Following are general FAQs on IATF16949 sanctioned interpretations which is the Latest QMS Standard for the Automotive industry IATF16949. We are sure, this FAQ on Quality Management System is going to address most of your queries.
Kindly comment if we missed your question. So that, we can add them.
Without the co-licensing agreement between ISO and the IATF for the integrated format of IATF 16949, the IATF was not able to negotiate a discount for the ISO 9001:2015 standard. The IATF kept the price of the automotive-specific content consistent with prior pricing. Essentially, the difference is the full list price to ISO for their publication of ISO 9001.
The IATF uses a defined process for managing translations of the standard, including “cross-checking” the translation to ensure accuracy. If an organization, or a certification body, identifies what is believed to be a translation error, they should contact either the IATF member industry association or the Oversight Office supporting their certification body.
The IATF uses a defined process for managing translations of the standard, including “crosschecking” the translation to ensure accuracy. If an organization, or a certification body, identifies what is believed to be a translation error, they should contact either the IATF member industry association or the Oversight Office supporting their certification body.
This clause focuses on product and manufacturing process characteristics that affect the safety performance of the final assembly. These characteristics may not be directly addressed in regulatory/statutory requirements but may be defined by the customer.
Responsibilities are assigned to the role/position (i.e. specific title, Quality Director) within the organization. Although individuals may have those responsibilities in their roles, the responsibilities remain with the role (e.g. Quality Director). Therefore, top management will assign the responsibility and authority to the role, not to the individuals by name..
(Clause Reference 7.1.5.1.1 Measurement system analysis)
No. A complete statistical study on each single piece of equipment is not required. Instruments with the same characteristics (e.g. measurement range, resolution, repeatability, etc.) can be grouped and a sample instrument (representative of the gauge family) can be used for the statistical study.
(Clause eReference 7.1.5.3.2 External laboratory)
The inspection or test equipment manufacturer developed the methodology to maintain and adjust the equipment to meet calibration requirements as part of the design and manufacture of the inspection or test equipment. Therefore, the original equipment manufacturer of the inspectionand test equipment is ualified to calibrate the equipment they designed and manufactured. The organization shall obtain customer approval before using any original equipment anufacturer
for calibration services.
No. In-line measurement and test equipment used in any part of the manufacturing process or assembly process is not considered to be an internal laboratory.
(Clause Reference 7.5.1.1Quality management system documentation)
The organization is responsible for evaluating customer requirements, including customer-specific requirements, and including them in the scope of the organization’s quality management system, per IATF 16949, Section 4.3.2.
A document (which could be a table, a list or a matrix) is required as part of the quality manual, per IATF 16949, Section 7.5.1.1 d). The document shall include all direct customers of the certified organization, which may include IATF OEMs, non-IATF OEMs, and other automotive customers (i.e. tier-1, tier-2, etc.). For example, a tier-2 organization must consider the customer requirements, including customer-specific requirements, of all its customers. The Tier-2 organization does not need to consider the customer requirements of the automotive OEM if the OEM is not its direct customer. It is important to note that the non-IATF OEM customers and other automotive customers may have customer requirements in an internal document that is shared with their suppliers (e.g. such as a supplier quality manual) or in a specific document available to the public (e.g. internet).Identifying customer-specific requirements may be difficult if the non-IATF OEM or other automotive customers do not clearly link to IATF 16949 clauses in their customer requirement documents. A way to identify if any customer-specific requirements exist is to compare sections of the IATF 16949 standard where the term « if required by the customer » exists and verify if the existing customer requirement document lists any specific requirements that are related to a requirement in the IATF 16949 standard. If yes, that customer and their requirements should be added to the document (which could be a table, a list or a matrix) in the quality manual. Organizations are not expected to take the customer’s requirements, including customer specific requirements, and convert them into a CSR format that aligns with the IATF 16949 clauses similar to what has been published by the IATF OEMs.
(Clause Reference 8.4.2.2 Statutory and regulatory requirements and 8.6.5
Statutory and regulatory conformity)
As defined in 8.3.3.1 g) and 8.3.4.2, the organization is required to have an approach to research, identify, obtain copies of, review, understand, and assure compliance with the statutory and regulatory requirements for the product they are manufacturing in the country where they are manufacturing products and the destination country where they are shipping the products toThe intent of 8.4.2.2 is that the organization designs into their product development methodology/business process(es) and their supplier management methodologies’/business process(es), one or more approaches for obtaining confirmation and evidence from their suppliers that the products and services being provided by the supplier comply with the statutory and regulatory requirements of the country where the supplier is manufacturing them, the country where the organization is using them, and the country where the organization ships their product to, if provided by the customer. The intent of 8.6.5 is to require the organization to check the records of conformance/compliance received from the supplier to assure that the lot code, batch number, or comparable traceability information for the product are covered by the evidence provided by the supplier. This could be done
upon receipt from the supplier, or while the product is in inventory, but must be done prior to release of the product into the organization’s production flow..
(Clause Reference 8.4.2.2 Statutory and regulatory requirements (cont.) and
8.6.5 Statutory and regulatory conformity (cont.)
The intent of the clause did not change. The ISO/TS 16949 requirement was “All purchased product shall conform to applicable statutory and regulatory requirements”. In this “passive voice” wording, the IATF decided their expectations were not clear. The new requirement is more explicit about what
is to be done, when it is to be done, and what evidence is required to support compliance.
(8.4.2.2 Statutory and regulatory requirements (cont.) and 8.6.5 Statutory and
regulatory conformity (cont.) )
IATF 16949, section 8.6.5, does not require the organization to be aware of or keep a list of all the international statutory and regulatory requirements for the externally provided processes, products or services they purchase. The organization is required to review the results of, audit, or otherwise periodically verify, that the supplier’s process is robust and assures compliance with the latest applicable statutory, regulatory and other requirements in the countries where they are manufactured and in the customer-identified countries of designation.
(Clause Reference 8.4.2.2 Statutory and regulatory requirements (cont.) and
8.6.5 Statutory and regulatory conformity (cont.)
The clause as worded expects the customer to provide information to the organization of where the products are going to be shipped. Changes to the applicable statutory and regulatory requirements due to changes in these destinations are only a requirement to the organization “if provided” by the
customer.
( Clause Reference 8.7.1.7 Nonconforming product disposition )
The intent is to ensure that the product cannot find its way into the unofficial aftermarket, onto a road
vehicle, or accidentally shipped to the customer.
The process of rendering nonconforming product unusable, does not have to occur in the
manufacturing area as long as the product is rendered unusable prior to final disposal.
(Clause Reference 8.7.1.7 Nonconforming product disposition)
The organization is responsible to develop and implement a nonconforming product disposition process and verify its effectiveness.
(Clause Reference 8.7.1.7 Nonconforming product disposition )
Yes, it is acceptable to contract the process of rendering the product unusable to a service provider. If a service provider is used, the organization needs to approve, and periodically verify, how the supplier is rendering the product unusable.
(Clause Reference 8.7.1.7 Nonconforming product disposition)
This requirement applies to the product that has gone through the part approval process and that the organization is shipping to the customer.
(Clause Reference 8.7.1.7 Nonconforming product disposition)
The nonconforming product needs to be rendered unusable and unrepairable. There is no requirement for crushing or pulverizing the product into many pieces.
( Clause Reference Throughout the IATF 16949 Standard )
Yes, it is acceptable for an organization to group multiple documented processes into one (or more) processes. Each documented process does not have to be a standalone process. Organizations should document their processes as it makes sense to their individual business and organizational needs.
(Clause Reference 4.4.1.2 Product safety)
As with all personnel competency requirements, the people assigned to specific tasks need to be competent for that task. That competence needs to include the rules and regulations associated with the task.
The safety requirements in 4.4.1.2 are very specific as to what is required. The sections include, referring to IATF 16949 section 4.4.1.2:
a) suppliers are expected to be aware of all statutory and regulatory equirements associated with the markets for use of the parts, as identified by the customer. The supplier needs to know where to research the regulations for all affected countries or regions.
b) Customer specifics will identify any customer notification requirements; therefore, knowledge in customer specifics (which may be taught by an internal designated subject matter expert).
c) The special approvals for design FMEAs would be identified in customer specifics, see item b) above.
d) and e) The identification of product safety related characteristics and their controls would be defined by the customer in its definition of special characteristics and required controls. The personnel developing PFMEAs and Control Plans would need to be knowledgeable in those areas of their customer(s) documents. Each line item f) through m) can also be similarly analyzed to determine the level of training and source of that training for each requirement within the safety requirements.
Since many of the requirements depend upon customer specific requirements, there is no single complete industry training on this topic. The organization needs to review the customer and regulatory requirements associated with each of its parts appropriate for the intended country of use and safety-related part characteristics. Some customers may have specific requirements regarding product safety, training, knowledge, and personnel. It is the organization’s responsibility to understand their customer’s specific requirements related to product safety.
(Clause Reference 7.1.5.3.2 External laboratory)
Yes, only certificates of calibration or test reports including the mark of a national accreditation body are acceptable. The accreditation mark (often also called “accreditation logo” or “accreditation symbol”) of a national accreditation body provides documented evidence that the provided inspection, test, or calibration
services were performed according to the accreditation scope and that they comply with the requirements of ISO/IEC 17025, and are subject to supervision of a national accreditation body.
(Clause Reference 8.3.2.3 Development of products with embedded software)
The intent of IATF 16949, Section 8.3.2.3 is to apply the same level of rigor to the development of software as is expected in the development of hardware parts. Just like parts, software has defined performance, operating conditions, known inputs, specified outputs, parameters of environment (e.g. size of the file), regulatory requirements (if any), known failure modes, usage profiles, variability of conditions of operation, etc.
The planning, designing, writing, testing, confirming and production validation phases in the development of software are not very different in concept from the development of hardware parts. IATF 16949 provides a robust framework to validate that all necessary steps have been taken to design, verify, and produce hardware parts that continue to meet specification in mass production. While similar in concept, those steps are not the same for the development of software. Therefore, a different set of criteria are used to evaluate the methods used to develop software.
Those criteria are not included in IATF 16949; therefore, other methods are referred to, such as Automotive SPICE and CMMI. There may be other acceptable methods available identified by some customers. Each customer may have a preferred tool to assess supplier software development capability. The organization should ask their customer(s) to confirm the acceptable assessment tool. Each customer may also specify a different approach used (e.g., customer onsite assessment, supplier self-assessment, or a combination of both).
The role of the IATF 16949 internal or external auditor is not to have the knowledge to conduct the Automotive SPICE or CMMI assessments. However, the internal or external auditor should be familiar enough with the assessments to be able to recognize when a software assessment requirement has not been met and that there are corrective action plans in place, with the appropriate resources assigned. The IATF 16949 internal and external auditor should also know if
the customer participates in that software development assessment and how that is documented.
(Clause Reference 8.4.2.4.1Second-party audits)
The risk-based thinking approach, driven by ISO 9001:2015, needs to be incorporated for supplier management. The risk analysis needs to be completed and depending on the results of the risk assessment (see below), then a 2nd party audit may not be required. To support the risk analysis, the organization needs to consider criteria such as: supplier certification status, commodity complexity, new product launch(es), significant employee turn-over, product
quality issues, delivery issues, customer specific requirements, and other risks to the organization or to their customer(s).
( Clause Reference 8.5.6.1.1 Temporary change of process controls)
No, it is not a requirement to have an alternative process control for every primary control. When introducing new products, an organization should consider the risk of the primary control potentially failing and, based on risk and severity of failure mode, decide where alternative process controls are needed. When backup or alternate process controls are needed, then both the primary and alternative process controls should be defined in the process flow, PFMEA, control plan, and the standardized work available.
For existing processes, where there is a failure in the primary process control, and no alternative process control is defined, the organization should consider risk, (e.g. FMEA) and if approved, develop standardized work for alternative process control, implement the controls, verify effectiveness through daily management, and then revalidate when the primary control is restored.
Periodically, the organization shall review instances of where alternative process controls have been used and consider this as an input to update the process flow, FMEA, and control plan. (See SI 11)
(Clause Reference 9.2.2.3 Manufacturing process audit)
Each audit does not have to cover all shifts in one audit (for example an audit of the pressing process could be done on shift 1 and 2, sampling shift changeover in year 1, and then in year 2 or 3 an audit undertaken on the third shift for pressing). However, all manufacturing processes must be audited on all shifts over a three-year cycle, the frequency depending on risk, performance, changes etc.
(9.2.2.4 Product audit)
The audit frequency must be determined based on the risk and product complexity (See ISO 9001, Section 9.2.2). If an organization has high risk and high product complexity, it is recommended that product audit frequency be increased.
( Clause Reference 8.6.2 Layout inspection and functional testing)
Yes, as stated in Note 1 of 8.6.2 of IATF 16949, [Layout inspection is the complete measurement of all product dimensions shown on the design record(s)]; layout inspection is limited to dimensional measurement and requirements. Performance or materials measurements are not included in a layout
inspection.
Product requalification would normally imply full validation to all product approval requirements (e.g. PPAP or PPA) and therefore exceeds the scope of a layout inspection.
Functional testing/verification would normally be limited to performance and material measurements such as durability or tensile strength and would not include dimensional measurements.
Where frequency is not defined by the customer, the organization is responsible to define the frequency of layout inspection.
Layout inspection is a part of product requalification, if product requalification is required by the customer.
On-going layout inspection and functional testing requirements are defined in the control plan. If customer-specific requirements exist, then those requirements (including layout inspection and functional testing requirements) are also included in the control plan.
(Clause Reference 9.2.2.4 Product audit)
As defined in section 3 of IATF 16949, the term product is used to represent “…any intended output…” of the manufacturing process.
Products typically have dimensional, performance (functional) and material requirements, therefore, product audits may contain verification of dimensional, performance (functional), or material requirements. As stated in the FAQ 21 above, a layout inspection is limited to dimensional requirements.
Product audits can be carried out on finished or partially finished product, following customer specified approaches (e.g. VDA 6.5 Product Audit), if applicable. Product audits may include packaging and labelling requirements.
A product audit, like other audit types, is an independent verification of compliance to requirements. As such, the product audit has a defined frequency and scope specified within the audit programme and is based on risk.
(Clause Reference 8.5.1.3 Verification of job set-ups)
As stated in 8.5.1.3 d), first-off/last-off part validation is performed only when it is applicable and appropriate. Where the validation is not performed because it is not applicable or appropriate, there is no requirement to maintain records..
(Clause Reference 8.4.2.2 Statutory and regulatory requirements)
No, all organizations regardless of their responsibility for product design must satisfy the applicable requirements of 8.4.2.2. The applicable requirements address purchased products, processes, and services for which the organization is responsible..
(Clause Reference 8.4.2.2 Statutory and regulatory requirements
(cont.)
Yes, the organization is required to request a complete list of the countries of destination from the customer if the list was not provided by the customer.
NOTE:
o The “country of receipt” is where the organization is located.
(Country of the manufacturing site)
o The “country of shipment” is the customer’s receiving location.
(Country where the manufacturing site ships to)
o The “country of destination” is the country where the vehicle is sold.
(Country where the final product is initially sold
(8.4.2.2 Statutory and regulatory requirements (cont.)
ANSWER 3:
If the organization claims that the customer did not provide the necessary information on the countries of destination, the organization should be able to produce written evidence (e.g. letters, emails, meeting minutes, etc.) of their efforts to obtain it.
(Clause Reference 8.4.2.2 Statutory and regulatory requirements (cont.)
No, a generic statement such as “every country globally” is not acceptable. The customer is expected to provide to the organization a specific list of countries where the vehicle(s) are initially sold.
(Clause Reference 8.4.2.2 Statutory and regulatory requirements (cont.)
It is expected that the customer will provide to the organization information of the characteristics that are relevant for the identification of required controls to meet applicable statutory and regulatory requirements (e.g. special characteristics).
(Clause Reference 8.3 Design and Development of products and services)
If an organization receives from its customer a fully defined engineering specification for the parts it is making (make to print), the organization would not be product design responsible. Where the organization does not receive a fully defined engineering specification for the parts it is making, the organization is product design responsible. In all cases, the organization is responsible for manufacturing process design.
(Clause Reference 8.5.1.5 Total Productive Maintenance)
The intent of all the line items in section 8.5.1.5 is to include the minimum steps to maintain manufacturing equipment over a long period of usage so it can consistently produce products to specification.
“Periodic overhaul” is rework of manufacturing tooling and equipment needed when regular maintenance steps are no longer enough to keep the tooling and equipment in a condition where it can continue to make product to specification, as detected using Mean Time Between Repairs or other similar metrics.
Periodic overhaul is already defined in section 3 of the standard: “maintenance methodology to prevent a major unplanned breakdown where, based on fault or interruption history, a piece of equipment, or subsystem of the equipment, is proactively taken out of service and disassembled, repaired, parts replaced, reassembled, and then returned to service.”
Perhaps periodic overhaul is not applicable to some types of tooling and equipment. Perhaps some tooling is simply replaced with a new tool at the end of its useful life. However, all tooling and equipment does have a limited life based on usage, time or other known factors. The tooling and equipment manufacturer would be a good source to determine which factors and to estimate when
such major work needs to be completed. Periodic overhaul or its appropriate equivalent (e.g. replacement) would need to be accounted for in the steps of the organization’s maintenance plan.
(Clause Reference 8.5.1.5 Total Productive Maintenance)
The term “Total Productive Maintenance” (TPM) used in the IATF 16949 standard refers to various similar approaches that focus on proactive and preventive techniques for improving tooling and equipment reliability through the machines, equipment, processes and employees that add manufacturing value to an organization. For example, the industry approach for TPM places the
responsibility for routine maintenance, such as cleaning, lubricating and inspection in the hands of the operators.
Clause 8.5.1.5 of IATF 16949 has some requirements which align with some of the pillars of industry TPM. However, the individual requirements of 8.5.1.5 [a) through j)] are as stated in IATF 16949. The use of the term “Total Productive Maintenance” in IATF 16949 gives organizations an opportunity to adopt the underlying principles of industry Total Productive Maintenance while meeting the listed requirements of 8.5.1.5 in IATF 16949
(Clause Reference 9.2.2.3 Manufacturing process audit)
Effective assessment of each manufacturing process is vital to ensure continued manufacturing of product meeting customer, statutory and regulatory requirements. However, aligned with the risk approach of ISO 9001 and IATF 16949, some manufacturing processes or aspects of manufacturing processes may need a higher frequency of assessment than others.
The organization determines the audit frequency, if not defined by the customer, by using the appropriate risk management approach, including consideration of new technologies and customer measured performance. Manufacturing processes demonstrated to be low risk by the organization may be audited less frequently than high risk processes; however, all manufacturing processes
are audited within the 3-year audit cycle.
Evidence for risk analysis includes continued compliance with all relevant requirements, (for example: statutory and regulatory, customer, process, and internal requirements). If any one of the relevant requirements is not met, the manufacturing processes is audited at a higher frequency than every 3 years. The 3-year frequency as per clause 9.2.2.3 is a minimum requirement intended for
low risk and fully compliant manufacturing processes.
(Clause Reference 6.1.2.3 Contingency Plans )
A Cyber-attack is an attempt to gain illegal access to a computer or computer system for the purpose of causing damage or harm. A cyberattack is often deliberate exploitation of weaknesses in the security of computer systems or networks to gain access to data, alter computer code, logic or data.
These actions may have disruptive consequences that can compromise confidential data and lead to cybercrimes, such as information and identity theft, automation-caused operational interruptions, encryption of company critical data, or illegal remote controlling of systems or data.
Cyber-attacks and cybercrimes are not always a result of a sophisticated series of actions to guess passwords using powerful computer programs run by teams of people from remote locations. They are often actions designed to convince individual persons to release sensitive or private information through email notes (typically phishing), pretexting (impersonating a trusted person or government
official), phone calls announcing fake emergencies getting personal information, visual reading of typed passwords, infecting popular websites with malware, text messages with links to sites installing malware, USB drives left on desks, appearing to be legitimate, which are plugged into PCs, and theft of discarded materials containing confidential computer information, etc. Additionally, a
cyber-criminal, after gaining access to a company’s system, could encrypt the company’s critical data and demand a ransom to unencrypt the data.
Also, GDPR (General Data Protection Regulation) in Europe or similar requirements in other regions specify that organizations are responsible to ensure that personal data retained by the organization is protected and kept secure at all times, reinforcing the importance of being prepared in the case
of cyber-attacks.
Additional details regarding information technology security techniques is available through ISO/IEC 27001.
Source: IATF sanctioned interpretations (International Automotive Task Force)
Quality HUB India offered Online Courses on ‘Quality Management‘
Hindi Version
- Basics of Quality Management
- Awareness Program on Quality Management System (ISO9001+IATF16949)
- Certified Quality Manager
- Certified Quality Cost Expert (COQ Expert)
English Version
- Awareness Program on Quality Management System (ISO9001)
- Awareness Program on Quality Management System (ISO9001+IATF16949)
- Certified Internal Auditor on Quality Management System (ISO9001:2015)
- Certified Internal Auditor on Quality Management System (ISO9001+IATF16949)
Related Article
- What is the Cost of Quality? 04 Components of Cost of Quality
- कॉस्ट ऑफ़ क्वालिटी क्या है ? कॉस्ट ऑफ क्वालिटी के क्या कॉम्पोनेन्ट है ?
- What Is Industry 4.0? Why Industry 4.0 Is Important For The Industry?
- Lets Change Our Paradigm On Quality First
Please describe all sanstion interpretation.