# VDA 6.3 Process Audit Checklist: P1–P7 & Star Questions

> VDA 6.3 process audit checklist for CNC suppliers: P1–P7 process elements, star-question traps, turtle diagram, scoring. Based on a real German Tier-1 audit.

https://www.sinbo-machining.com/wiki/quality/vda63-process-audit-checklist/

---

## On This Page

- What VDA 6.3 Is — and What It Is Not
- The 7 Process Elements (P1–P7) and Where the Auditor Spends Time
- Scoring — 0 / 4 / 6 / 8 / 10 and Red / Yellow / Green
- Star Questions (Sonderfragen) — the Deal-Breakers
- The Turtle Diagram — How to Present P6
- Evidence Preparation — What Counts and What Doesn’t
- Common Failures — What Chinese CNC Suppliers Get Wrong
- Pre-Audit Self-Assessment Checklist (Printable)
- Standards & Sources
- Need help preparing for a VDA 6.3 audit?

# VDA 6.3 Process Audit: A Real CNC Supplier's Checklist from a German Tier-1 Audit
VDA 6.3 is the process-audit standard almost every German automotive OEM expects its Tier-1 and Tier-2 suppliers to pass. It is not a system audit (that is IATF 16949) and not a product audit (that is VDA 6.5). It is a structured, evidence-based review of how a specific process actually runs on the shop floor. This page distills what the auditor opens, asks, and scores, with a printable self-assessment checklist.
## What VDA 6.3 Is — and What It Is Not
VDA 6.3 is the process audit standard published by VDA QMC (Verband der Automobilindustrie Qualitäts Management Center). The current edition is VDA 6.3:2016 (3rd edition, sometimes referred to as “P1–P7”). It evaluates a specific process — e.g. your CNC turning cell, your heat-treatment outsourcing, your final inspection — against seven process elements (P1–P7), about 60 process steps, and a set of “star questions” (Sonderfragen) that are deal-breakers if you can’t answer them. Three audit types German automotive buyers use:• VDA 6.3 (process audit) — verifies a specific process actually runs the way your documents say it does. The auditor walks the floor, opens FMEAs, watches operators.• IATF 16949 (system audit) — verifies your quality management system exists and is maintained. Document-heavy, less floor-time.• VDA 6.5 (product audit) — verifies a finished product meets specification. Usually done at the customer’s incoming inspection or on a sample pulled from your shipping. The most common confusion we see at Chinese CNC suppliers: a company passes its IATF 16949 surveillance audit and assumes the German customer’s process audit will go smoothly. It often does not — because IATF looks at the system; VDA 6.3 looks at the one process the customer cares about. You can have a textbook QMS and still score red on a VDA 6.3 P6 production-process audit if your CNC cell does not actually run to the PFMEA on the wall.
## The 7 Process Elements (P1–P7) and Where the Auditor Spends Time
VDA 6.3 organizes every question into seven process elements. The auditor assigns a score per element and the worst-performing element drives the overall rating.
|  Element |  Focus |  What the auditor actually checks at a CNC shop |  Typical time spent
|  P1 — Potential Analysis |  Supplier selection, project acquisition |  Did you actually evaluate the risk before taking the order? Is there a documented project-acquisition gate? |  5–10%
|  P2 — Project Management |  Planning, resources, milestones |  Project plan with gates, roles, risk register, lessons-learned from similar parts |  10–15%
|  P3 — Product & Process Development Planning |  DFMEA, PFMEA, control plan, special characteristics |  PFMEA covers customer special characteristics (e.g. << or K), control plan matches PFMEA actions, Cpk target set |  10–15%
|  P4 — Product & Process Development Realization |  Prototype, sample, validation, PPAP |  Dimensional report, material cert (EN 10204 3.1), process capability evidence, MSA / Gauge R&R |  10–15%
|  P5 — Supplier Management |  Sub-supplier qualification, monitoring |  Approved-supplier list, sub-supplier audit reports, incoming-control of outsourced processes (e.g. heat treatment, plating) |  10–15%
|  P6 — Process Analysis / Production |  How the process actually runs on the floor |  Turtle diagram, work instructions, control plan adherence, operator training records, FAI, in-process inspection, reaction plan — this is where the auditor spends most of the time |  30–40%
|  P7 — Customer Satisfaction |  Field failures, complaints, service |  Complaint-handling log (8D on file), warranty PPM trend, lessons-learned fed back into FMEA |  5–10%
P6 is the audit. In a real two-day VDA 6.3 audit, the auditor will spend roughly 30–40% of the time on P6 — walking the cell, pulling routers, watching a setup, opening inspection records. If you over-prepare anywhere, over-prepare P6.
## Scoring — 0 / 4 / 6 / 8 / 10 and Red / Yellow / Green
Each of the ~60 process steps in VDA 6.3 is scored on a fixed 5-point scale. The score is per element, not per question.
|  Score |  Meaning |  Auditor’s reaction
|  0 |  Not implemented, or no evidence |  Immediate red flag
|  4 |  Partially implemented, major gaps |  Concerning — usually triggers an action item
|  6 |  Implemented with minor deviations |  Acceptable but documented as a finding
|  8 |  Fully implemented and effective |  Pass
|  10 |  Best practice, exceeds requirement |  Exceptional — used sparingly
The element score is the worst question score in that element. So a single “4” in P6 caps P6 at 4 even if every other P6 question is 10. The overall audit rating uses a traffic-light system:
|  Rating |  Element score |  What it means for business
|  Green (A) |  All elements ≥ 8 |  No restrictions. Audit pass.
|  Yellow (B) |  One or more elements = 6, none < 6 |  Conditional pass — documented action plan, re-check in 6–12 months
|  Red (C) |  Any element = 4 or 0 |  Conditional fail — new business on hold, existing business under review until re-audit
0KM concept: German OEMs apply the “0 km” rule — defects found at the customer’s incoming inspection or on the assembly line (before the car is even driven) are treated as 100% the supplier’s fault, regardless of who actually caused the failure. A VDA 6.3 yellow rating after a 0-km field action is effectively treated as red by procurement.
## Star Questions (Sonderfragen) — the Deal-Breakers
Star questions are a small set of “must answer” items scattered across the elements. A “no” or a vague answer on a star question usually forces the rating to yellow or red regardless of the rest of your scores. They exist because they correlate with the most common reasons automotive parts fail in the field.
|  Element |  Star question (paraphrased) |  What evidence the auditor wants to see
|  P3 |  Are customer special characteristics (<< / K) called out in your PFMEA, control plan, and work instructions? |  The exact symbol traced through PFMEA RPN, control plan row, and operator work-instruction header
|  P3 |  Do you have a process-capability target (Cpk / Ppk) defined for every special characteristic? |  Written target (typically Cpk ≥ 1.67 long-term, ≥ 1.33 short-term) on the control plan
|  P4 |  Is the initial sample (PPAP / VDA / ISIR) traceable to a real production run, not a hand-picked prototype? |  Sample-pull record showing the parts came from a documented production lot
|  P5 |  Are your sub-suppliers (especially heat treatment, plating, coating) qualified and monitored? |  Sub-supplier audit reports ≤ 12 months old, incoming-control records
|  P6 |  Does the operator have the current work instruction, control plan, and drawing at the machine? |  Physical check at the cell — the auditor will walk to a machine and ask
|  P6 |  Is the reaction plan (out-of-control action) defined for every special characteristic? |  Reaction plan column in the control plan filled in, not blank
|  P6 |  Is there a documented change-management process (engineering change, process change, sub-supplier change) that is actually followed? |  ECN log with sign-off, cross-reference to updated PFMEA / control plan revision
|  P7 |  Are field complaints handled with a documented problem-solving method (8D / A3) and fed back into the FMEA? |  Completed 8D with root cause, corrective action, and an updated PFMEA row
Field reality: In our ETO project (German Tier-1, 6 parts, 26 sub-parts), the auditor spent about 70% of the star-question time on P3 (special characteristics) and P6 (operator-level adherence). If your PFMEA doesn’t trace << to the operator card, nothing else saves the rating.
## The Turtle Diagram — How to Present P6
The turtle diagram is the most common way to present a single process to a VDA 6.3 auditor. It has six legs plus the process name in the head. The auditor will probably ask you to draw it on a whiteboard during the audit — if you can’t, it signals you don’t really own the process. 🐢 Process name Head of the turtle (the process being audited) → Inputs Material, drawings, programs, fixtures, customer spec ⚙ Controls / Methods Work instruction, control plan, PFMEA, setup sheet 👥 People / Competence Training records, certifications, language coverage 🔧 Resources / Equipment Machine list, calibration, maintenance plan, capacity 📊 Performance / KPIs Cpk, PPM, OEE, scrap, first-pass yield, reaction-plan triggers → Outputs Conforming parts, FAI, traceability, certs, packaging For a CNC turning cell producing a solenoid valve body, a filled turtle diagram looks like:
|  Leg |  Filled-in content (example)
|  Inputs |  Bar stock 1.4301 (304) per EN 10088-2, drawing rev. D, customer spec CSR-2024-017, CNC program OP10.001
|  Controls |  WI-CNC-OP10 rev. 7, Control Plan CP-2024-17 row 5 (special char Ø8 H7), PFMEA PF-2024-17 RPN 42
|  People |  3 operators certified per WI-CNC-OP10; language: Chinese, English for audit support
|  Resources |  Citizen Cincom L20, calibrated 2026-04; Okuma LB3000 EX; tool presetter; climate-controlled inspection room
|  Performance |  Cpk 1.85 (Ø8 H7), 0 PPM past 18 months, OEE 82%, FPY 99.4%
|  Outputs |  Conforming parts with FAI per AS9102, material cert EN 10204 3.1, packed per customer packaging spec

## Evidence Preparation — What Counts and What Doesn’t
Each star question needs a piece of evidence the auditor can touch, open, or read. Generic claims (“we train everyone”) score 4 at best. Specific, dated, signed evidence scores 8.
|  Evidence type |  Counts as evidence |  Does NOT count
|  PFMEA |  Excel/PDF, dated, signed, RPN scored, special characteristics marked, action status updated |  PFMEA template filled in once and never reviewed; RPN cells blank
|  Control plan |  Current rev, matches PFMEA, reaction plan filled in for every special char, signed |  Control plan with the reaction-plan column blank; revision older than the latest engineering change
|  Work instruction |  Laminated at the machine, current rev, in operator’s language, dated, with photo of correct setup |  Work instruction only on the server; rev on server newer than the copy at the machine
|  Training record |  Per WI, with date, trainer signature, operator signature, competence test pass |  Sign-in sheet with no link to which WI was trained; no test
|  Calibration |  Calibration cert from accredited lab (ISO 17025), in date, covers the gauge you actually use |  In-house calibration with no traceability; cert expired last month
|  Material cert |  EN 10204 3.1 with heat number, batch number, chemistry, mechanical properties, signed by the mill’s authorized inspector |  EN 10204 2.1 (compliance only, no test results); mill cert without heat number
|  Sub-supplier audit |  Documented audit (VDA 6.3 or equivalent), ≤ 12 months old, with action-item closure |  Initial supplier qualification only; no recurring audit
|  8D report |  D1–D7 all filled, root cause validated, corrective action implemented, PFMEA updated, customer accepted |  Open 8D with D4 root cause still “to be determined” after 60 days
Signatures and dates matter more than formatting. A neatly formatted but unsigned control plan scores 4. A handwritten but signed-and-dated reaction-plan card scores 8. The auditor reads paper, not templates.
## Common Failures — What Chinese CNC Suppliers Get Wrong
From our own audit history and what peers in the same Tier-1 supplier network report, these are the failures that show up again and again. Each is a score-4 item in the real audit.
|  # |  Failure |  Why it happens |  Fix
|  1 |  PFMEA has no special-characteristic symbol (<< / K) traced to the control plan |  Engineering translates the drawing but doesn’t mark the symbol in the PFMEA template |  Add a “Special Char” column to the PFMEA and force the symbol to be filled in for every row
|  2 |  Reaction-plan column is blank in the control plan |  Team treated the control plan as a copy-paste exercise |  Reaction plan is a separate SOP, but the control plan must list the trigger and the action for every special char
|  3 |  Work-instruction revision at the machine is older than the revision on the server |  No controlled-distribution system for paper documents |  Implement a one-document-one-rev system; old revs collected and shredded on new-rev issue
|  4 |  Sub-supplier (heat treat / plating) never audited |  Initial qualification done, no recurrence |  Annual sub-supplier audit, VDA 6.3 or equivalent, with documented action closure
|  5 |  Cpk study done once on the PPAP sample, never repeated on production |  Team treats Cpk as a one-off, not a continuous KPI |  Calculate Cpk from the last 30 production lots; trend it; trigger action if Cpk < 1.33
|  6 |  No 8D — complaints handled in WeChat groups |  No formal complaint-handling SOP |  Customer-complaint SOP with mandatory 8D, 24-hour D2 containment deadline
|  7 |  Process change (new bar supplier, new tooling) made without ECN |  No change-management discipline |  ECN triggered by any of: material source, machine, tooling, parameter window, sub-supplier
|  8 |  Process description too vague (e.g. “finish to drawing”) on the router |  Engineers treat the router as a placeholder |  Router must list the operation, the machine, the work instruction rev, the inspection step, the control plan row

## Pre-Audit Self-Assessment Checklist (Printable)
Print this page and walk it through your own shop with your quality manager, your production manager, and your engineering manager in the room. Be honest. If you can’t answer “yes” to a row, that’s a 4 in the real audit, not a 6.
|  # |  Element |  Question (paraphrased) |  Y / N |  Evidence on file
|  1 |  P1 |  Do you have a documented supplier-selection / project-acquisition gate that you actually use? |  |
|  2 |  P2 |  Is there a written project plan with gates, roles, milestones, risk register? |  |
|  3 |  P3 |  Are all customer special characteristics called out in the PFMEA, control plan, and work instruction? |  |
|  4 |  P3 |  Does every special characteristic have a Cpk / Ppk target written in the control plan? |  |
|  5 |  P4 |  Is the PPAP / VDA / ISIR sample traceable to a documented production lot? |  |
|  6 |  P5 |  Do you have an approved-supplier list with sub-supplier audit dates within 12 months? |  |
|  7 |  P5 |  Do you inspect incoming material from sub-suppliers (especially heat treat / plating)? |  |
|  8 |  P6 |  Can the operator at the machine show the current work instruction, control plan, and drawing? |  |
|  9 |  P6 |  Is the reaction plan filled in for every special characteristic in the control plan? |  |
|  10 |  P6 |  Is there a documented change-management process and an ECN log? |  |
|  11 |  P6 |  Are inspection gauges calibrated by an ISO 17025 lab, in date, and listed? |  |
|  12 |  P6 |  Are operator training records per work instruction, with a competence test, dated and signed? |  |
|  13 |  P6 |  Is Cpk calculated continuously (not just on PPAP) and trended? |  |
|  14 |  P7 |  Are customer complaints logged, with 8D reports, and are they fed back into the PFMEA? |  |
|  15 |  P7 |  Are PPM / scrap / first-pass-yield KPIs visible on the shop floor and trended monthly? |  |
Scoring your self-assessment: • 13–15 yes → Expect a green audit. • 9–12 yes → Expect a yellow audit; fix the gaps before the auditor arrives. • < 9 yes → Expect a red rating; postpone the audit or accept the consequence.
## Standards & Sources
Primary standardVDA 6.3:2016 (3rd edition) VDA QMC — Process Audit. Defines the seven process elements (P1–P7), the question catalogue, the scoring scale (0/4/6/8/10), and the red/yellow/green rating. Available from VDA QMC Webshop. Related standardsIATF 16949:2016 Automotive QMS standard; Clause 9.2.2.4 covers process audits; defines the system behind VDA 6.3.VDA 6.5:2020 Product audit; companion to VDA 6.3.AIAG PPAP 4th ed. Defines the 18 PPAP elements referenced in P4.AIAG VDA DFMEA 1st ed. (2019) Joint AIAG-VDA DFMEA / PFMEA reference manual.AIAG CQI-23 Soldering process assessment (mentioned for comparison — another process-audit style standard). Supporting readingAIAG & VDA QMC, DFMEA / PFMEA Handbook, 1st edition 2019 — the standard reference for PFMEA structure referenced in P3.AIAG, PPAP, 4th edition — covers the 18 elements referenced in P4.DGQ / VDA QMC, VDA 6.3 Process Auditor Training Manual — the official auditor course material. Frequently Asked Questions What is the difference between a VDA 6.3 audit and an IATF 16949 audit? IATF 16949 audits the QMS — does your system exist, is it documented, is it maintained across all clauses. VDA 6.3 audits a specific process — does this one process actually run the way your documents say it does. You can be IATF-certified and still score red on a VDA 6.3 P6 production-process audit if your CNC cell doesn’t follow the PFMEA. VDA 6.3 is what the German customer’s SQE runs; IATF is the certification your registrar (e.g. TÜV, DQS) runs. How long does a VDA 6.3 process audit take for a CNC machining supplier? Typically 1.5–2.5 days on-site for a single process at a single site, depending on part complexity and number of special characteristics. P2–P4 (project / development) often run in the office for half a day. P6 (production) takes 1–1.5 days because the auditor walks the cell, opens routers, watches a setup. Add half a day for P5 (sub-supplier review) if you outsource heat treatment, plating, or coating. What are the most common star-question failures at CNC shops? From the audits we’ve seen and the peers we work with, the top three are: (1) PFMEA doesn’t trace the customer’s special-characteristic symbol (<< or K) into the control plan and the operator’s work instruction, (2) reaction-plan column is blank in the control plan, and (3) the work-instruction revision at the machine is older than the revision on the server. Each of these is a yellow at best, and if the gap is severe, a red. Can we fail a VDA 6.3 audit and still keep the customer? Sometimes, but the color matters. A yellow (B) rating is a conditional pass — you submit an action plan, the customer re-checks in 6–12 months, and existing business continues. A red (C) rating usually means new business is on hold and existing business is under review. The hidden risk: a yellow rating after a 0-km field action is effectively treated as red by German procurement. How much does it cost to prepare for a VDA 6.3 audit? Direct costs (formal training, mock-audit consultant) are typically €3,000–€10,000 for a small CNC shop. Indirect costs (closing the gaps the mock audit finds) vary wildly — from a few engineer-weeks for documentation fixes to six figures if you need a new CMM, new gauge calibration, or new sub-supplier qualification. Compared to the cost of a red rating (lost orders, 8D cost, switching cost), preparation is almost always cheaper than non-preparation. Do we need a certified VDA 6.3 auditor on our own team? Not legally, but yes in practice. At a minimum, you need at least one person who has attended the official VDA 6.3 process auditor course (3–5 days, offered by VDA QMC licensed training providers) and can run an internal mock audit. Without that, you will not see the gaps in your own PFMEA, control plan, and turtle diagram before the customer’s SQE walks in. Sources & Standards Referenced 1- VDA 6.3:2016 (3rd edition, P1–P7): VDA QMC Process Audit, including the seven process elements (P1 Potential Analysis, P2 Project Management, P3 Product & Process Development Planning, P4 Product & Process Development Realization, P5 Supplier Management, P6 Process Analysis/Production, P7 Customer Satisfaction), the 0/4/6/8/10 scoring scale, the red/yellow/green rating, and the turtle-diagram representation of a process for P6
1- IATF 16949:2016, Clause 9.2.2.4: Automotive QMS requirement for process audits (the system behind VDA 6.3)
1- VDA 6.5:2020: VDA QMC Product Audit (companion to VDA 6.3)
1- AIAG PPAP 4th edition: Production Part Approval Process, 18 elements, 5 submission levels (referenced in VDA 6.3 P4)
1- AIAG-VDA DFMEA / PFMEA Handbook, 1st edition 2019: Joint AIAG-VDA reference for PFMEA structure and special-characteristic symbol (referenced in VDA 6.3 P3)
1- DGQ / VDA QMC: VDA 6.3 Process Auditor Training Manual, including turtle-diagram methodology and star-question list (Sonderfragen)
1- AIAG 8D Disciplinary Procedure, rev 2014: 8-step problem-solving method referenced in VDA 6.3 P7 (customer satisfaction / complaint handling)
1- EN 10204:2004 / EN 10204:2017: Metallic products — Types of inspection documents 3.1 / 3.2 (referenced in VDA 6.3 P4 material evidence)
1- AIAG CQI-23: Soldering Process Assessment (referenced for comparison — another process-audit style standard)

## Need help preparing for a VDA 6.3 audit?
We are a CNC machining supplier that has passed a German Tier-1 automotive VDA 6.3 process audit. We can review your PFMEA, control plan, and turtle diagram against the P1–P7 checklist before the auditor arrives. [Request a Quote ](https://www.sinbo-machining.com/quote/)