# IATF 16949 Audit Actions: How to Respond and Close > Responding to IATF 16949 audit nonconformities: minor vs major classification, the 7-step NCR process, evidence requirements and 60-day timelines. https://www.sinbo-machining.com/wiki/quality/iatf16949-audit-action-items-response/ --- ## On This Page - What an IATF 16949 Audit Action Item Actually Is - Minor vs Major Nonconformity — How the CB Classifies - The 7-Step Response Process — from Finding to Closure - What the CB Wants to See — Evidence by Clause - Common Action Items — What the CB Raises Most Often - The Response Timeline — How the 60 Days Play Out - If the Action Item Is a Major — What Else Changes - Prevention — What to Build So the Next Audit Is Cleaner - Standards & Sources - Need help closing an IATF 16949 audit action item? # IATF 16949 Audit Action Items: A Supplier’s Playbook for Responding, Closing, and Avoiding the Next One When an IATF 16949 surveillance or re-certification audit closes with action items, the supplier has a fixed window to respond with a root-cause analysis, corrective action, and evidence of effectiveness. Most suppliers treat this as paperwork; the ones who treat it as a system-level fix close the action, keep the certification, and avoid the next finding. This page walks through the response process, the classification logic, and the evidence that satisfies the certification body. ## What an IATF 16949 Audit Action Item Actually Is IATF 16949:2016 is the automotive QMS standard, owned by the International Automotive Task Force (IATF) and accredited by ANSI (as American National Standard) and by ISO (as ISO 9001 with automotive extras). It replaced ISO/TS 16949:2009 in 2016 and is valid through 2027 with the next revision under preparation by the IATF. An audit action item (also called a finding, nonconformity (NC), or observation) is a written statement from the certification body (CB) auditor identifying a requirement of the standard that is not being met. The CB issues a finding after each audit; the supplier must respond before the CB closes the audit cycle. Three types of audit findings in IATF 16949:• Nonconformity (NC) — a requirement is not met. Minor if it is an isolated lapse, Major if it is systemic or puts product conformity at risk. Must be closed before certification is issued / maintained.• Observation — a condition that could become a nonconformity. Documented; usually requires a planned action but not a formal closure.• Opportunity for Improvement (OFI) — a suggestion, not a requirement. Documented; no formal response needed. The CB’s audit report will list each finding with the IATF clause reference, the evidence seen, and the requirement that was not met. The supplier’s response must address each one separately. ## Minor vs Major Nonconformity — How the CB Classifies The classification matters because it drives the response depth, the deadline, and the consequence. | Class | Definition (IATF wording) | Typical example | Response deadline | Consequence | Minor | A nonconformity that does not indicate a systemic breakdown of the QMS and does not put product conformity at significant risk | One calibration record missing a signature on a single gauge; one operator’s training record is 30 days past the due date | 60–90 days from audit closure (per CB) | Closure requires a documented response + evidence; on-time closure does not affect certification | Major | A nonconformity that indicates a systemic breakdown, OR a nonconformity that puts product conformity at significant risk, OR any Clause 7.5.3 / 8.5.2 (control of production) failure, OR any customer-complaint-related failure without containment | PFMEA exists but no RPN scored for any row; special characteristics called out on the drawing but not traced to the control plan; no documented 8D for a customer complaint filed 6 months ago | 60 days from audit closure (standard) | Certification is suspended until the major is closed; if not closed in 60 days, the suspension becomes a withdrawal The 60-day major NC clock is hard. Unlike a minor NC, where the CB is more flexible on the response time, a major NC must be closed within 60 calendar days from the audit’s official closure date. If the supplier does not respond in time, the CB withdraws the IATF 16949 certificate. The withdrawal is then published in the IATF database (https://www.iatfglobaloversight.org/) and every customer sees it. Re-instatement requires a full re-audit, at the supplier’s cost. ## The 7-Step Response Process — from Finding to Closure The IATF requires a structured response, not just “we’ll fix it.” The de-facto structure is the same as ISO 9001 Clause 10.2 and aligns with 8D; the IATF CB auditors expect to see all seven steps documented. | Step | Name | What you do | Evidence you collect | 1 | Containment | Stop the bleeding — quarantine suspect product, lock the gauge, halt the process, notify the customer if shipped product is affected | Quarantine record, customer notification (8D D2), recall list if applicable | 2 | Root cause analysis | Find out why, not just what. Use 5-Why, fishbone (Ishikawa), or fault tree. Avoid “operator error” and “training” as a root cause without supporting evidence | 5-Why worksheet, fishbone diagram, data analysis, supporting records | 3 | Corrective action plan | Define the action(s) that will eliminate the root cause and prevent recurrence. Include who, what, when | Action plan with owner, due date, and verification method | 4 | Implement corrective action | Execute the plan. Update documents, retrain, re-tool, re-spec, re-validate | Updated procedures, training records, validation reports | 5 | Effectiveness check | Prove the action worked — re-audit the specific process, re-measure, re-test, look for recurrence in the data | Re-audit report, re-measurement data, trend chart over 30–90 days post-implementation | 6 | Systemic review | Check if the same root cause exists in other cells, other products, other shifts. Fix everywhere, not just where the finding was raised | Cross-plant / cross-process audit report, list of additional actions taken | 7 | Closure documentation | Compile all evidence into a single response package for the CB; quality manager signs the closure request | Signed NC response form, all evidence attached, lessons-learned entry in the QMS Step 5 is what most suppliers get wrong. They fix the immediate issue, write up the action, and skip the effectiveness check. The CB then comes back at the next surveillance audit, finds the same problem, and raises a major. A real effectiveness check runs 30–90 days after implementation and looks for evidence that the issue has not recurred — trend data, re-audit results, customer feedback. Without it, the closure is not credible. ## What the CB Wants to See — Evidence by Clause The IATF clauses most often raised as action items, and the evidence the CB will ask for in your response. | IATF clause | Topic | Common finding | Evidence in your response | 4.4.1.2 / 7.5.3.2.1 | Control of production / records | Records are missing, illegible, or stored only on personal drives | Records index, retention policy, backup evidence, audit log of access | 6.1.2.1 | Risk analysis | Risk register exists but no actions defined for high risks | Updated risk register with treatment actions, owners, dates | 7.1.5.1 / 7.1.5.2 | Calibration / measurement traceability | Gauge in use but calibration cert expired or from a non-accredited lab | Updated calibration schedule, ISO 17025 certs for the lab | 7.2.4 / 7.3.3 | Communication / design input | Customer requirements not communicated to production; design changes not propagated | Communication log, ECN distribution list with sign-offs | 7.5.3.2.1 | Control plan | Control plan doesn’t cover special characteristics, or reaction plan column is blank | Revised control plan with special chars and reaction plan filled in | 8.3.3.3 / 8.3.5.1 | Design FMEA / Process FMEA | PFMEA has no RPN scored, or actions not closed out | Revised PFMEA with RPN, action status, sign-off | 8.5.1.1 | Control plan (production) | Process is not running to the control plan on the shop floor | Operator work-instruction update, training records, layer-process-audit results | 8.7.1.4 | Customer notification of nonconforming product | Customer not notified when nonconforming product was shipped | 8D D2 record, customer communication log | 9.1.1.1 / 9.1.3.1 | Analysis of data / management review | KPIs not trended, or management review is a rubber-stamp | Updated KPI dashboard, minutes of management review with actions | 10.2.1 | Nonconformity and corrective action | No documented 8D for known issues, or 8D open for > 60 days | Completed 8D per AIAG 8D Disciplinary Procedure (rev 2008 or 2014) ## Common Action Items — What the CB Raises Most Often From the IATF CB audit reports shared in supplier communities and from the IATF sanction reports published on the IATF Global Oversight website, the action items that show up in 70% of supplier audits are: | # | Action item | Typical clause | Why it keeps showing up | 1 | PFMEA does not cover all special characteristics, or RPN not scored | 8.3.5.1 / IATF SI 12 | PFMEA treated as a one-time template, not a living document | 2 | Control plan reaction plan column is blank or generic | 8.5.1.1 / APQP | Control plan copied from a template; reaction plan not thought through | 3 | Calibration cert from a non-accredited lab, or cert expired | 7.1.5.2 | Calibration treated as a checkbox; ISO 17025 requirement misunderstood | 4 | Customer complaints with no documented 8D, or 8D open > 60 days | 10.2.1 / 8.7.1.4 | No customer-complaint SOP, or complaint handling done in chat tools | 5 | Management review is a formality — minutes exist but no actions tracked to closure | 9.3 | Review held but not used as a management tool | 6 | Internal audit does not cover all IATF clauses, or auditor not competent | 9.2.2 | Internal audits scheduled to a calendar, not to risk; auditors not trained | 7 | Production process does not match the control plan (audit finds operator running differently from the doc) | 8.5.1.1 | Process change made on the floor but not propagated to the doc | 8 | Risk register exists but high-risk items have no treatment plan | 6.1.2.1 | Risk analysis done once, not maintained as a living document | 9 | Records stored on personal drives, not in the QMS, and not retrievable | 7.5.3 | No record retention policy, or policy not enforced | 10 | Customer-specific requirements (CSRs) not implemented at the process level | 8.3.3 / IATF SI 1 | CSRs received by sales / quality but not communicated to production Sanctions-correlated items. The IATF Global Oversight publishes quarterly sanction reports listing the most common reasons for certificate suspension and withdrawal. Items 1, 2, 4, and 7 in the table above are the most-cited in suspension decisions. Treat them as “must-pass” in your internal audit before the CB arrives. ## The Response Timeline — How the 60 Days Play Out For a major NC, the 60-day window is the difference between keeping and losing certification. The CB expects a specific workflow within that window. | Day | Milestone | Owner | Deliverable | 0 | Audit closes; CB issues the audit report with the major NC | CB lead auditor | Audit report, NC statement, evidence cited | 1–3 | Internal kick-off; quality manager convenes the response team; containment actions confirmed | Quality manager | Containment record, response team, plan | 3–10 | Root cause analysis (5-Why, fishbone, data review); interim update to CB if requested | Engineer + quality | Root cause analysis report | 10–20 | Corrective action defined; plan reviewed by process owner and quality manager | Process owner | Corrective action plan, with dates and owners | 20–40 | Corrective action implemented (doc update, training, gauge replacement, etc.) | Process owner | Updated documents, training records, validation evidence | 40–55 | Effectiveness check (re-measure, re-audit, trend data) | Quality manager | Effectiveness check report, trend data | 55–60 | Closure package compiled and submitted to CB | Quality manager | Signed NC response form, all evidence | 60+ | CB reviews the package; either accepts closure (NC closed) or rejects (escalation to withdrawal) | CB | Closure letter or escalation notice Day 40–55 is the risk window. The fix is in place; the trend data is too short to prove effectiveness. Two common failure modes: (a) the supplier submits the closure on day 60 with only 15 days of post-fix data, and the CB rejects on insufficient evidence of effectiveness; (b) the supplier runs into an unexpected obstacle (gauge on backorder, training rescheduled) and blows the day-60 deadline. The fix is to start the response on day 1, not day 14, and to give yourself a 5-day buffer before the deadline. ## If the Action Item Is a Major — What Else Changes A major NC triggers actions beyond the 60-day response window. Most suppliers don’t realize these are coming until the CB tells them. 1- Customer notification. Most automotive OEMs require you to notify them within 24–72 hours of receiving a major NC on your IATF certificate. The notification is a contractual obligation under the OEM’s supplier quality manual, not a courtesy. Check your customer-specific requirements (CSRs) for the exact timeline. 1- CB verification audit. A major NC is closed by the CB on document review, but the CB will usually schedule a follow-up verification visit (often a half-day on-site) to confirm the action is in place. The cost of the visit is on the supplier. 1- Reduced audit cycle. After a major NC, the CB may move you from a 12-month surveillance cycle to a 6-month cycle, doubling your certification cost for the next certification period. 1- IATF database entry. A certificate suspension or withdrawal is published in the IATF Global Oversight database. Customers with supply-chain risk tools will see it. 1- Customer-specific consequences. Major German OEMs (VW, BMW, Daimler) treat a major NC as a supplier status downgrade in their internal systems. New business may be put on hold pending re-audit. The IATF database is not a private list. A certificate withdrawal is publicly visible. Customers, competitors, and industry databases all read it. A withdrawal is not just a compliance event — it is a reputational event. ## Prevention — What to Build So the Next Audit Is Cleaner The cheapest major NC is the one that never gets raised. Three system-level changes that consistently reduce IATF 16949 audit findings. | # | System change | What it prevents | How to implement | 1 | Layered process audits (LPA) | Process does not match the control plan (item 7 in common findings) | Daily 5-minute audit by supervisor on a rotating set of questions; weekly summary by quality manager; trends visible on the shop floor | 2 | Living PFMEA / control plan | PFMEA and control plan out of sync, or RPN never updated (items 1, 2, 7) | Trigger PFMEA / control plan review on every ECN, every customer complaint, every process change; sign and date the review | 3 | Calibration-as-a-system | Expired or non-accredited calibration certs (item 3) | Centralized calibration database with alerts 30 days before expiry; ISO 17025 lab only; gauge list linked to control plan rows Layered process audits (LPA) are the single highest-ROI investment. Most major NCs the IATF CB raises are not found for the first time at the CB audit — they are conditions the supplier’s own people would have seen if they had looked. A daily 5-minute LPA by the supervisor, with a rotating set of 10–20 questions per cell, surfaces the drift between the doc and the floor before the CB does. Toyota, VW, and Bosch all run LPAs as a standard practice; their suppliers that have copied the practice have measurably fewer IATF findings. ## Standards & Sources Primary standardsIATF 16949:2016 Automotive QMS standard, based on ISO 9001:2015 with automotive extras. Published by IATF (International Automotive Task Force).ISO 9001:2015, Clause 10.2 Nonconformity and corrective action — the basis for the IATF 16949 corrective-action requirement.ISO 17025:2017 General requirements for the competence of testing and calibration laboratories — referenced in IATF 7.1.5.2. Supporting readingAIAG, 8D Disciplinary Procedure, rev 2014 — the structured 8-step problem-solving method that aligns with IATF Clause 10.2.AIAG-VDA, DFMEA / PFMEA Handbook, 1st edition 2019 — the FMEA reference for IATF 8.3.5.1.AIAG, APQP, 3rd edition — the framework for control plan and PPAP.IATF Global Oversight, Sanction Reports (quarterly, public) — the published list of suspended and withdrawn certificates, by reason. Cross-references to other wiki pagesVDA 6.3 (process audit) — the process-level companion to IATF 16949; many suppliers are audited against both.EN 10204 3.1 / 3.2 (material certificate) — a common IATF finding topic under Clause 8.5.2 (control of production).PPAP submission — the automotive evidence package required by IATF Clause 8.6.2. Frequently Asked Questions What is the difference between a minor and a major IATF 16949 nonconformity? A minor nonconformity is an isolated lapse that does not indicate a systemic breakdown — e.g. one missing signature on a single calibration record. A major nonconformity indicates a systemic breakdown, puts product conformity at significant risk, or is a failure of Clauses 7.5.3 (control of records) or 8.5.2 (control of production). The classification matters because a major triggers a 60-day closure deadline and can suspend your certificate if not closed in time. How long do I have to respond to an IATF 16949 audit finding? For a minor, the certification body (CB) typically allows 60–90 days from the audit closure date. For a major, the standard window is 60 days, and the clock is hard — if the closure package is not accepted by the CB within 60 days, the certificate is suspended and eventually withdrawn. Most suppliers give themselves a 5-day internal buffer and aim to submit on day 55, not day 60. Do I have to notify my customers if I get a major nonconformity? Almost always yes. Most automotive OEMs’ supplier-quality manuals require you to notify them within 24–72 hours of receiving a major NC. VW, BMW, Daimler, Ford, and GM all have explicit contractual clauses for this. Notification is a contractual obligation, not a courtesy. Check your customer-specific requirements (CSRs) for the exact window. Failure to notify is itself a separate IATF finding (Clause 8.7.1.4 — customer notification of nonconforming product). Can I dispute a major nonconformity? You can submit a formal objection in writing to the CB, with counter-evidence. The CB’s internal review process will consider it. Practically speaking, disputing a major NC on a technicality is rarely successful — the CB’s auditors are trained to document the evidence; if they wrote it up as major, the evidence usually supports it. A more productive use of time is to accept the NC, focus the 60-day response on a strong root cause and effectiveness check, and request a downgrade to minor in your closure submission if the evidence supports it. What is the IATF database and why does it matter? The IATF Global Oversight database (https://www.iatfglobaloversight.org/) is the public registry of all valid IATF 16949 certificates, plus a list of suspended and withdrawn certificates. When a certificate is suspended or withdrawn, the entry is published. Customers with supply-chain risk tools monitor this database. A suspension or withdrawal is not a private compliance event — it is visible to your customers, your competitors, and the broader market. Re-instatement requires a full re-audit, at your cost, on a shortened cycle. What is the difference between an 8D and an IATF corrective action? An 8D (8 Disciplines) is a structured problem-solving method, formalized by AIAG and Ford. It is the de-facto format for automotive corrective action. The IATF 16949 corrective action (Clause 10.2) is the requirement — the QMS must have a process to eliminate the cause of nonconformities. The 8D is the typical format used to satisfy the requirement, but the IATF itself does not mandate 8D — any structured method that includes containment, root cause, corrective action, and effectiveness check satisfies the clause. Other formats in use: A3, DMAIC, 5-Why + fishbone. The 8D is the most common at automotive suppliers. Sources & Standards Referenced 1- IATF 16949:2016: Automotive QMS standard (based on ISO 9001:2015 with automotive extras) — the 60-day closure deadline for major nonconformities is established in the IATF Rules for Certification Bodies (Sanctioned Interpretation SI 4 for major NCs) 1- ISO 9001:2015, Clause 10.2: Nonconformity and corrective action — the basis for the IATF 16949 corrective-action requirement and the 7-step response process 1- ISO 17025:2017: General requirements for the competence of testing and calibration laboratories (referenced in IATF 7.1.5.2) 1- AIAG 8D Disciplinary Procedure, rev 2014: 8-step problem-solving method aligned with IATF Clause 10.2 (D1–D7 used in the 7-step response process) 1- AIAG-VDA DFMEA / PFMEA Handbook, 1st edition 2019: FMEA reference for IATF Clause 8.3.5.1 and the special-characteristic symbol 1- AIAG APQP 3rd edition: Advanced Product Quality Planning — framework for control plan and PPAP 1- IATF Global Oversight Sanction Reports (quarterly, public): published list of suspended and withdrawn certificates, with the 60-day major NC deadline as the trigger for suspension; published at https://www.iatfglobaloversight.org/ 1- IATF Rules for Certification Bodies, 5th edition 2023: CB obligations including the 60-day major NC closure, follow-up verification audit, and IATF database notification ## Need help closing an IATF 16949 audit action item? We are an IATF 16949-certified CNC machining supplier. We can review your action-item response, run a 5-Why or fishbone root cause, build the effectiveness-check data set, and assemble the closure package for your certification body. [Request a Quote ](https://www.sinbo-machining.com/quote/)