AuditsCompliance-in-a-Box: The Startup Guide to Audit-Ready DocsSVSid Varma · 12 min readFor quality managers at automotive production and service parts sites, preparing for audits under IATF Rules 6th Edition and watching the second edition. What must be written, and what auditors check.
30-day trialUnlimited free viewersNo credit card required
Checked against primary sources on 18 October 2026.
Sites that make production or service parts for automotive customers, typically required by vehicle makers and tier suppliers as a condition of supply.
IATF-recognized certification bodies under IATF Global Oversight; vehicle-maker complaints can trigger special audits through the IATF complaint system
Initial certification audit, surveillance audits every 12 months (Rules 6th Edition removed the 6 and 9 month options), and a recertification audit to renew each certificate cycle
IATF 16949:2016 (1st edition), read with the IATF Sanctioned Interpretations (latest November 2025) and FAQs (latest June 2026), 2016-10. Paid standard (US$177 non-member, US$60 AIAG member, English hard copy or single-user eDocument, per AIAG).
| Date | What happens | Status |
|---|---|---|
| 2025-01-01 | IATF Rules 6th Edition fully in effect for certification bodies and IATF 16949 sites | Done |
| 2027 (mid-year, indicative) | IATF 16949 second edition planned for publication | Expected |
| 2029-09-30 | End of transition to the IATF 16949 second edition, aligned with the end of the ISO 9001:2026 transition | Expected |
Each one needs an owner, an approval, and proof it reached the people it covers.
Clause 5.1.1.1
Sites define and implement corporate responsibility policies, at minimum an anti-bribery policy, an employee code of conduct and an ethics escalation (whistle-blowing) policy.
Clause 4.4.1.2
A documented process manages product-safety related products and manufacturing processes, including statutory requirements, customer notification and any special approval of safety-related documents.
Clause 6.1.2.3
Contingency plans protect supply when key equipment, external supply, utilities or systems fail, and are reviewed, tested for effectiveness and communicated to employees.
Clause 7.5.1.1
The quality manual covers the scope and exclusions, the documented processes or references to them, process interactions and a record of where customer-specific requirements are met.
Clause 7.2.3
A documented process verifies that system, manufacturing process and product auditors are competent, and the site keeps a list of qualified internal auditors.
Citations are to the standard or regulation; wording is ours. IATF has not printed an end date for the second-edition transition; it says the transition ends with the ISO 9001 transition, which Global ACI sets at 30 September 2029. Clause 5.1.1.1 follows the IATF 16949 structure; confirm it against your copy.
What reviewers sample about these documents and the people they cover.
Auditors ask for the anti-bribery policy, code of conduct and whistle-blowing policy, and check that employees know how to raise a concern.
Auditors review the quality manual's record of customer-specific requirements for all direct customers and trace selected requirements into the processes that meet them.
Auditors request contingency plans with evidence of periodic review, testing for effectiveness, including cyber-attack scenarios, and employee awareness of the plan.
Auditors sample internal auditors from the qualified list and check competency records against the minimum competencies for system, process and product auditors.
Write each policy, send it through approval, and send it to the people it covers. Each acknowledgment is recorded by name, with the version, the date and the time.
When a policy changes, the new version is approved, its Editor sends it out again, and everyone it applies to is asked again. Export the record as a PDF or CSV, or give a reviewer Viewer access to the documents their tags allow.
Need help with the rest of IATF 16949? Find a consultant for your standard (opens in a new tab).
Your region’s laws, the standards your customers ask for, and your own house rules. Write each one as a policy, approve it, and send it to the people it covers.
IATF Stakeholder Communique SC-2026-005 (July 2026) gives an indicative mid-2027 publication, after drafting and external feedback in 2026. The end of the transition will be aligned with the end of the ISO 9001 transition.
The IATF lists five priorities: simplification and clarity, software quality assurance, Tier N supply chain management, launch management and customer-specific requirements. One goal is to fold common customer-specific requirements into the standard where possible.
Yes. The IATF FAQs confirm that multiple documented processes can be grouped into one or more processes, documented in the way that suits the business.
No. An IATF Sanctioned Interpretation to clause 7.5.1.1 clarifies that a table, list or matrix is acceptable, and the format is the organization's choice. The record must cover all direct customers, including non-IATF vehicle makers and tier suppliers.
Rules 6th Edition became fully effective on 1 January 2025. Surveillance is now on a 12-month cycle only, and timing for nonconformity responses was tightened, with 15 calendar days for an initial response to a major nonconformity.
free for 30 days