tooling and process parameters for a critical machining operation.

The organization should evaluate whether the existing audit programme is still suitable.

If quality problems occur after the change, the organization may need additional or earlier audit coverage.

The purpose is to ensure that the audit programme remains appropriate for the actual condition of the process.

Review of Internal Audit Programme Effectiveness

Completing every audit shown on the audit calendar does not automatically mean that the audit programme is effective.

The organization should evaluate whether internal auditing is actually helping identify and address problems.

Possible information for review includes:

Planned audits completed
Significant audit findings
Recurring findings
Corrective action effectiveness
Findings from critical processes
Customer complaints
Customer audit results
QMS audit results
Manufacturing process audit results
Product audit results
Delayed corrective actions

This information should be considered during management review.

A useful question is:

Are our internal audits finding meaningful issues and helping the organization improve, or are we simply completing the audit schedule?

Clause 9.2.2.2 – Quality Management System Audit

Clause 9.2.2.2 addresses Quality Management System audits.

The organization must audit its QMS processes over each applicable three-year calendar period, according to its annual audit programme and using the process approach to verify compliance with IATF 16949.

The audit also includes sampling of applicable customer-specific QMS requirements to verify effective implementation.

Three-Year QMS Audit Coverage

The organization should plan its audit programme so that all applicable QMS processes are covered over the required three-year calendar period.

This does not mean that every process should be audited only once during three years.

A process with high risk or poor performance may require more frequent auditing.

For example, an organization may have:

Customer management
Purchasing
Production planning
Training
Maintenance
Calibration
Corrective action
Internal audit
Management review
Supplier management
Quality control
Product release

The organization should establish a multi-year programme that provides complete coverage while considering risk and performance.

What is the Process Approach in a QMS Audit?

A process approach means the auditor does not simply check whether a procedure exists.

The auditor evaluates how the process actually works.

The auditor may consider:

Inputs
Process activities
Outputs
Responsibilities
Resources
Performance indicators
Risks
Controls
Interactions with other processes

For example, during a purchasing-process audit, the auditor should not stop after checking whether a purchasing procedure exists.

The auditor can examine:

How purchasing requirements are received.
How suppliers are selected or approved.
How purchase orders are generated.
How specifications are communicated.
How supplier performance is monitored.
How nonconforming purchased material is controlled.
How supplier problems are addressed.
Whether the purchasing process achieves its intended results.

This provides a much better understanding of process effectiveness.

Customer-Specific Requirements in QMS Audits

Customer-specific requirements, commonly called CSRs, are an important consideration in automotive QMS auditing.

The organization should identify applicable customer requirements and determine where they apply.

During the QMS audit, appropriate samples should be used to verify that applicable customer-specific requirements are effectively implemented.

For example, a customer may require a particular:

Reporting format
Quality record
Approval process
Escalation process
Performance-monitoring method

The auditor should verify:

Has the requirement been identified?
Does the responsible department understand it?
Is the requirement implemented?
Is there objective evidence?
Are records maintained where required?
Is the process effective?

Current, authorized customer documents should be used when determining applicable requirements.

Clause 9.2.2.3 – Manufacturing Process Audit

Manufacturing process audits are particularly important in automotive manufacturing because they verify what is actually happening on the shop floor.

The organization must audit applicable manufacturing processes over each required three-year calendar period.

The objective is to determine process effectiveness and efficiency.

Where a customer has specified a required process-audit approach, that applicable approach should be used.

Where the customer has not specified an approach, the organization needs to determine its own appropriate approach.

The process audit should also include effective implementation of:

Process risk analysis such as PFMEA
Control Plan
Associated process documents

What is a Manufacturing Process Audit?

A manufacturing process audit examines the actual manufacturing process and verifies whether it is operating as intended.

It may include processes such as:

CNC machining
Stamping
Pressing
Welding
Grinding
Heat treatment
Surface treatment
Assembly
Other manufacturing activities within the organization’s scope

The exact process list depends on the organization’s manufacturing operations.

Effectiveness and Efficiency in Process Audits

A manufacturing process audit should consider both effectiveness and efficiency.

Process Effectiveness

Effectiveness asks:

Is the process achieving its intended results?

Examples include:

Are conforming products being produced?
Are critical characteristics being controlled?
Are process requirements being followed?
Are specified process parameters maintained?
Are reaction plans implemented?
Are customer requirements being achieved?

Process Efficiency

Efficiency asks whether the process is achieving its intended results with appropriate use of resources.

Examples include:

Excessive rework
Excessive scrap
Repeated downtime
Long process delays
Ineffective material movement
Repeated machine stoppages
Unnecessary inspection or handling

The auditor should use objective evidence rather than assumptions.

Customer-Specific Process Audit Requirements

Before conducting a manufacturing process audit, the organization should determine whether the customer has specified a particular process audit method.

The auditor or audit planner should check:

Customer requirements
Customer-specific requirements
Required audit methodology
Required checklist
Organizational procedure
Process-specific requirements

If a customer requires a particular process audit approach, the applicable requirement should be considered when planning and conducting the audit.

If the customer has not specified an approach, the organization should define a suitable method based on its processes and applicable requirements.

Auditing All Manufacturing Shifts

One of the important requirements associated with manufacturing process audits is coverage of all shifts on which the manufacturing process operates within each individual audit plan.

The audit should also include appropriate sampling of shift handover.

Consider a machining process that operates:

Shift A: 6:00 AM to 2:00 PM
Shift B: 2:00 PM to 10:00 PM
Shift C: 10:00 PM to 6:00 AM

The audit plan should cover the applicable shifts rather than assuming that the process operates identically on every shift.

The auditor can also examine shift handover information such as:

Machine problems
Rejected products
Pending inspection
Process abnormalities
Parameter issues
Maintenance problems
Production instructions
Quality alerts

Appropriate shift-handover sampling helps determine whether important information is being transferred effectively between shifts.

Auditing PFMEA, Control Plan and Process Documents

A manufacturing process audit should not treat PFMEA, Control Plan and work instructions as separate documents.

The auditor should examine whether they are connected and whether the controls are actually implemented.

For example, suppose a CNC machining process has a critical diameter requirement.

The PFMEA may identify:

Failure Mode: Incorrect component diameter

Effect: Product does not meet dimensional requirements

Cause: Incorrect machining parameter or tool condition

The PFMEA may identify appropriate prevention and detection controls.

The Control Plan should then define the applicable:

Characteristic
Specification
Inspection method
Frequency
Acceptance criteria
Reaction plan

The Work Instruction should explain the applicable operating method.

During the audit, the auditor should verify whether the shop-floor process actually follows these controls.

Practical Manufacturing Process Audit Questions

The following questions can help an auditor evaluate implementation:

Does the PFMEA identify the relevant process risks?
Are important failure modes and causes understood?
Are PFMEA controls reflected appropriately in the Control Plan?
Is the Control Plan available at the point of use?
Is the specified inspection frequency being followed?
Are process parameters within defined limits?
Are operators following the approved work instruction?
Is the reaction plan understood?
What happens when an abnormal condition occurs?
Are rejected products properly identified and controlled?
Are measurement devices suitable and available?
Are maintenance requirements being followed?
Are changes properly controlled?
Are previous audit findings effectively addressed?
Is the process achieving the intended quality and production results?

The objective is not simply to ask questions.

The auditor should collect objective evidence.

Clause 9.2.2.4 – Product Audit

Product audit focuses on verifying whether the product conforms to specified requirements.

The organization must audit products at appropriate stages of production and delivery using applicable product requirements and the Control Plan.

Where a customer has specified a product audit approach, that applicable approach should be followed.

Where no customer-specific approach is defined, the organization should establish its own appropriate method.

What is a Product Audit?

A product audit verifies the actual product against applicable requirements.

Depending on the product, the audit may include:

Dimensions
Material characteristics
Functional requirements
Appearance
Identification
Labeling
Packaging
Traceability
Other specified characteristics

The product audit should be based on applicable:

Drawings
Specifications
Customer requirements
Control Plan
Inspection methods
Acceptance criteria

Product Audit at Appropriate Stages

Product auditing may be performed at appropriate stages such as:

In-process production
Finished product
Pre-dispatch
Packaging
Label verification
Other stages defined by the organization or customer

The organization should establish:

What products are selected
Which characteristics are checked
When audits are performed
How samples are selected
What acceptance criteria apply
How results are recorded
What happens when a nonconformity is identified

Customer-Specific Product Audit Approach

Where the customer specifies a particular product audit methodology, the applicable requirement should be considered.

If no customer-specific method is specified, the organization should define an appropriate approach.

The approach should clearly explain:

Product selection
Audit frequency
Characteristics to be checked
Inspection method
Acceptance criteria
Record requirements
Nonconformity handling

Difference Between QMS Audit, Manufacturing Process Audit and Product Audit

Although all three are internal audit activities, they have different focuses.

QMS Audit

The main focus is the organization’s Quality Management System processes.

The auditor examines whether the management system processes conform to applicable requirements and are effectively implemented.

Example:

Purchasing process audit

The auditor evaluates supplier selection, purchasing controls, supplier performance monitoring and related QMS requirements.

Manufacturing Process Audit

The focus is the effectiveness and efficiency of the manufacturing process.

Example:

CNC machining process audit

The auditor verifies process parameters, operator practices, PFMEA controls, Control Plan implementation, inspection, reaction plans and process performance.

Product Audit

The focus is product conformity.

Example:

Finished component product audit

The auditor verifies dimensions, appearance, identification, packaging and other applicable product characteristics.

The three audits therefore provide different perspectives of the organization’s quality system.

Practical Internal Audit Programm

An automotive organization can develop its internal audit programme by considering the requirements of Clause 9.2.2.1 through Clause 9.2.2.4.

The programme may include:

QMS audits
Manufacturing process audits
Product audits
Follow-up audits

The programme should be developed according to:

Process risk
Process criticality
Internal performance
Customer performance
Previous audit findings
Customer complaints
Process changes
Customer-specific requirements

The annual programme should also be reviewed and adjusted where appropriate.

How to Prepare an IATF 16949 Internal Audit Checklist

A good audit checklist should be based on the actual audit objective.

It should not be simply a long list of questions copied from an old audit.

For a QMS audit, the checklist can focus on:

Applicable QMS requirements
Process inputs and outputs
Responsibilities
Performance indicators
Risks
Process controls
Customer-specific requirements
Objective evidence

For a manufacturing process audit, the checklist can focus on:

PFMEA
Control Plan
Work Instructions
Process parameters
Special characteristics
Inspection
Reaction plan
Operator competency
Equipment
Maintenance
Product identification
Traceability
Process performance

For a product audit, the checklist can focus on:

Drawing requirements
Dimensions
Material
Appearance
Function
Identification
Packaging
Labeling
Traceability

The checklist should support the auditor rather than replace the auditor’s understanding of the process.

Practical IATF 16949 Clause 9.2 Audit Questions

Internal Audit Programme

The auditor can ask:

Is a documented internal audit process established?
Does the audit programme cover QMS, manufacturing process and product audits?
Is audit priority based on risk?
Are internal performance trends considered?
Are external performance trends considered?
Is process criticality considered?
Are customer complaints considered?
Is audit frequency reviewed when significant changes occur?
Is the effectiveness of the audit programme reviewed during management review?

QMS Audit

The auditor can ask:

Are all applicable QMS processes covered within the required period?
Is an annual audit programme established?
Is the process approach used?
Are applicable IATF requirements considered?
Are applicable customer-specific requirements sampled?
Is effective implementation verified?
Are findings documented?
Are corrective actions followed up?

Manufacturing Process Audit

The auditor can ask:

Are all applicable manufacturing processes covered?
Is the customer-required process audit approach used where applicable?
Is an appropriate process audit method defined where required?
Are all applicable manufacturing shifts covered?
Is shift handover appropriately sampled?
Is PFMEA implementation verified?
Is Control Plan implementation verified?
Are work instructions implemented?
Are process effectiveness and efficiency evaluated?

Product Audit

The auditor can ask:

Are products audited at appropriate stages?
Are specified product requirements verified?
Are customer requirements considered?
Is the product audit approach defined?
Are product characteristics clearly identified?
Are acceptance criteria established?
Are audit results recorded?
Are nonconforming products properly controlled?

Common Mistakes in IATF 16949 Clause 9.2 Auditing

Mistake 1: Auditing the Same Processes Every Year

Some organizations repeatedly audit the same departments because they are familiar or easy to audit.

The problem is that other QMS or manufacturing processes may not receive adequate coverage.

Better approach

Maintain a documented multi-year audit plan and periodically verify complete process coverage.

Mistake 2: Ignoring Customer-Specific Requirements

An organization may use its own internal checklist without checking whether a customer requires a particular audit methodology.

Better approach

Before planning an audit, identify applicable customer-specific requirements and determine whether the customer has specified a required audit approach.

Mistake 3: Auditing Only the Day Shift

An auditor may audit the day shift and assume that the second and third shifts operate exactly the same way.

This assumption may not be valid.

Different shifts may have differences in:

Manpower
Experience
Machine condition
Maintenance support
Process discipline
Shift handover
Inspection practices

Better approach

Plan audit coverage for all applicable shifts and include appropriate shift-handover sampling.

Mistake 4: Checking Documents Without Going to the Shop Floor

A PFMEA and Control Plan may be perfect on paper while actual production practices are different.

Better approach

Compare the documented process with actual shop-floor conditions.

Check:

Machine settings
Operator practices
Inspection frequency
Reaction plan
Product identification
Process parameters
Records
Actual controls

Mistake 5: Not Reviewing Audit Frequency

A fixed annual audit schedule may become unsuitable after:

Major process change
New machine
Customer complaint
Recurring rejection
Major nonconformity
New product

Better approach

Review audit frequency when relevant changes or performance problems occur.

Mistake 6: Treating Audit Completion as Audit Effectiveness

Completing 100% of planned audits does not automatically prove that the audit programme is effective.

The organization should also evaluate:

Quality of findings
Recurring findings
Corrective action effectiveness
Significant process risks
Customer complaints
Repeat problems

The objective is improvement, not merely calendar completion.

Mistake 7: Writing Weak Audit Findings

A finding should be supported by objective evidence.

Instead of writing:

“Operator is not following process.”

the audit record should contain sufficient factual evidence to explain what was observed, where it was observed and which applicable requirement or documented control was not met.

Good audit reporting should help the responsible department understand the problem and take appropriate corrective action.

Mistake 8: Closing Corrective Actions Without Effectiveness Verification

A corrective action should not be considered effective simply because someone has submitted a response.

The auditor or responsible function should verify whether the action actually addressed the identified problem.

For example:

Problem: Inspection frequency was not followed.

Correction: Operator was instructed to inspect correctly.

Corrective action: Root cause identified and process control improved.

Effectiveness verification: Subsequent records and shop-floor observation demonstrate sustained implementation.

The exact method will depend on the finding and organization’s corrective-action process.

Internal Audit and Objective Evidence

A strong internal audit is based on objective evidence.

Examples include:

Records
Production data
Inspection reports
Machine parameters
Training records
Maintenance records
Calibration records
Customer complaints
Audit reports
PFMEA
Control Plan
Work Instructions
Operator interviews
Shop-floor observations
Product samples

The auditor should avoid conclusions based only on assumptions.

For example:

Weak evidence:

“The process appears to be under control.”

Stronger evidence:

“Observed the CNC machining operation and verified the specified parameter against the approved work instruction. Inspection records for the sampled production period were reviewed and found consistent with the defined frequency.”

The second approach is more useful because it explains what was actually verified.

Relationship Between PFMEA, Control Plan and Internal Audit

One of the strongest connections in a manufacturing process audit is:

PFMEA → Control Plan → Work Instruction → Actual Process

PFMEA identifies risks.

The Control Plan defines applicable controls.

Work Instructions explain how the operation should be performed.

The internal audit verifies whether those controls are actually implemented.

For example:

PFMEA identifies tool wear as a potential cause.

The Control Plan specifies dimensional inspection at a defined frequency.

The Work Instruction explains the inspection method.

During the process audit, the auditor verifies:

Is the inspection being performed?
Is the specified instrument being used?
Is the frequency followed?
Are results recorded?
What happens when the result is out of specification?
Is the reaction plan implemented?

This approach makes the process audit much more meaningful.

How to Make Internal Audits More Effective

An effective internal audit should focus on the actual performance of the process.

Some practical approaches include:

Audit the process where the work happens

Do not spend the entire audit in a conference room.

Ask open questions

Instead of asking only “Yes or No,” ask the operator to explain how the process is controlled.

Follow the process

Trace an actual part or transaction through the process where practical.

Compare documents with reality

Check whether PFMEA, Control Plan and work instructions match the actual process.

Use data

Review rejection, scrap, rework, customer complaints and process performance.

Check previous problems

Verify whether previously identified problems have really been eliminated or controlled.

Look for recurring issues

Repeated findings can indicate a deeper systemic problem.

Verify effectiveness

Do not stop at finding closure. Check whether the implemented action works.

Frequently Asked Questions About IATF 16949 Clause 9.2

What is IATF 16949 Clause 9.2?

IATF 16949 Clause 9.2 defines requirements related to internal auditing. It includes applicable ISO 9001 internal audit requirements and automotive-specific requirements for QMS, manufacturing process and product audits.

What are the three types of audits in the internal audit programme?

The three main audit types are:

Quality Management System audit
Manufacturing process audit
Product audit

Each audit has a different objective.

What is the three-year audit requirement in IATF 16949?

The organization must plan coverage of applicable QMS processes and manufacturing processes over each required three-year calendar period according to the applicable requirements.

This does not mean every process must be audited only once during the three-year period.

Audit frequency should also consider risk, performance, criticality and other applicable requirements.

Are all manufacturing shifts required to be audited?

For the manufacturing process audit plan, each manufacturing process should be audited on all shifts where it occurs, including appropriate sampling of shift handover, as required by the applicable clause.

What is the role of PFMEA in a manufacturing process audit?

PFMEA identifies and evaluates potential process risks.

The manufacturing process audit verifies whether the process risk analysis, Control Plan and associated process documents are effectively implemented.

What if the customer has not defined a process audit approach?

The organization needs to determine an appropriate process audit approach based on applicable requirements, its manufacturing processes and documented procedures.

What is the difference between a QMS audit and a manufacturing process audit?

A QMS audit focuses on the organization’s management-system processes and their conformity and effectiveness.

A manufacturing process audit focuses on the effectiveness and efficiency of the actual manufacturing process and implementation of applicable process controls.

What is a product audit?

A product audit verifies whether the product conforms to specified requirements.

It can include dimensions, material, function, appearance, identification, packaging and other applicable characteristics.

Is a product audit the same as final inspection?

No.

Final inspection is a production or quality-control activity.

A product audit is an audit activity designed to independently verify product conformity using an established audit approach.

What should be reviewed during management review regarding internal audits?

The effectiveness of the internal audit programme should be reviewed as part of management review.

Relevant information may include:

Audit completion
Audit findings
Recurring findings
Corrective action effectiveness
Customer complaints
Critical process findings
QMS audit results
Manufacturing process audit results
Product audit results

Is ISO 19011 mandatory for IATF 16949 internal audits?

ISO 19011 provides guidance for auditing management systems. Its application should be considered in relation to applicable IATF 16949 requirements, customer-specific requirements and the organization’s audit process.

Do not assume that every ISO 19011 recommendation automatically becomes a mandatory IATF 16949 requirement.

IATF 16949 Clause 9.2 Internal Audit – Practical Checklist

Before considering an internal audit programme effective, the organization should ask:

Audit Programme

Is there a documented internal audit process?
Does the programme cover applicable QMS processes?
Does it include manufacturing process audits?
Does it include product audits?
Is risk considered?
Is process criticality considered?
Are internal performance trends considered?
Are external performance trends considered?
Are customer complaints considered?
Is audit frequency reviewed when conditions change?
Is programme effectiveness reviewed during management review?

QMS Audit

Are all applicable QMS processes covered within the required period?
Is the process approach used?
Are IATF requirements considered?
Are applicable customer-specific requirements sampled?
Is implementation verified?
Is objective evidence collected?
Are findings documented?
Are corrective actions followed up?

Manufacturing Process Audit

Are applicable manufacturing processes covered?
Are customer-required audit methods followed where applicable?
Are all applicable shifts covered?
Is shift handover appropriately sampled?
Is PFMEA implementation verified?
Is Control Plan implementation verified?
Are work instructions implemented?
Are process parameters controlled?
Are reaction plans effective?
Are process effectiveness and efficiency evaluated?

Product Audit

Are products audited at appropriate stages?
Are applicable product requirements verified?
Are customer requirements considered?
Are characteristics clearly defined?
Are acceptance criteria available?
Are audit results recorded?
Are nonconforming products controlled?

Conclusion

IATF 16949 Clause 9.2 Internal Audit is an important part of the automotive Quality Management System because it provides a structured method for verifying whether processes are actually working as intended.

An effective internal audit programme should cover the applicable:

Quality Management System processes
Manufacturing processes
Products

The programme should also be planned using relevant information such as:

Process risk
Process criticality
Internal performance
External performance
Customer complaints
Previous audit findings
Process changes
Nonconformities

For manufacturing process audits, the auditor should go beyond document review and verify the actual implementation of PFMEA, Control Plan and associated process documents.

The relationship can be understood simply:

PFMEA identifies the risk → Control Plan defines the control → Work Instruction explains the operation → Internal Audit verifies implementation.

A good internal audit should therefore answer a practical question:

“Is the process actually being controlled in the way the organization says it is being controlled?”

The most effective auditors do not simply look for paperwork. They observe the process, talk to people, review objective evidence, compare actual conditions with documented requirements and investigate whether corrective actions have really worked.

The ultimate objective of Clause 9.2 is not simply to complete an audit schedule.

It is to help the organization identify weaknesses, verify conformity, improve process performance and prevent problems from reaching the customer.

For automotive quality professionals, understanding Clause 9.2 is therefore essential for effective QMS auditing, manufacturing process auditing and product auditing.