IATF 16949:2016 is approaching 10-years old but it remains the current version of the Automotive Quality Management System (as of September 2026).
However, over the years, the International Automotive Task Force (IATF) has issued numerous Sanctioned Interpretations (SIs) and Frequently Asked Questions (FAQs) that clarify, modify and expand upon the requirements of IATF 16949. These updates can introduce new expectations that organisations may not realise apply to them until an auditor raises a nonconformity.
At Assent Risk Management, we regularly conduct gap analyses and internal audits for organisations across the automotive supply chain. One recurring theme is that businesses often have well-established quality management systems but remain exposed to audit findings where they have not paid attention to these sanctioned interpretations.
Cybersecurity Has Become a Quality Management Issue
Historically, cybersecurity has been viewed as an IT responsibility but today, the automotive supply chain has recognised that cyber threats can have a direct impact on product conformity, manufacturing processes, delivery performance and business continuity. So much so that some OEMs have collaborated to develop TISAX, a dedicated information security standard for the Automotive industry.
Read more: TISAX – It’s not just for Motor Manufacturers – Assent Risk Management
Aside from that, during IATF 16949 quality audits, auditors increasingly expect to see evidence that cybersecurity risks have been considered and incorporated into the organisation’s risk management process. A ransomware attack, system outage or compromise of production equipment can quickly become a quality issue, making cybersecurity a critical consideration within an IATF 16949 management system.
Many organisations have invested heavily in technology controls but have not fully integrated cybersecurity into their quality management framework and this disconnect frequently becomes apparent during audits.
Contingency Planning Needs to Reflect Modern Risks
Most suppliers have a business continuity or contingency plan but the real question is whether it addresses the risks that threaten the organisation today?
Many plans remain focused on equipment breakdowns and utility failures while overlooking more significant threats such as cyber-attacks, cloud service outages, loss of critical suppliers, transportation disruption or shortages of skilled personnel.
Recent examples, including the attack on Jaguar Landrover, demonstrate the real impact that can be felt across the supply chain when a vulnerability is exploited.
Auditors often expect contingency plans to be regularly reviewed and tested so that they can provide confidence that customer requirements can continue to be met when disruption occurs.
Although ISO 22301 explicitly covers business continuity management, and is not a mandatory requirement, IATF 16949 certified companies are expected to have some basic level of continuity planning in place.
Supplier Development Is More Than Monitoring Performance
Supplier management remains one of the most challenging aspects of IATF 16949 compliance.
Many businesses have robust supplier processes and performance reports but struggle to demonstrate active supplier development. Monitoring a supplier’s performance is only one part of the requirement. Organisations should also be able to demonstrate how they are supporting supplier improvement and addressing identified risks.
As supply chains become increasingly complex, customers are placing greater emphasis on how organisations manage the quality capability of their suppliers.
Internal Audits Should Drive Improvement
Unfortunately, many organisations treat internal auditing as a compliance exercise with audits becoming checklist-based activities that verify documentation rather than evaluating process effectiveness.
A mature internal audit programme should challenge whether processes are achieving their intended results, identify emerging risks and provide leadership with meaningful insight into the health of the management system.
When performed effectively, internal audits often reveal opportunities for improvement long before they become customer complaints or audit findings.
Auditor Competence Remains a Common Weakness
A training certificate alone does not automatically make someone competent to conduct IATF 16949 audits.
Internal auditors are expected to understand the standard, process-based auditing techniques, automotive tools and relevant customer-specific requirements.
Many organisations underestimate the level of competence required and fail to maintain clear evidence demonstrating how auditor capability has been assessed and maintained over time.
This is where external support from IATF 16949 consultants like Assent Risk Management can help. We have a broad exposure across the automotive supply chain, giving us a unique perspective and knowledge of processes and the standard. We can provide outsourced internal audits. Contact us to discuss how we can help.
Corrective Actions Must Eliminate Root Causes
One of the most common findings encountered during internal and third-party audits relates to ineffective corrective action.
It is relatively easy to fix an immediate problem, but considerably more difficult to identify why the issue occurred in the first place and ensure it cannot happen again: the root-cause.
Effective problem solving requires systematic investigation, identification of root causes and implementation of actions that genuinely prevent recurrence.
Customer-Specific Requirements Continue to Catch Suppliers Out
Customer-specific requirements also remain a significant source of nonconformities throughout the automotive sector.
Many organisations download customer manuals and retain them within their document management systems but fail to make sure that changes are reviewed, communicated and implemented. As requirements evolve, businesses can quickly become non-compliant without realising it.
A robust process for identifying, evaluating and deploying customer-specific requirements is essential if suppliers are to maintain compliance and meet customer expectations consistently.
Is Your IATF 16949 System Audit Ready?
Many organisations only discover gaps when a customer auditor or certification body auditor identifies them. By then, the cost and effort required to address the issue is often significantly greater.
Planning ahead saves time and money.
How Assent Risk Management Can Help
Assent Risk Management provides practical IATF 16949 consultancy services designed to help automotive suppliers strengthen compliance, reduce audit risk and improve operational performance.
Whether you are preparing for certification, addressing audit findings, developing your internal audit programme or seeking independent assurance that your management system remains effective, our consultants can provide experienced support tailored to your organisation.
Our services include:
- IATF 16949 gap analysis
- Internal audits
- Supplier audit and development programmes
- Automotive core tools support
- Corrective action and problem-solving assistance
- Certification readiness assessments
- Outsourced and fractional Quality Management support
We focus on delivering practical solutions that satisfy auditors while creating genuine value for the business.
Need Independent IATF 16949 Support?
If you’re unsure whether your management system fully reflects the latest IATF expectations, an independent review can provide clarity and confidence.
Contact Assent Risk Management to discuss your IATF 16949 requirements and discover how our experienced consultants can help you maintain compliance, improve performance and prepare for future audits.
