IATF 16949 requires three types of internal audit: the quality management system audit, the manufacturing process audit and the product audit (clause 9.2.2). The first two must cover every process in each three-year calendar period, and the process audit must also cover every shift. The programme is prioritised by risk and adjusted when there are changes, nonconformities or customer complaints.
This is the part of the standard where the difference from ISO 9001 shows most. A company used to auditing procedures in an office has to start auditing on the shop floor, with the control plan and the FMEA in hand and, sometimes, on the night shift.
The three types of audit
| Type | Minimum coverage | What is checked |
|---|---|---|
| System (9.2.2.2) | Every process in the system in each three-year calendar period, following an annual programme | That the system meets IATF 16949 and ISO 9001, with a process approach and including each customer's specific requirements |
| Manufacturing process (9.2.2.3) | Every manufacturing process in each three-year calendar period, on every shift and sampling the shift handover | The effectiveness and efficiency of the process, and that the process risk analysis (FMEA), the control plan and associated documents are really applied |
| Product (9.2.2.4) | At the production and delivery stages you define | That the product meets the specified requirements: dimensions, functionality, packaging and labelling |
For process and product audits, the standard asks you to use the method the customer requires, where there is one. That is why it pays to read each customer's specific requirements before designing the programme: some manufacturers specify a particular process audit questionnaire, and others ask for layered audits in which different levels of management review the same line at different frequencies.
A risk-based programme
Clause 9.2.2.1 asks for a documented programme that covers the whole system and is prioritised according to risk, internal and external performance trends and the criticality of each process. The frequency is reviewed and adjusted if a process changes, if internal or external nonconformities appear or if customer complaints come in.
In practice, "once every three years" is the minimum, not the plan. A line with a new customer, a recent tool change or an open complaint should be audited sooner and more often than one that has been stable for years. What the certification auditor wants to see is that the programme reacts: if a complaint came in from a line in March, they will look for an audit of that line after March.
Who can audit
Clause 7.2.3 asks for a list of qualified internal auditors and a documented process to verify their competence. All of them must understand the risk-based process approach, customer-specific requirements, ISO 9001 and IATF 16949 as they relate to what they audit, and the core tools (APQP, PPAP, FMEA, SPC and MSA).
In addition, the manufacturing process auditor needs technical knowledge of the process being audited, including its FMEA and control plan, and the product auditor needs to understand the product requirements and the use of measuring equipment. Competence is maintained by carrying out a minimum number of audits a year, set by the organisation itself, and by keeping up with changes in the standard, in processes and in customers.
Where certification audits fail
The IATF regularly publishes which clauses accumulate the most nonconformities in certification audits worldwide. In the latest report, from October 2026, problem solving is well ahead of everything else:
Almost 18% of major nonconformities fall under clauses 10.2.3 and 10.2.1, that is, how a problem is investigated and how it is closed. And the rest of the list (control plan, MSA, maintenance, process monitoring) is exactly what a good manufacturing process audit reviews on the shop floor. If your internal audits find these failures before the external auditor does, the programme is doing its job.
That is why we would give as much weight to how findings are closed as to how they are found. An internal audit finding closed with "retrain the operator" and no root cause analysis is exactly what the external auditor flags under clause 10.2.3. Each finding should open its nonconformity, go through the problem-solving method you have defined (8D, for example) and then be checked to confirm the action worked.
How we would set it up
A three-year programme with the three audits kept separate, in which each system process and each manufacturing process has its planned year, and the shifts of each line are spread out. On top of that, a quarterly review of the programme using complaint data, customer indicators and nonconformities, to bring forward the audits of whatever is performing worst.
In the GlobalSuite® audit module each audit has its plan, its working papers and its findings, and each finding becomes a nonconformity with its corrective action and owner. Because the IATF 16949 and ISO 9001 requirements are on the same platform, you can see which clause and which process each finding touched, which is what you will need for the management review. If you'd like to see it with your own programme, get in touch.
Official sources: IATF 16949:2016 on the IATF website, IATF 16949 sanctioned interpretations and IATF nonconformity statistics. Content reviewed in October 2026.
