QM Bench

IATF 16949 internal audit: theory, how to run it and case study

The three types of internal audit required by IATF 16949, the automotive-specific requirements auditors focus on, and a worked system audit example with a major finding on MSA.

Ľubomír Blažek
Automotive quality manager · updated 2026-10-25

Try it while you read

Open the free IATF 16949 Internal Audit tool and click Load sample: it reproduces the case study below.

Open the tool

Theory: ISO 9001 plus the automotive layer

IATF 16949:2016 is not a standalone standard: it adds automotive requirements on top of ISO 9001. Internal audits must therefore cover both. Auditors focus on areas where automotive suppliers typically fail:

  • Customer-specific requirements (4.3.2): listed, assessed and visible in the processes.
  • Product safety (4.4.1.2): defined process for safety-related characteristics.
  • MSA (7.1.5.1.1): a study for every measurement system in the control plan.
  • Special characteristics (8.3.3.3) carried through FMEA, control plan and instructions.
  • Control plan (8.5.1.1) reviewed after changes and quality issues.
  • Problem solving (10.2.3) and error-proofing (10.2.4).

Key point

The most frequent IATF major findings involve MSA, control plans that are not updated, and customer-specific requirements nobody has read.

Step by step with the tool

  1. Start an audit and remove out-of-scope sections.
  2. Add your customers’ CSR as extra questions with “Edit checklist”.
  3. Pick a part and follow it: drawing → FMEA → control plan → work instruction → gauge → MSA study.
  4. Rate and record evidence; every minor or major gets a corrective action.
  5. Download the PDF with the action plan.

Case study: system audit of manufacturing

The Load sample audit covers 37 automotive-specific requirements in manufacturing and quality.

  • Result: 1 major, 2 minor, 1 OFI; conformity 94.6 %.
  • Major, 7.1.5.1.1: no MSA study for the air gauge and the CMM program listed in control plan CP-4711. Action: Gage R&R for both, containment by 100 % CMM until done.
  • Minor, 8.5.1.1: control plan not reviewed after a customer complaint. Action: review in D7 of the 8D.
  • Minor, 9.2.2.3: two night shifts not covered by manufacturing process audits.

The major finding shows why following one part through the documents works: the control plan named the gauges, but the MSA folder had no study for them. The team runs a Gage R&R and a Type 1 study within two weeks.

Result

A major finding in an internal audit is good news compared with the same finding in the certification audit: it was found, contained and fixed in time.

Common mistakes

  • Auditing IATF requirements without the ISO 9001 base.
  • Ignoring night shifts and weekends.
  • Internal auditors without core tools knowledge.

The checklist uses our own wording with clause numbers; the standard is sold by IATF and national associations.

Frequently asked questions

What are the three internal audit types?

Quality management system audits (all processes over three years), manufacturing process audits (all processes and shifts over three years, e.g. VDA 6.3 style) and product audits (conformity of product at defined stages).

What qualifications do internal auditors need?

IATF 16949 clause 7.2.3 requires knowledge of the automotive process approach, customer-specific requirements, ISO 9001 and IATF 16949, and the core tools (APQP, PPAP, FMEA, SPC, MSA).