IATF 16949 Internal Audit Process: Step by Step

The IATF 16949 internal audit process has nine steps, from setting the purpose to verifying the fix. You plan a risk-based programme that covers system, manufacturing process and product audits. You choose competent, independent auditors, build a checklist from the process map, audit by interview and audit trail, grade the findings and report them. Then the plant fixes the cause and checks that the fix worked. IATF 16949:2016 asks for the programme in clause 9.2.2.1 and for auditor competence in clause 7.2.3, and leaves the method to the plant.

Facts were checked on the IATF Global Oversight site on 1 November 2026. IATF 16949:2016 is the current edition and a revision is under way, with no transition dates published there. Clause numbers are the 2016 numbering. We describe requirements in our own words and never copy the standard. The arithmetic below was run in Node.

What an internal audit is for

An internal audit asks two questions about each process: does it meet its criteria, and does it work? The criteria are ISO 9001, IATF 16949, the customer specific requirements that apply and the plant's own procedures. An audit is only a sample, so what you choose to sample matters more than how many pages the checklist has. Every audit needs a purpose written down, such as covering a changed process, following up a complaint or reaching a process not audited for a long time.

Step 1 and 2: the programme and its three audit types

The programme covers three kinds of audit, each with a different object.

A programme that visits every department equally spends time on quiet processes and misses risky ones. Frequency should follow risk.

Step 2 worked example: scoring frequency

One simple method scores three factors from 1 to 3: the effect on the customer, the recent results and the recent change. Multiply them. A score of 12 or more is audited every 6 months, 6 to 11 yearly, and anything lower once in the three-year cycle. This is a teaching method, and a plant may use a different one if it is documented and risk-based. Here is a small plant.

Welding and change control are audited twice a year, three processes once a year, and two once in three years. That is 2 x 2 + 3 + 2 / 3 = 7.67 process audits a year. At 6 hours each, including preparation and the report, that is about 46 auditor hours a year. Scores move with events. If a gauge fails in calibration and the results score rises from 1 to 3, calibration becomes 3 x 3 x 2 = 18 and moves to every 6 months. A programme that never changes after complaints is a finding in itself.

Step 3: choose auditors who are competent and independent

Clause 7.2.3 asks the plant to verify that its internal auditors are competent. They need the automotive process approach, the customer rules that apply, ISO 9001 and IATF 16949, the core tools relevant to what they audit, and audit method. Nobody audits their own work, so a quality engineer who owns the control plan swaps with a colleague. Competence is shown with records: training, observed audits and a competence matrix.

Step 4: build the checklist from the process map

Take the turtle diagram of the process and turn each box into a question and the evidence to look for. Inputs, methods, people, equipment and measures each give questions. Add the customer specific requirements for that process and the points raised in the last audit. A checklist is a start, not a script, and good auditors adjust priorities when the evidence points elsewhere.

How much to sample

There is no fixed sample size in the standard, so the auditor decides and records the reason. A useful habit is to sample across the whole period since the last audit, across shifts and across part numbers, not just the last day. Pick records before you look at them, so the sample is fair. If the first few records show a problem, widen the sample to learn how far it goes. If they show none, say what you looked at, because "no findings" means little without the sample size.

Step 5: audit on the floor

The opening meeting confirms scope and times. On the floor, ask open questions of the person doing the work. Show me how you check this bore. What do you do when the gauge reads out of limit? Ask for the record, not the story. Then follow an audit trail from a requirement to the work.

1. Read the requirement, for example a bore marked as a special characteristic on the drawing.
2. Find the check in the control plan.
3. Go to the machine and see the gauge and the method.
4. Open the hourly records.
5. Check the gauge's calibration record.

Step 6 worked example: grading what you find

On the welding cell the control plan asks for an hourly gauge check on a special characteristic. The auditor samples 20 hourly checks across three shifts. 17 records are present and 3 are missing, all on the same night shift, so 3 / 20 = 15 per cent are missing. Written as a finding it reads: the control plan requires an hourly gauge check on the weld penetration. Of 20 sampled hours, records for 3 hours of night shift on 12 May are missing. That is a statement anyone can verify.

Grading follows the effect on the system. A single lapse in an otherwise working system is usually minor. If the whole of a shift had no checks on a special characteristic, many plants would grade the finding major, because conforming product cannot be assured. Write about the requirement and the evidence, never about a person.

Steps 7 to 9: report, fix the cause and verify

The closing meeting presents the findings and agrees the next steps. The plant answers each one with containment, a root cause and a corrective action. The auditor then verifies. Was the cause removed? Has the problem returned? Verification names a record and a date, not just a signed form. For the night-shift example, that means sampling another 20 hourly checks four weeks later and finding none missing. The programme, the findings and the closure rate then go to management review, which adjusts the next year's plan.

Common weaknesses in a programme

Most weak programmes fail in the same few ways, and you can test your own against the list.

• Paper audits only. The auditor reads procedures in an office and never watches the process run.
• No product audit. The programme covers systems and processes but never checks finished parts against the drawing.
• One shift only. Night and weekend shifts run differently, and the programme never reaches them.
• A fixed schedule. Frequencies were set once and never moved after complaints, scrap or a process change.
• Findings with no evidence. "Calibration is poor" is an opinion. A requirement, a record and a location make a finding.
• Closure by signature. A corrective action is closed when the form is signed, not when the data shows the problem has gone.
• Ignoring customer rules. The checklist covers the standard but not the customer specific requirements for the part.

How this connects to the wider automotive toolbox

Audit trails run through the core tools. A control plan row points to a process FMEA, a gauge study and a capability study, which is why auditors learn all of them. Our AI quality inspection guide shows how camera data changes what an auditor samples, and the manufacturing skills gap post explains why quality skills remain in demand. IATF Global Oversight publishes the customer specific requirements for the automotive makers, and its IATF 16949:2016 page explains the standard's background.

Practise it free

The free IATF 16949 Automotive QMS and Internal Auditing course works through every step above, with a risk-based programme exercise, audit trails and graded nonconformity statements. It gives internal auditor knowledge only. Third-party IATF auditors qualify through IATF-recognized certification bodies, and this course does not qualify anyone for that route.

It is a free course with a verifiable certificate of completion, and anyone can check a certificate on our verification page. EDWartens is not affiliated with IATF, AIAG or any certification body. Open the IATF 16949 internal auditor course to build your own programme.

Take the free course

Free

Quality management · Beginner · Free

IATF 16949 Automotive QMS and Internal Auditing

Free

Quality management · Beginner · Free

ISO 9001:2026 Quality Management and Internal Auditing

Free

Quality management · Intermediate · Free

Automotive Core Tools: FMEA (AIAG-VDA 1st Edition)