IATF 16949 does not treat internal audit as a single annual exercise. It expects an audit programme that looks at the system, the manufacturing processes and the product itself. Understanding how the three fit together makes your programme both more useful and easier to defend in a certification or customer audit.

The three audit types

1. Quality management system (QMS) audit

This checks that your system meets the standard and your own procedures, and that it is effective. The programme should cover all QMS processes over a defined cycle, using a risk-based plan rather than a simple checklist walk-through.

2. Manufacturing process audit

This looks at how each manufacturing process actually runs on the shop floor: are the control plan, work instructions, gauging, set-up and reaction plans in use as written? Many European customers expect VDA 6.3, which scores a process against structured questions and produces a graded result. Always check your customer-specific requirements.

3. Product audit

This checks finished product against all specified requirements (dimensions, function, appearance, packaging and labelling) at suitable points in production and delivery. It confirms that what you ship is what the customer specified, independent of process data.

Building a programme that works

  • Prioritise by risk. Give more audit time to processes with poor performance, customer complaints or recent change.
  • Cover all shifts and processes over the cycle, not just the day shift and the easy areas.
  • Use trained, objective auditors. Keep competence records, and keep people from auditing their own work.
  • Close findings properly. Treat nonconformities with root cause and corrective action, and check effectiveness.
  • Feed results into management review so audit data drives improvement, not just compliance.

Common weaknesses we see

  • Audit checklists copied from the standard that never test real process behaviour.
  • Findings closed with "retrained operator" and no systemic fix.
  • Product audits that repeat the final inspection instead of checking against the full specification.
  • Programmes that ignore customer complaints and scrap data when deciding where to audit.

We deliver internal and supplier audits including VDA 6.3, and can set up or review your programme through our IATF 16949 consultancy. For the wider certification picture see the cost and timeline guide.

Clause numbers and requirements vary between standard editions and customer-specific requirements. Always confirm against the current standard and your customer documents.