IATF 16949 Audit Action Items: A Supplier’s Playbook for Responding, Closing, and Avoiding the Next One

Q: What is the difference between a minor and a major IATF 16949 nonconformity?

A minor nonconformity is an isolated lapse that does not indicate a systemic breakdown — e.g. one missing signature on a single calibration record. A major nonconformity indicates a systemic breakdown, puts product conformity at significant risk, or is a failure of Clauses 7.5.3 (control of records) or 8.5.2 (control of production). The classification matters because a major triggers a 60-day closure deadline and can suspend your certificate if not closed in time.

Q: How long do I have to respond to an IATF 16949 audit finding?

For a minor , the certification body (CB) typically allows 60–90 days from the audit closure date. For a major , the standard window is 60 days , and the clock is hard — if the closure package is not accepted by the CB within 60 days, the certificate is suspended and eventually withdrawn. Most suppliers give themselves a 5-day internal buffer and aim to submit on day 55, not day 60.

Q: Can I dispute a major nonconformity?

You can submit a formal objection in writing to the CB, with counter-evidence. The CB’s internal review process will consider it. Practically speaking, disputing a major NC on a technicality is rarely successful — the CB’s auditors are trained to document the evidence; if they wrote it up as major, the evidence usually supports it. A more productive use of time is to accept the NC, focus the 60-day response on a strong root cause and effectiveness check, and request a downgrade to minor in your closure submission if the evidence supports it.

When an IATF 16949 surveillance or re-certification audit closes with action items, the supplier has a fixed window to respond with a root-cause analysis, corrective action, and evidence of effectiveness. Most suppliers treat this as paperwork; the ones who treat it as a system-level fix close the action, keep the certification, and avoid the next finding. This page walks through the response process, the classification logic, and the evidence that satisfies the certification body.

What an IATF 16949 Audit Action Item Actually Is

IATF 16949:2016 is the automotive QMS standard, owned by the International Automotive Task Force (IATF) and accredited by ANSI (as American National Standard) and by ISO (as ISO 9001 with automotive extras). It replaced ISO/TS 16949:2009 in 2016 and is valid through 2027 with the next revision under preparation by the IATF.

An audit action item (also called a finding, nonconformity (NC), or observation) is a written statement from the certification body (CB) auditor identifying a requirement of the standard that is not being met. The CB issues a finding after each audit; the supplier must respond before the CB closes the audit cycle.

Three types of audit findings in IATF 16949:
• Nonconformity (NC) — a requirement is not met. Minor if it is an isolated lapse, Major if it is systemic or puts product conformity at risk. Must be closed before certification is issued / maintained.
• Observation — a condition that could become a nonconformity. Documented; usually requires a planned action but not a formal closure.
• Opportunity for Improvement (OFI) — a suggestion, not a requirement. Documented; no formal response needed.

The CB’s audit report will list each finding with the IATF clause reference, the evidence seen, and the requirement that was not met. The supplier’s response must address each one separately.

Minor vs Major Nonconformity — How the CB Classifies

The classification matters because it drives the response depth, the deadline, and the consequence.

Class	Definition (IATF wording)	Typical example	Response deadline	Consequence
Minor	A nonconformity that does not indicate a systemic breakdown of the QMS and does not put product conformity at significant risk	One calibration record missing a signature on a single gauge; one operator’s training record is 30 days past the due date	60–90 days from audit closure (per CB)	Closure requires a documented response + evidence; on-time closure does not affect certification
Major	A nonconformity that indicates a systemic breakdown, OR a nonconformity that puts product conformity at significant risk, OR any Clause 7.5.3 / 8.5.2 (control of production) failure, OR any customer-complaint-related failure without containment	PFMEA exists but no RPN scored for any row; special characteristics called out on the drawing but not traced to the control plan; no documented 8D for a customer complaint filed 6 months ago	60 days from audit closure (standard)	Certification is suspended until the major is closed; if not closed in 60 days, the suspension becomes a withdrawal

The 60-day major NC clock is hard. Unlike a minor NC, where the CB is more flexible on the response time, a major NC must be closed within 60 calendar days from the audit’s official closure date. If the supplier does not respond in time, the CB withdraws the IATF 16949 certificate. The withdrawal is then published in the IATF database (https://www.iatfglobaloversight.org/) and every customer sees it. Re-instatement requires a full re-audit, at the supplier’s cost.

The 7-Step Response Process — from Finding to Closure

The IATF requires a structured response, not just “we’ll fix it.” The de-facto structure is the same as ISO 9001 Clause 10.2 and aligns with 8D; the IATF CB auditors expect to see all seven steps documented.

Step	Name	What you do	Evidence you collect
1	Containment	Stop the bleeding — quarantine suspect product, lock the gauge, halt the process, notify the customer if shipped product is affected	Quarantine record, customer notification (8D D2), recall list if applicable
2	Root cause analysis	Find out why, not just what. Use 5-Why, fishbone (Ishikawa), or fault tree. Avoid “operator error” and “training” as a root cause without supporting evidence	5-Why worksheet, fishbone diagram, data analysis, supporting records
3	Corrective action plan	Define the action(s) that will eliminate the root cause and prevent recurrence. Include who, what, when	Action plan with owner, due date, and verification method
4	Implement corrective action	Execute the plan. Update documents, retrain, re-tool, re-spec, re-validate	Updated procedures, training records, validation reports
5	Effectiveness check	Prove the action worked — re-audit the specific process, re-measure, re-test, look for recurrence in the data	Re-audit report, re-measurement data, trend chart over 30–90 days post-implementation
6	Systemic review	Check if the same root cause exists in other cells, other products, other shifts. Fix everywhere, not just where the finding was raised	Cross-plant / cross-process audit report, list of additional actions taken
7	Closure documentation	Compile all evidence into a single response package for the CB; quality manager signs the closure request	Signed NC response form, all evidence attached, lessons-learned entry in the QMS

Step 5 is what most suppliers get wrong. They fix the immediate issue, write up the action, and skip the effectiveness check. The CB then comes back at the next surveillance audit, finds the same problem, and raises a major. A real effectiveness check runs 30–90 days after implementation and looks for evidence that the issue has not recurred — trend data, re-audit results, customer feedback. Without it, the closure is not credible.

What the CB Wants to See — Evidence by Clause

The IATF clauses most often raised as action items, and the evidence the CB will ask for in your response.

IATF clause	Topic	Common finding	Evidence in your response
4.4.1.2 / 7.5.3.2.1	Control of production / records	Records are missing, illegible, or stored only on personal drives	Records index, retention policy, backup evidence, audit log of access
6.1.2.1	Risk analysis	Risk register exists but no actions defined for high risks	Updated risk register with treatment actions, owners, dates
7.1.5.1 / 7.1.5.2	Calibration / measurement traceability	Gauge in use but calibration cert expired or from a non-accredited lab	Updated calibration schedule, ISO 17025 certs for the lab
7.2.4 / 7.3.3	Communication / design input	Customer requirements not communicated to production; design changes not propagated	Communication log, ECN distribution list with sign-offs
7.5.3.2.1	Control plan	Control plan doesn’t cover special characteristics, or reaction plan column is blank	Revised control plan with special chars and reaction plan filled in
8.3.3.3 / 8.3.5.1	Design FMEA / Process FMEA	PFMEA has no RPN scored, or actions not closed out	Revised PFMEA with RPN, action status, sign-off
8.5.1.1	Control plan (production)	Process is not running to the control plan on the shop floor	Operator work-instruction update, training records, layer-process-audit results
8.7.1.4	Customer notification of nonconforming product	Customer not notified when nonconforming product was shipped	8D D2 record, customer communication log
9.1.1.1 / 9.1.3.1	Analysis of data / management review	KPIs not trended, or management review is a rubber-stamp	Updated KPI dashboard, minutes of management review with actions
10.2.1	Nonconformity and corrective action	No documented 8D for known issues, or 8D open for > 60 days	Completed 8D per AIAG 8D Disciplinary Procedure (rev 2008 or 2014)

Common Action Items — What the CB Raises Most Often

From the IATF CB audit reports shared in supplier communities and from the IATF sanction reports published on the IATF Global Oversight website, the action items that show up in 70% of supplier audits are:

#	Action item	Typical clause	Why it keeps showing up
1	PFMEA does not cover all special characteristics, or RPN not scored	8.3.5.1 / IATF SI 12	PFMEA treated as a one-time template, not a living document
2	Control plan reaction plan column is blank or generic	8.5.1.1 / APQP	Control plan copied from a template; reaction plan not thought through
3	Calibration cert from a non-accredited lab, or cert expired	7.1.5.2	Calibration treated as a checkbox; ISO 17025 requirement misunderstood
4	Customer complaints with no documented 8D, or 8D open > 60 days	10.2.1 / 8.7.1.4	No customer-complaint SOP, or complaint handling done in chat tools
5	Management review is a formality — minutes exist but no actions tracked to closure	9.3	Review held but not used as a management tool
6	Internal audit does not cover all IATF clauses, or auditor not competent	9.2.2	Internal audits scheduled to a calendar, not to risk; auditors not trained
7	Production process does not match the control plan (audit finds operator running differently from the doc)	8.5.1.1	Process change made on the floor but not propagated to the doc
8	Risk register exists but high-risk items have no treatment plan	6.1.2.1	Risk analysis done once, not maintained as a living document
9	Records stored on personal drives, not in the QMS, and not retrievable	7.5.3	No record retention policy, or policy not enforced
10	Customer-specific requirements (CSRs) not implemented at the process level	8.3.3 / IATF SI 1	CSRs received by sales / quality but not communicated to production

Sanctions-correlated items. The IATF Global Oversight publishes quarterly sanction reports listing the most common reasons for certificate suspension and withdrawal. Items 1, 2, 4, and 7 in the table above are the most-cited in suspension decisions. Treat them as “must-pass” in your internal audit before the CB arrives.

The Response Timeline — How the 60 Days Play Out

For a major NC, the 60-day window is the difference between keeping and losing certification. The CB expects a specific workflow within that window.

Day	Milestone	Owner	Deliverable
0	Audit closes; CB issues the audit report with the major NC	CB lead auditor	Audit report, NC statement, evidence cited
1–3	Internal kick-off; quality manager convenes the response team; containment actions confirmed	Quality manager	Containment record, response team, plan
3–10	Root cause analysis (5-Why, fishbone, data review); interim update to CB if requested	Engineer + quality	Root cause analysis report
10–20	Corrective action defined; plan reviewed by process owner and quality manager	Process owner	Corrective action plan, with dates and owners
20–40	Corrective action implemented (doc update, training, gauge replacement, etc.)	Process owner	Updated documents, training records, validation evidence
40–55	Effectiveness check (re-measure, re-audit, trend data)	Quality manager	Effectiveness check report, trend data
55–60	Closure package compiled and submitted to CB	Quality manager	Signed NC response form, all evidence
60+	CB reviews the package; either accepts closure (NC closed) or rejects (escalation to withdrawal)	CB	Closure letter or escalation notice

Day 40–55 is the risk window. The fix is in place; the trend data is too short to prove effectiveness. Two common failure modes: (a) the supplier submits the closure on day 60 with only 15 days of post-fix data, and the CB rejects on insufficient evidence of effectiveness; (b) the supplier runs into an unexpected obstacle (gauge on backorder, training rescheduled) and blows the day-60 deadline. The fix is to start the response on day 1, not day 14, and to give yourself a 5-day buffer before the deadline.

If the Action Item Is a Major — What Else Changes

A major NC triggers actions beyond the 60-day response window. Most suppliers don’t realize these are coming until the CB tells them.

Customer notification. Most automotive OEMs require you to notify them within 24–72 hours of receiving a major NC on your IATF certificate. The notification is a contractual obligation under the OEM’s supplier quality manual, not a courtesy. Check your customer-specific requirements (CSRs) for the exact timeline.
CB verification audit. A major NC is closed by the CB on document review, but the CB will usually schedule a follow-up verification visit (often a half-day on-site) to confirm the action is in place. The cost of the visit is on the supplier.
Reduced audit cycle. After a major NC, the CB may move you from a 12-month surveillance cycle to a 6-month cycle, doubling your certification cost for the next certification period.
IATF database entry. A certificate suspension or withdrawal is published in the IATF Global Oversight database. Customers with supply-chain risk tools will see it.
Customer-specific consequences. Major German OEMs (VW, BMW, Daimler) treat a major NC as a supplier status downgrade in their internal systems. New business may be put on hold pending re-audit.

The IATF database is not a private list. A certificate withdrawal is publicly visible. Customers, competitors, and industry databases all read it. A withdrawal is not just a compliance event — it is a reputational event.

Prevention — What to Build So the Next Audit Is Cleaner

The cheapest major NC is the one that never gets raised. Three system-level changes that consistently reduce IATF 16949 audit findings.

#	System change	What it prevents	How to implement
1	Layered process audits (LPA)	Process does not match the control plan (item 7 in common findings)	Daily 5-minute audit by supervisor on a rotating set of questions; weekly summary by quality manager; trends visible on the shop floor
2	Living PFMEA / control plan	PFMEA and control plan out of sync, or RPN never updated (items 1, 2, 7)	Trigger PFMEA / control plan review on every ECN, every customer complaint, every process change; sign and date the review
3	Calibration-as-a-system	Expired or non-accredited calibration certs (item 3)	Centralized calibration database with alerts 30 days before expiry; ISO 17025 lab only; gauge list linked to control plan rows

Layered process audits (LPA) are the single highest-ROI investment. Most major NCs the IATF CB raises are not found for the first time at the CB audit — they are conditions the supplier’s own people would have seen if they had looked. A daily 5-minute LPA by the supervisor, with a rotating set of 10–20 questions per cell, surfaces the drift between the doc and the floor before the CB does. Toyota, VW, and Bosch all run LPAs as a standard practice; their suppliers that have copied the practice have measurably fewer IATF findings.

Standards & Sources

Primary standards
IATF 16949:2016 Automotive QMS standard, based on ISO 9001:2015 with automotive extras. Published by IATF (International Automotive Task Force).
ISO 9001:2015, Clause 10.2 Nonconformity and corrective action — the basis for the IATF 16949 corrective-action requirement.
ISO 17025:2017 General requirements for the competence of testing and calibration laboratories — referenced in IATF 7.1.5.2.

Supporting reading
AIAG, 8D Disciplinary Procedure, rev 2014 — the structured 8-step problem-solving method that aligns with IATF Clause 10.2.
AIAG-VDA, DFMEA / PFMEA Handbook, 1st edition 2019 — the FMEA reference for IATF 8.3.5.1.
AIAG, APQP, 3rd edition — the framework for control plan and PPAP.
IATF Global Oversight, Sanction Reports (quarterly, public) — the published list of suspended and withdrawn certificates, by reason.

Cross-references to other wiki pages
VDA 6.3 (process audit) — the process-level companion to IATF 16949; many suppliers are audited against both.
EN 10204 3.1 / 3.2 (material certificate) — a common IATF finding topic under Clause 8.5.2 (control of production).
PPAP submission — the automotive evidence package required by IATF Clause 8.6.2.

Frequently Asked Questions

What is the difference between a minor and a major IATF 16949 nonconformity?

A minor nonconformity is an isolated lapse that does not indicate a systemic breakdown — e.g. one missing signature on a single calibration record. A major nonconformity indicates a systemic breakdown, puts product conformity at significant risk, or is a failure of Clauses 7.5.3 (control of records) or 8.5.2 (control of production). The classification matters because a major triggers a 60-day closure deadline and can suspend your certificate if not closed in time.

How long do I have to respond to an IATF 16949 audit finding?

For a minor, the certification body (CB) typically allows 60–90 days from the audit closure date. For a major, the standard window is 60 days, and the clock is hard — if the closure package is not accepted by the CB within 60 days, the certificate is suspended and eventually withdrawn. Most suppliers give themselves a 5-day internal buffer and aim to submit on day 55, not day 60.

Do I have to notify my customers if I get a major nonconformity?

Almost always yes. Most automotive OEMs’ supplier-quality manuals require you to notify them within 24–72 hours of receiving a major NC. VW, BMW, Daimler, Ford, and GM all have explicit contractual clauses for this. Notification is a contractual obligation, not a courtesy. Check your customer-specific requirements (CSRs) for the exact window. Failure to notify is itself a separate IATF finding (Clause 8.7.1.4 — customer notification of nonconforming product).

Can I dispute a major nonconformity?

You can submit a formal objection in writing to the CB, with counter-evidence. The CB’s internal review process will consider it. Practically speaking, disputing a major NC on a technicality is rarely successful — the CB’s auditors are trained to document the evidence; if they wrote it up as major, the evidence usually supports it. A more productive use of time is to accept the NC, focus the 60-day response on a strong root cause and effectiveness check, and request a downgrade to minor in your closure submission if the evidence supports it.

What is the IATF database and why does it matter?

The IATF Global Oversight database (https://www.iatfglobaloversight.org/) is the public registry of all valid IATF 16949 certificates, plus a list of suspended and withdrawn certificates. When a certificate is suspended or withdrawn, the entry is published. Customers with supply-chain risk tools monitor this database. A suspension or withdrawal is not a private compliance event — it is visible to your customers, your competitors, and the broader market. Re-instatement requires a full re-audit, at your cost, on a shortened cycle.

What is the difference between an 8D and an IATF corrective action?

An 8D (8 Disciplines) is a structured problem-solving method, formalized by AIAG and Ford. It is the de-facto format for automotive corrective action. The IATF 16949 corrective action (Clause 10.2) is the requirement — the QMS must have a process to eliminate the cause of nonconformities. The 8D is the typical format used to satisfy the requirement, but the IATF itself does not mandate 8D — any structured method that includes containment, root cause, corrective action, and effectiveness check satisfies the clause. Other formats in use: A3, DMAIC, 5-Why + fishbone. The 8D is the most common at automotive suppliers.

Sources & Standards Referenced

IATF 16949:2016: Automotive QMS standard (based on ISO 9001:2015 with automotive extras) — the 60-day closure deadline for major nonconformities is established in the IATF Rules for Certification Bodies (Sanctioned Interpretation SI 4 for major NCs)
ISO 9001:2015, Clause 10.2: Nonconformity and corrective action — the basis for the IATF 16949 corrective-action requirement and the 7-step response process
ISO 17025:2017: General requirements for the competence of testing and calibration laboratories (referenced in IATF 7.1.5.2)
AIAG 8D Disciplinary Procedure, rev 2014: 8-step problem-solving method aligned with IATF Clause 10.2 (D1–D7 used in the 7-step response process)
AIAG-VDA DFMEA / PFMEA Handbook, 1st edition 2019: FMEA reference for IATF Clause 8.3.5.1 and the special-characteristic symbol
AIAG APQP 3rd edition: Advanced Product Quality Planning — framework for control plan and PPAP
IATF Global Oversight Sanction Reports (quarterly, public): published list of suspended and withdrawn certificates, with the 60-day major NC deadline as the trigger for suspension; published at https://www.iatfglobaloversight.org/
IATF Rules for Certification Bodies, 5th edition 2023: CB obligations including the 60-day major NC closure, follow-up verification audit, and IATF database notification

Need help closing an IATF 16949 audit action item?

We are an IATF 16949-certified CNC machining supplier. We can review your action-item response, run a 5-Why or fishbone root cause, build the effectiveness-check data set, and assemble the closure package for your certification body.

Request a Quote