Practical IATF 16949 (17) | Comparison of Clauses between IATF 16949 and ISO 9001: Comprehensive List of Additional Requirements and Implementation Vehicles
A car parts company received a secondary supplier order from a major automaker, with the client requiring the company to obtain an IATF 16949 certificate within a year. The quality department conducted a gap analysis by laying out the tables of contents for both ISO 9001 and IATF 16949, and checking each chapter and clause—marking "existing" for those in ISO 9001 and "new" for those in IATF 16949. After ten days, they produced a twelve-page comparison table, concluding that there were "47 differences, requiring 5 new procedure documents."
However, on the third day of the consultant's visit, three critical issues were identified: the table did not include 10.2.4 poka-yoke, 8.5.1.6 tooling management, or 7.2.4 second-party auditor capability. The control plan was marked as "already covered in ISO 9001 8.5.1," and thus not considered a difference. The company added five procedure documents based on this table, but the on-site audit still issued nonconformities for the control plan, equipment maintenance, and second-party auditor qualifications.
The gap analysis was inaccurate because it counted differences based on whether the clause numbers existed. IATF 16949 has three forms of additional requirements, only one of which is visible in the table of contents; the other two are hidden under parent clauses and cannot be counted by page numbers alone.
1. Differences Have Only Three Forms; Identify the Form Before Comparison
| Form | Identification Characteristics | Typical Clauses | Typical Misjudgments in Table of Contents |
|---|---|---|---|
| Strengthening (Supplementary Sub-clause) | Third-level clause number added after the parent clause, which already exists in ISO 9001 | 8.5.1.1 control plan, 8.5.1.3 work preparation verification, 9.3.2.1 management review input | Seeing "8.5.1 existing" and skipping the entire section, missing all supplementary requirements |
| Pure Addition (New Subject) | No corresponding subject in ISO 9001, independently numbered in the table of contents | 4.4.1.2 product safety, 6.1.2.3 emergency plan, 10.2.4 poka-yoke, 10.2.5 warranty management | Only comparing "chapter titles," new subjects have no implementation points in the old system, making them impossible to match |
| Scope Change (Same Subject with Different Scope) | Same subject, but different objects, scope, or evaluation criteria | 8.4.2.3 supplier system development, 7.5.3.2.1 record retention, 3.1 term "customer requirements" includes CSR | Executing according to old habits, documents written but requirements not met |
Once the evaluation criteria are established, the first step in gap analysis is clear: use "supplementary clauses" as rows, one clause per row, without merging or grouping by chapter. IATF 16949 has about 70 supplementary clauses (including sub-clauses), and a mature gap matrix will have 70 rows, each with three fields: "who is responsible, which document implements, and what evidence is used for verification."
2. Chapters 4-5: Additional Requirements for System Scope and Leadership
| ISO 9001 Clause | IATF Supplementary Clause | Key Points of Additional Requirements | Implementation Vehicle | Common Audit Evidence |
|---|---|---|---|---|
| 4.3 System Scope | 4.3.1 Scope—Supplementary | Support functions (design center, distribution center, training facilities) must be included in the scope, or the exclusion reasons must be stated; outsourced processes cannot be an exclusion reason | Quality manual "scope and exclusions" section | Manual scope description, list of support facilities, list of outsourced processes |
| 4.3 System Scope | 4.3.2 Customer-Specific Requirements | Must identify and evaluate CSR, and include them in the system scope | CSR list and comparison matrix | CSR acquisition channels, version date, clause mapping table |
| 4.4 System and Processes | 4.4.1.1 Product and Process Conformance | All products and processes (including service parts and outsourced processes) must meet customer and regulatory requirements, including material conformance | Product conformance statement, material compliance report | Material composition report, regulatory compliance list |
| 4.4 System and Processes | 4.4.1.2 Product Safety | Documented product safety process: identification and control of safety characteristics, responsibilities and escalation, special approval of FMEA and control plan, traceability, full supply chain communication, training | Product safety control procedure, safety characteristics list | Safety characteristics list, FMEA approval records, escalation records for safety-related nonconformities |
| 5.1.1 Leadership | 5.1.1.1 Corporate Responsibility | Clearly define and implement a corporate responsibility policy, including anti-bribery, employee code of conduct, and ethical escalation (whistleblowing) policy | Corporate responsibility policy, employee handbook | Policy publication and dissemination records, whistleblowing channel and handling records |
| 5.1.1 Leadership | 5.1.1.2 Process Effectiveness and Efficiency | Top management must review the effectiveness and efficiency of product realization and support processes, and the results must be included in the management review | Process review plan and report | Process review records, management review input list |
| 5.1.1 Leadership | 5.1.1.3 Process Owners | Appoint an owner for each process, responsible for process output, and with the necessary competence | Process list and process owner appointments | Process list, appointment documents, competence evaluation records |
| 5.3 Responsibilities and Authorities | 5.3.1 Responsibilities and Authorities—Supplementary | Designated personnel must have the responsibility and authority to ensure that nonconforming products are not released and corrective actions are implemented | Job responsibility statements, authority matrix | Appointment letters, stop-line/stop-shipment authorization records |
| 5.3 Responsibilities and Authorities | 5.3.2 Responsibilities and Authorities for Product Requirements and Corrective Actions | Clearly define personnel with the authority to stop production and delivery to ensure product conformance | Authorization matrix | Stop-line authorization, records of unauthorized release |
This chapter is often treated as a "leadership issue" and glossed over. In actual audits, 4.3.1 support facilities and 5.1.1.3 process owners are frequent nonconformities—support facilities are often excluded with the excuse "design is at headquarters, not in the audit scope," and in a process list of 30 processes, only 5 responsible persons are listed.
3. Chapter 6: Additional Requirements for Risk, Emergency Plans, and Quality Objectives
| ISO 9001 Clause | IATF Supplementary Clause | Key Points of Additional Requirements | Implementation Vehicle | Common Audit Evidence |
|---|---|---|---|---|
| 6.1 Risk and Opportunities | 6.1.2.1 Risk Analysis | Risk analysis must cover specific consequences in the automotive industry, such as product recalls, field failures, and process failures, and retain documented information | Risk list, FMEA, and risk register | Risk identification records, action tracking sheets |
| 6.1 Risk and Opportunities | 6.1.2.2 Preventive Actions | Preventive actions must be linked to risk analysis results and evaluated for effectiveness | Preventive action ledger | Action-risk relationship, effectiveness verification data |
| 6.1 Risk and Opportunities | 6.1.2.3 Emergency Plan | Covers power outages, material shortages, critical equipment failures, labor shortages, key supplier interruptions, cyber attacks, and epidemics; includes recovery time objectives and regular testing | Emergency plan, drill plans and records | Scenario list, RTO indicators, drill records and improvement items |
| 6.2.2 Quality Objectives | 6.2.2.1 Quality Objectives—Supplementary | Objectives must be measurable, based on customer requirements, included in the business plan, and reviewed regularly | Annual quality objectives and business plan | Objective breakdown table, monthly achievement data |
The emergency plan clause has been strengthened twice in the accreditation interpretations since 2020: drills must cover cyber attack scenarios, and emergency plans for suppliers must also be reviewed. Posting a "power outage emergency plan" on the wall is no longer sufficient to meet the requirements.
4. Chapter 7: Additional Requirements for Support Processes (The Chapter with the Most Omissions)
| ISO 9001 Clause | IATF Supplementary Clause | Key Points of Additional Requirements | Implementation Vehicle | Common Audit Evidence |
|---|---|---|---|---|
| 7.1.3 Infrastructure | 7.1.3.1 Factory Facilities and Equipment Planning | Manufacturing feasibility assessment, capacity and cycle time planning, material flow and lean layout, impact assessment of downtime on delivery | Factory layout diagram, capacity planning table | Capacity calculation, layout optimization records |
| 7.1.4 Operating Environment | 7.1.4.1 Operating Environment—Supplementary | Order, cleanliness, and personnel safety (including protection and hygiene) in the production area | On-site management standards, 6S inspection sheet | On-site inspection records, accident ledger |
| 7.1.5.1 Monitoring and Measuring Resources | 7.1.5.1.1 Measurement System Analysis | Conduct MSA according to the measurement system analysis plan, covering measurement systems referenced in the control plan | MSA plan, MSA report | Correspondence between plan and gauge ledger, GR&R report |
| 7.1.5.2 Measurement Traceability | 7.1.5.2.1 Calibration/Validation Records | Gauge identification, calibration records (including traceability of standard parts), product impact assessment when calibration fails | Gauge ledger, calibration certificates | Gauge number, calibration validity period, traceability assessment records for failures |
| 7.1.5.3 Laboratory | 7.1.5.3.1 Internal Laboratory | Laboratory scope document covering actual inspection and testing projects; personnel, equipment, methods, and records are complete | Laboratory scope document | Comparison of scope document with actual projects |
| 7.1.5.3 Laboratory | 7.1.5.3.2 External Laboratory | External laboratories must have ISO/IEC 17025 accreditation or written customer approval | List of external laboratories and qualifications | Whether the accreditation scope covers the commissioned projects |
| 7.2 Competence | 7.2.1 Competence—Supplementary | Training effectiveness evaluation and job skill matrix | Skill matrix, training effectiveness records | Matrix covering all key positions, evaluation methods |
| 7.2 Competence | 7.2.2 Competence—On-the-Job Training | On-the-job training for new employees and those changing positions, including quality awareness and customer requirements | On-the-job training plan and records | Mentorship records, job qualification confirmation |
| 7.2 Competence | 7.2.3 Competence of Internal Auditors | Internal auditors must have the necessary competence (training + audit experience) | List of internal auditor qualifications | Training certificates, audit experience records |
| 7.2 Competence | 7.2.4 Competence of Second-Party Auditors | Second-party auditors must have automotive industry audit capabilities, including expertise in the processes being audited | List of second-party auditor qualifications | Qualification evaluation, audit records |
| 7.3 Awareness | 7.3.1 Awareness—Supplementary | All personnel must be aware of CSR, product safety, and the handling and escalation of nonconforming products | Awareness training materials | On-site interviews, random questioning records |
| 7.3 Awareness | 7.3.2 Employee Motivation and Empowerment | Documented motivation and empowerment process to promote the achievement of quality objectives and continuous improvement | Incentive management methods | Incentive implementation records, improvement proposal ledger |
| 7.5.1 Documented Information | 7.5.1.1 System Documents | Quality manual + system document list | Quality manual, document list | Consistency between manual and list versions |
| 7.5.3 Document Control | 7.5.3.2.1 Record Retention | Retention period must meet customer and regulatory requirements and be at least as long as the product life cycle | Record retention list | Comparison of retention period with customer contract |
| 7.5.3 Document Control | 7.5.3.2.2 Engineering Specifications | Customer engineering specifications and changes must be reviewed, distributed, and implemented within 10 working days | Engineering specification receipt and review records | Time difference between receipt and implementation dates |
In the 15 clauses of Chapter 7, 7.2.4 and 7.5.3.2.2 are the most typical "rules without evidence": second-party auditor qualifications often consist of only an ISO 9001 internal auditor certificate, and engineering specification reviews are often not implemented until a month after receipt, revealing a significant time lag.
5. Chapter 8: Additional Requirements for Operations (The Chapter with the Most Clauses)
Design and Development (8.3)
| ISO 9001 Clause | IATF Supplementary Clause | Key Points of Additional Requirements | Implementation Vehicle |
|---|---|---|---|
| 8.3.1 General | 8.3.1.1 Design and Development—Supplementary | The design and development process must be documented, including APQP or equivalent methods | APQP procedure, project plan |
| 8.3.2 Planning | 8.3.2.1 Planning—Supplementary | Multidisciplinary team, cross-functional interfaces, alignment with customer milestones | Project team appointment, Gantt chart |
| 8.3.2 Planning | 8.3.2.2 Product Design Skills | Design personnel must have the necessary skills and be proficient in using specified tools | Design personnel skill matrix |
| 8.3.2 Planning | 8.3.2.3 Embedded Software | Products with embedded software must have a software development and validation capability assessment | Software design specifications, validation records |
| 8.3.3 Input | 8.3.3.1 Product Design Input | Includes reliability, regulatory, material, appearance, and manufacturability requirements | Design input list |
| 8.3.3 Input | 8.3.3.2 Manufacturing Process Design Input | Includes capacity, cycle time, process capability, poka-yoke, ergonomics, and maintenance accessibility | Process design input list |
| 8.3.3 Input | 8.3.3.3 Special Characteristics | Identify and mark special characteristics, and form a list | Special characteristics list |
| 8.3.4 Control | 8.3.4.1 Monitoring | Monitor design activities at each stage, update APQP milestones and issue list | Stage review records |
| 8.3.4 Control | 8.3.4.2 Design Verification—Supplementary | Verification must cover customer and regulatory requirements | DV plan and report |
| 8.3.4 Control | 8.3.4.3 Prototype Sample Plan | Prototype sample manufacturing must be included in risk analysis and control plan | Sample control plan |
| 8.3.4 Control | 8.3.4.4 Product Approval Process | Implement PPAP or equivalent approval according to customer requirements | PPAP file package, PSW |
| 8.3.5 Output | 8.3.5.1 Design Output—Supplementary | Output must be verifiable and correspond to input requirements | Design output list |
| 8.3.5 Output | 8.3.5.2 Manufacturing Process Design Output | Process flow diagram, PFMEA, control plan, work instructions, acceptance criteria, capacity, maintenance plan | Process design file package |
| 8.3.6 Change | 8.3.6.1 Design Change—Supplementary | Changes must be evaluated for their impact on products and processes, and update FMEA and control plan | Change notification, impact analysis |
External Provision (8.4)
| ISO 9001 Clause | IATF Supplementary Clause | Key Points of Additional Requirements | Implementation Vehicle |
|---|---|---|---|
| 8.4.1 General | 8.4.1.1 / 8.4.1.2 Supplier Selection | Documented supplier selection criteria, including quality systems, risk, and performance | Supplier admission procedure |
| 8.4.1 General | 8.4.1.3 Customer-Specified Sources | Customer-specified sources must still be controlled, but this does not exempt quality responsibility | List of customer-specified sources and monitoring records |
| 8.4.2 Control | 8.4.2.1 Control Type—Supplementary | Control methods and levels based on risk, performance, and product importance | Supplier grading control matrix |
| 8.4.2 Control | 8.4.2.2 Regulatory Requirements | Outsourced processes must comply with regulations and material requirements | Material compliance statement |
| 8.4.2 Control | 8.4.2.3 Supplier System Development | Target is IATF 16949 certification; at least ISO 9001 first, phased implementation | Supplier system development plan |
| 8.4.2 Control | 8.4.2.3.1 Automotive Software Suppliers | Suppliers providing automotive-related software must be evaluated for software development capability | Software supplier evaluation form |
| 8.4.2 Control | 8.4.2.4 Supplier Monitoring | Monitoring indicators include delivery performance, PPM, special status, customer interruptions, and second-party audit results | Supplier monthly scorecard |
| 8.4.2 Control | 8.4.2.4.1 Second-Party Audit | Conduct second-party audits based on risk, and auditors must meet 7.2.4 | Second-party audit plan and report |
| 8.4.2 Control | 8.4.2.5 Supplier Development | Develop underperforming suppliers, including coaching and verification | Supplier development plan and acceptance |
| 8.4.3 Information | 8.4.3.1 External Supplier Information—Supplementary | Must communicate special characteristics, traceability, change notifications, and PPAP requirements to suppliers | Purchase agreement, technical agreement |
Production and Service Provision (8.5)
| ISO 9001 Clause | IATF Supplementary Clause | Key Points of Additional Requirements | Implementation Vehicle |
|---|---|---|---|
| 8.5.1 Production Control | 8.5.1.1 Control Plan | Covers all products and manufacturing sites, linked with PFMEA, and must be approved by the customer if required | Control plan (three stages) |
| 8.5.1 Production Control | 8.5.1.2 Standard Work | Work instructions must be understandable by operators (including language), and visual standards must distinguish good from bad | Work instructions, limit samples |
| 8.5.1 Production Control | 8.5.1.3 Work Preparation Verification | Verification required after changeover, startup, and shift change, and retain first and last piece records | First piece confirmation form, changeover inspection form |
| 8.5.1 Production Control | 8.5.1.4 Verification After Unplanned Downtime | Verify process effectiveness before resuming production after unplanned downtime | Resumption verification records |
| 8.5.1 Production Control | 8.5.1.5 Total Productive Maintenance | Identify critical equipment, set maintenance targets, implement preventive and predictive maintenance, and evaluate effectiveness | Equipment ledger, TPM plan, OEE |
| 8.5.1 Production Control | 8.5.1.6 Tooling Management | Full management of tooling and gauges, including identification, status, maintenance, repair, and disposal | Tooling ledger, repair records |
| 8.5.1 Production Control | 8.5.1.7 Production Scheduling | Schedule production based on orders and capacity, monitor capacity and delivery risks | Scheduling rules, capacity load table |
| 8.5.2 Identification and Traceability | 8.5.2.1 Identification and Traceability—Supplementary | Batch or serial number traceability, with forward and backward traceability capabilities, and retention period meeting customer requirements | Traceability ledger, traceability drill records |
| 8.5.4 Protection | 8.5.4.1 Protection—Supplementary | Protection covers the entire process from procurement to delivery, including inventory turnover and shelf life | Warehouse management standards, FIFO records |
| 8.5.5 Post-Delivery | 8.5.5.1 Service Information Feedback | Issues discovered during service must be fed back to design and manufacturing | Service information feedback process |
| 8.5.5 Post-Delivery | 8.5.5.2 Service Agreement with Customer | Service agreement content must align with system requirements and be controlled | Service agreement, spare parts support plan |
| 8.5.6 Change Control | 8.5.6.1 Change Control—Supplementary | Review FMEA and control plan before any change, and conduct trial production if necessary | Change application form, trial production report |
| 8.5.6 Change Control | 8.5.6.1.1 Temporary Process Control Change | Establish a list of process controls (including poka-yoke devices), and alternative methods must be approved and verified | Temporary change list and approval records |
Release and Nonconforming Output (8.6, 8.7)
| ISO 9001 Clause | IATF Supplementary Clause | Key Points of Additional Requirements | Implementation Vehicle |
|---|---|---|---|
| 8.6 Release | 8.6.1 Release—Supplementary | Release must comply with the control plan and acceptance criteria, and retain traceable release records | Inspection records, release forms |
| 8.6 Release | 8.6.2 Full Dimensional Inspection and Functional Testing | Conduct according to the frequency in the control plan; at least once a year if not specified by the customer | Annual full dimensional inspection plan and report |
| 8.6 Release | 8.6.3 Appearance Items | Appearance items must have an approved master sample, evaluation area, and lighting conditions | Master sample list, appearance evaluation records |
| 8.6 Release | 8.6.4 Verification of Externally Provided Products | Verify and accept externally provided products according to the control plan | Incoming inspection specifications and records |
| 8.6 Release | 8.6.5 Regulatory Compliance | Verify and document the regulatory compliance of products and processes | Regulatory list and compliance statement |
| 8.6 Release | 8.6.6 Acceptance Criteria | Acceptance criteria for attribute sampling is zero defects unless otherwise specified by the customer | Acceptance criteria in inspection specifications |
| 8.7 Nonconforming Output | 8.7.1.1 Customer Concession Authorization | Concession acceptance must be authorized in writing by the customer and retain identification and traceability | Concession application and approval |
| 8.7 Nonconforming Output | 8.7.1.2 Customer-Specified Process | Handle nonconforming products according to the customer-specified process | Customer nonconforming product handling process |
| 8.7 Nonconforming Output | 8.7.1.3 Control of Suspect Product | Suspect products must be identified, isolated, and reviewed to prevent misuse | Suspect product area and review records |
| 8.7 Nonconforming Output | 8.7.1.4 Control of Reworked Product | Rework must include risk analysis, work instructions, and re-inspection | Rework work instructions, re-inspection records after rework |
| 8.7 Nonconforming Output | 8.7.1.5 Control of Repaired Product | Repair must be approved by the customer (if required) and assess the impact on lifespan | Repair approval, impact assessment report |
| 8.7 Nonconforming Output | 8.7.1.6 Customer Notification | Notify the customer of nonconformities and suspect products according to customer requirements | Customer notification records |
| 8.7 Nonconforming Output | 8.7.1.7 Nonconforming Product Disposition | Clear and traceable disposition methods, including scrap and concession | Nonconforming product ledger |
6. Chapters 9-10: Additional Requirements for Performance Evaluation and Improvement
| ISO 9001 Clause | IATF Supplementary Clause | Key Points of Additional Requirements | Implementation Vehicle |
|---|---|---|---|
| 9.1.1 Monitoring and Measurement | 9.1.1.1 Manufacturing Process Monitoring and Measurement | All manufacturing processes must be monitored, including process capability and process studies | Process capability ledger, SPC records |
| 9.1.1 Monitoring and Measurement | 9.1.1.2 Statistical Tool Identification | Identify and determine the statistical tools used in each process | Statistical tool list |
| 9.1.1 Monitoring and Measurement | 9.1.1.3 Application of Statistical Concepts | Relevant personnel must understand variation, control, over-adjustment, and process capability | Training records, on-site random questioning |
| 9.1.2 Customer Satisfaction | 9.1.2.1 Customer Satisfaction—Supplementary | Includes monitoring of delivery performance, customer scorecards, and customer interruption events | Customer satisfaction analysis report |
| 9.2.2 Internal Audit | 9.2.2.1 Internal Audit Plan | Covers all processes and shifts, including system, process, and product audits, with frequency based on risk | Annual audit plan |
| 9.2.2 Internal Audit | 9.2.2.2 System Audit | Covers all clauses and processes, including CSR compliance | System audit checklist |
| 9.2.2 Internal Audit | 9.2.2.3 Manufacturing Process Audit | Covers all manufacturing processes and shifts within a three-year cycle | Process audit plan, VDA6.3 report |
| 9.2.2 Internal Audit | 9.2.2.4 Product Audit | Conduct product audits according to customer requirements and product importance | Product audit report |
| 9.3.1 Management Review | 9.3.1.1 Management Review—Supplementary | At least once a year, frequency and form must be documented | Management review plan |
| 9.3.2 Review Input | 9.3.2.1 Input—Supplementary | Includes poor quality cost, process efficiency, maintenance targets, warranty performance, customer scorecards, and field failures | Management review input list |
| 9.3.3 Review Output | 9.3.3.1 Output—Supplementary | Output includes improvement priorities and is compared with the business plan | Management review report and action ledger |
| 10.2 Nonconformities and Corrective Actions | 10.2.3 Problem Solving | Documented problem-solving process, including containment, root cause, effectiveness verification, and horizontal deployment | 8D report, horizontal deployment records |
| 10.2 Nonconformities and Corrective Actions | 10.2.4 Poka-Yoke | Identify poka-yoke needs, design and verify poka-yoke devices, and include them in the control plan and PFMEA | Poka-yoke list, challenge piece verification records |
| 10.2 Nonconformities and Corrective Actions | 10.2.5 Warranty Management | Establish a warranty management process if warranty responsibility is assumed, including NTF piece analysis | Warranty management procedure, NTF analysis report |
| 10.2 Nonconformities and Corrective Actions | 10.2.6 Customer Complaints and Field Failure Analysis | Customer complaints and field failure pieces must be analyzed and fed back into the FMEA | Failure analysis report, FMEA update records |
| 10.3 Continuous Improvement | 10.3.1 Continuous Improvement—Supplementary | Improvements must have goals, projects, and verification | Improvement project ledger |
7. The 12 Most Commonly Missed Clauses: Self-Checklist and Consequences of Omission
The following 12 clauses are the most frequently missed in gap analysis. The usage is simple: answer the "judgment questions" one by one. A "no" answer indicates a gap.
| # | Supplementary Clause | Judgment Question | Consequences of Omission |
|---|---|---|---|
| 1 | 4.4.1.2 Product Safety | Is there a product safety process document covering elements a to m, and listing all safety characteristics? | Safety piece incident escalation channel is interrupted, a major nonconformity |
| 2 | 6.1.2.3 Emergency Plan | Does the scenario list include cyber attacks and epidemics, and have drills been conducted in the past 12 months? | No plan for delivery interruptions, risk of customer line stoppage |
| 3 | 8.3.2.3 Embedded Software | Has a software development capability assessment been conducted for products with embedded software? | Software version chaos, incorrect flashing |
| 4 | 7.1.5.3.1 Internal Laboratory | Does the laboratory scope document cover all actual inspection and testing projects? | Data for out-of-scope projects is not recognized |
| 5 | 7.1.5.3.2 External Laboratory | Does the accreditation scope of the external laboratory cover the commissioned projects? | External reports are invalid, PPAP is rejected |
| 6 | 7.2.4 Second-Party Auditor Capability | Do second-party auditors have proof of automotive industry audit experience, not just an internal auditor certificate? | Second-party audit conclusions are not accepted |
| 7 | 8.4.2.3 Supplier System Development | Is there a phased supplier system development plan and progress tracking? | Inability to close the loop on supply chain system weaknesses |
| 8 | 8.5.1.6 Tooling Management | Does tooling have a ledger, status identification, and repair records? | No traceability for dimensional drift caused by tooling failure |
| 9 | 8.5.1.7 Production Scheduling | Does scheduling consider capacity load and delivery risk, not just orders? | Fluctuations in delivery performance, decline in customer scorecard |
| 10 | 8.6.2 Full Dimensional Inspection | Is there an annual full dimensional inspection plan and has it been completed on schedule? | Lack of periodic evidence for product conformance |
| 11 | 10.2.4 Poka-Yoke | Does the poka-yoke device have a list and is it verified with challenge pieces on schedule? | No one notices poka-yoke failure, leading to batch release |
| 12 | 10.2.5 Warranty Management | Is there a method for analyzing warranty pieces and determining NTF? | Uncontrolled warranty costs, inability to feed back failure modes |
8. Five-Step Gap Analysis Method: From Clause Matrix to Priority Ranking
Step 1: Build the Matrix. Use supplementary clauses as rows (approximately 70 rows), with at least 6 fields: clause number, key points of requirements, current status description, evidence number, score, and responsible person.
Step 2: Collect Evidence for Each Clause. Do not look at document titles, but at records. The only criterion for judgment is whether real records from the past 12 months can be produced. Documents that look good but lack execution records are directly scored 1.
Step 3: Four-Level Scoring.
| Score | Status Definition | Judgment Basis |
|---|---|---|
| 0 | No requirement, no document, no execution | The requirement cannot be found in the system |
| 1 | Document exists, not executed or no execution records | Document exists but does not match the site, or records are missing |
| 2 | Executed, records exist, but no data or no closure | Records can be checked, but lack trend data or measure verification |
| 3 | Effectively operating, with data and improvements | Indicators, trends, and improvement cases exist |
Step 4: Calculate Priority. Use P = (3 − score) × R × C to rank, where R is the clause risk weight and C is the customer attention weight.
- R: Safety, regulations, special characteristics = 3; delivery and traceability = 2; general management = 1.
- C: Customer CSR or scorecard explicitly requires = 2; general = 1.
Example: A company scores 0 for 10.2.4 poka-yoke, R=3 (involves missed safety characteristic inspection), C=2 (customer CSR requires poka-yoke verification), P=(3−0)×3×2=18, listed for immediate rectification; 7.3.2 employee motivation scores 2, R=1, C=1, P=1, listed for annual improvement.
Step 5: Output the Rectification Plan. Divide the P values into three categories: P≥9 to be completed within 30 days; 6～8 to be completed within 90 days; <6 to be included in the annual plan. Each rectification must clearly state "which document to modify, which type of record to supplement, who will verify, and what data will be used for verification."
9. Implementation Vehicles: Which to Integrate into Existing Documents, Which to Create New
The output of gap analysis is not just a table, but a list of document modifications. The best practice is: if a chapter can be added to an existing ISO 9001 procedure, do not create a new procedure document.
| Handling Method | Applicable Clauses | Approach |
|---|---|---|
| Integrate into Existing Procedures (Add Chapters) | 5.1.1.x Corporate Responsibility and Process Owners, 7.1.4.1 On-Site Environment, 7.5.3.2.x Record Retention and Engineering Specifications, 8.6.x Release and Acceptance Criteria | Add a section "Automotive Industry Supplementary Requirements" to the original procedure, noting the clause number |
| Expand Existing Procedures (Modify Judgment Criteria) | 8.4.x Supplier Management, 8.5.6.1 Change Control, 9.2.2.x Internal Audit, 10.2.3 Problem Solving | Replace the original judgment criteria, add indicators and record forms |
| Must Create New Independent Documents | 4.4.1.2 Product Safety, 6.1.2.3 Emergency Plan, 8.3.4.4 Product Approval, 8.5.1.1 Control Plan, 8.5.1.5 TPM, 8.5.1.6 Tooling Management, 7.2.4 Second-Party Auditor Capability, 10.2.4 Poka-Yoke, 10.2.5 Warranty Management | Independent themes, multiple cross-department interfaces, mixed writing can lead to unclear responsibilities |
Typically, a medium-sized parts company upgrading from ISO 9001 to IATF 16949 needs to create 8 to 10 new independent documents and expand 6 to 8 existing ones, with the rest supplemented by forms. Any plan listing more than 20 "new documents" is likely treating forms as procedure documents.
10. 90-Day Implementation Schedule
| Stage | Weeks | Main Deliverables | Judgment Threshold |
|---|---|---|---|
| Build the Matrix | Weeks 1-2 | 70-row gap matrix, CSR comparison table | Each row has a current status description and evidence number |
| Collect Evidence and Score | Weeks 3-5 | Clause-by-clause scoring and evidence list | All 0 and 1 score items confirmed on-site |
| Determine Priority | Week 6 | P value ranking table, rectification plan | Each item includes responsible person and verification data |
| Document Modification | Weeks 7-10 | Create 8-10 new documents, expand 6-8 existing ones | Documents reviewed, approved, and published |
| Trial Operation | Weeks 11-12 | Activate record forms, internal audit sampling | Sample 20 items, scores improved to 2 or above |
11. Key Points for Implementation and Common Errors
- Count by Supplementary Clauses, Not by Chapters. A 70-row matrix is the minimum requirement; a 12-page "chapter comparison table" will inevitably miss items because strengthening clauses are not visible in the table of contents.
- List CSR Separately. Customer-specific requirements and standard clauses are two different sets of requirements. Mixing them in one table will ultimately sacrifice one. The CSR table should answer "which clause and which document this requirement falls under."
- Prioritize Evidence Over Documents. Scoring 2 or 3 depends on whether there are trend data and improvement cases, not on how detailed the documents are.
- Do Not Treat "Existing ISO 9001 Certificate" as a Starting Point. Support functions in 4.3.1 and supplier system development in 8.4.2.3 are often reasonably excluded in the ISO 9001 system and must be re-included during the upgrade.
- Calculate Priority, Do Not Guess. Ranking rectifications by feel will result in "easy-to-fix items being addressed first," while safety and customer-focused items are left until last.
- Complete All Changes in One Go, Not in Batches. One round of gap matrix modification, one round of document modification, and one round of record supplementation, with a six-month gap in between, will result in inconsistent criteria during audits, making the situation worse than not changing at all.
Differences are not counted, they are verified clause by clause
Knowledge code: 15.1.1
Version: v20261009
Author: QTank QTank is dedicated to providing systematic professional knowledge, methodologies, and practical tools for quality management practitioners, helping companies continuously improve their quality capabilities.