A Supplier Audit Checklist That Starts With Corrective Action

A useful supplier audit checklist puts the effort where customer auditors actually write findings. For automotive work that means corrective action and problem solving first. Both clauses lead the IATF 16949 major nonconformance rankings in the IATF's 2024 data and in the IAOB analysis presented at the 2025 AIAG Quality Summit. Tidying binders comes later.

Supplier audit checklist: the short version

Start about eight weeks before an OEM or tier-1 audit and work through the clauses in the order auditors most often cite them:

• Close corrective actions, with data from effectiveness checks and updated documents (8 to 6 weeks out).

• Line up PFMEA, control plan, work instruction and gauge for every part number (6 to 5 weeks).

• Check calibration and MSA records, including how out-of-tolerance gauges were handled (5 to 4 weeks).

• Confirm document control and customer-specific requirements (4 to 3 weeks).

• Run a timed traceability drill both forward and backward (3 to 2 weeks).

• Do layered floor walk-throughs while the process is running (2 to 1 weeks).

What auditors write up most often

The data is consistent. In the IATF global data summarized by simpleQuE (shares of total volume as of November 25, 2024), these clauses produced the most findings:

In that dataset, total productive maintenance moved to the top of the minor findings, replacing contingency plans.

A second dataset agrees. An IAOB analysis presented at the 2025 AIAG Quality Summit used the NC-CARA database from 19 IAOB certification bodies. As simpleQuE reported, its top five clauses were problem solving (10.2.3), nonconformity and corrective action (10.2.1), manufacturing process design output (8.3.5.2), measurement systems analysis (7.1.5.1.1) and control plan (8.5.1.1). The only change from the IATF 2024 list is that MSA and control plan swap fourth and fifth place. The same five clauses lead both lists.

For aerospace suppliers: the most recent AS9100-family data available here is older. In the IAQG-OASIS Americas data for 2019 (the Americas sector holds about half of global AS91XX certifications), auditors wrote 17,184 nonconformances: 15,298 minor and 1,886 major. The top combined findings were control of production (8.5.1), nonconformity and corrective action (10.2.1, which drew the most majors), measurement traceability (7.5.3.2 document control also ranked, along with 7.1.5.2 traceability), information for external providers (8.4.3), control of externally provided processes (8.4.1.1), type and extent of supplier control (8.4.2), internal audit (9.2.2) and competence (7.2), according to simpleQuE. Treat those figures as 2019 context. The overlap with the IATF data still holds: corrective action, measurement and supplier control.

8 to 6 weeks out: close corrective actions properly

Most of the effort belongs here. The IAOB data shows where corrective-action findings come from. Sub-clause 10.2.1 d) accounted for 60.45% of clause 10.2.1 nonconformances. simpleQuE summarizes that sub-clause as weak monitoring and follow-up on whether corrective actions were effective. Sub-clause 10.2.3 f), reviewing and updating documented information, accounted for 40.83% of problem-solving nonconformances. Put simply, plants are getting written up for corrective actions that were never checked to see if they worked, and for fixes that never made it into the documents.

Pull every open corrective action report (CAR) and every one closed in the past audit cycle. For each one, check:

• Root-cause evidence. Look for the analysis itself, not only a box with a conclusion in it.

• Effectiveness check with data. The record should show what was measured after the fix, over what period, and the result. "Closed, no recurrence" without numbers will not hold up.

• Document updates. Was the PFMEA revised? Was the control plan? The work instruction? Lessons learned? Check that the revision dates come after the CAR.

• Honest status. If an action really is still open, document where it stands, the containment in place, and the planned verification date. Do not backdate a closure.

The IAOB presentation also named the root causes behind these findings: inadequate training, gaps in procedures and insufficient management oversight. If the same weakness shows up across several CARs, fix the procedure and the review cadence as well as the individual records.

6 to 5 weeks out: align control plans and PFMEAs

Process design output (8.3.5.2) and control plan (8.5.1.1) appear in the top five for both majors and minors in the 2024 IATF data. These findings usually come from a mismatch between documents and the floor. For each active part number, trace one chain: PFMEA failure mode, then the control-plan characteristic, then the work instruction, then the gauge actually in use at the station. Log every gap, such as a characteristic in the control plan with no instruction, a gauge on the floor that differs from the one specified, or a reaction plan the operator cannot find.

Include two more items from the minor-finding list in the same pass:

• Job set-up verification (8.5.1.3). Pull set-up records for a sample of recent changeovers and confirm they are complete and signed off.

• Contingency plans (6.1.2.3). The UT Center for Industrial Services advises testing contingency plans and reviewing them at least once a year. A plan that has never been exercised is a likely finding. UT CIS also recommends treating control plans as living documents and not something written once at launch.

5 to 4 weeks out: calibration and MSA

MSA (7.1.5.1.1) is a top-five major finding in both datasets, and IATF 16949 asks for more on calibration records than ISO 9001 does. According to a clause explainer by Pretesh Biswas (a paraphrase, not the standard's text), records under 7.1.5.2.1 cover:

• out-of-calibration readings and the risk assessment that follows

• an evaluation of whether earlier measurement results are still valid

• notifying the customer when suspect product has already shipped

• statements of conformity after calibration

• verification of software used for product and process control

• records for all gauging

"All gauging" covers more than most plants' calibration lists. A CalibrationOS explainer notes that employee-owned, customer-owned and supplier-owned gauges are included. Walk the floor and toolboxes and compare what you find against the master list. Then pick every out-of-tolerance event since the last audit and confirm the full reaction is on file. Finally, check that each gauge named in a control plan has a current MSA study.

4 to 3 weeks out: document control and customer-specific requirements

At the point of use, confirm the revision on the floor matches the controlled master. Remove obsolete copies, including laminated ones taped to machines. Check that approval trails are complete. Then turn to customer-specific requirements (4.3.2), which led UT CIS's list of top findings from IATF 16949 transition audits. Confirm that each customer's current requirements document is in the system, that someone owns it, and that its requirements show up in the affected procedures.

3 to 2 weeks out: run a traceability drill

Clause 8.5.2.1 requires documented traceability plans based on risk and failure severity. According to the Biswas explainer on that clause, the plans must let you identify and segregate nonconforming or suspect product, meet customer and regulatory response-time requirements, and keep records in a format (electronic, hardcopy or archive) that makes that response time achievable. They must also serialize where the customer or a regulation requires it and extend to externally provided products with safety or regulatory characteristics.

Test this with a timed drill:

• Forward: pick a supplier lot, ideally a part with safety or regulatory characteristics, and find every finished lot it went into and where each one shipped.

• Backward: pick a shipped finished lot and recover its input lots, process records, set-up verification, inspection results and the gauges used.

• Time it against the customer's required response time. If records sit in a format that slows retrieval, that is the finding to fix.

Also check how product status is shown on the floor. The explainer notes that inspection and test status should not be shown only by where product sits in the flow, unless that is inherently obvious.

2 to 1 weeks out: layered floor walk-throughs

Use the final two weeks for short, repeated audits on the floor, modeled on layered process audits. AIAG publishes the CQI-8 Layered Process Audits Guideline, now in its second edition. AIAG says LPAs run while the process is running, so they can catch nonconformances before the job is finished, which reduces rework, scrap and the need for inspection. In practice, supervisors, managers and plant leadership each check the same small set of controls on different shifts:

• TPM records. Total productive maintenance is now the top minor finding. Confirm that planned maintenance happened when scheduled and that the records show it.

• Part status marking at each station and in holding areas.

• Set-up verification done and recorded at the most recent changeover.

• Reaction plans. Ask operators what they do when a characteristic is out of spec, and check that the answer matches the control plan.

TPM gaps cost money on the line as well as in the audit. To size what weak maintenance discipline costs in unplanned downtime, use the free downtime cost calculator. It separates lost contribution from incremental recovery costs.

Audit week: show the record

Choose one escort for the auditor who knows the floor, plus a runner who can pull records quickly. Set up an evidence room with the CAR log, control plans, calibration master list and traceability drill results indexed so they can be found fast. When the auditor asks a question, answer with the record: hand over the effectiveness data and the revised PFMEA instead of explaining that the fix worked. Answer only what is asked. If something is missing, say so and write it down. A known gap with a dated plan holds up better than an improvised explanation.

What is changing

• IATF 16949: the IATF issued Sanctioned Interpretations #27 to 30 in November 2025, effective that month (IATF Global Oversight). Read them against your procedures before the next surveillance audit.

• ISO 9001:2026: published 16 September 2026, according to DNV and LRQA. DNV says ISO 9001:2015 certificates stop being valid after 30 September 2029. LRQA lists the main changes as requirements on quality culture and ethical behavior, risks separated from opportunities, stronger change management, core QMS terms added to the standard, and expanded guidance in Annex A.

• Medical devices: FDA's Quality Management System Regulation took effect February 2, 2026, and incorporates ISO 13485:2016 by reference (FDA). Tier-2 plants that supply device makers should expect customer audits to reflect it.

Related reading

• Does a Job Shop Entering Aerospace Need AS9100 or ISO 9001?

• How the Wolfspeed Pentagon loan could reshape a SiC supplier fresh out of Chapter 11

• The Hardest Manufacturing Jobs to Fill This Fall Are Hybrid Roles

• More Quality & Compliance coverage

Sources

• simpleQuE: IATF 16949 Top Nonconformances, Highlights from the 2025 AIAG Quality Summit

• simpleQuE: The Top 10 IATF 16949 Major and Minor Audit Nonconformances of 2024

• simpleQuE: AS9100 Standards Major and Minor Nonconformances for 2019

• UT Center for Industrial Services: Top Findings During IATF 16949:2016 Transition Audits

• Pretesh Biswas: IATF 16949:2016 Clause 7.1.5.2.1 Calibration/verification records

• CalibrationOS: IATF 16949 Calibration and MSA Requirements

• Pretesh Biswas: IATF 16949:2016 Clause 8.5.2.1 Identification and traceability

• AIAG: AIAG Simplifies Layered Process Audits

• IATF Global Oversight: IATF 16949:2016 Sanctioned Interpretations

• DNV: ISO 9001:2026 Standard Revision

• LRQA: ISO 9001:2026 is live, the transition period has begun

• FDA: Quality Management System Regulation (QMSR)