THIS SIMPLEQUE INFOGRAPHIC ILLUSTRATES THE RECERTIFICATION CYCLE OF TWO SURVEILLANCE AUDITS FOLLOWED BY A RECERTIFICATION AUDIT EVERY THIRD YEAR BY A CERTIFICATION BODY.

Preparing for your organization’s IATF 16949® recertification 

The IATF 16949® standard operates on a three year certification cycle. While surveillance audits occur annually, the third year brings a Recertification Audit. This is a comprehensive evaluation of your entire Quality Management System (QMS) over the previous three years.

The focus of a certification body (CB) auditor will be organizational performance, both internally (Key Performance Indicators (KPIs)/measures/metrics) and externally (customer satisfaction and supplier control).  To ensure your organization is ready for recertification, consider these ten strategic questions.

The IATF 16949® Recertification Audit Readiness Checklist

1. Do metrics show continual improvement over the 3-year cycle?
   Auditors are not just looking for a snapshot of today. They want to see the trend lines for your Key Performance Indicators (KPIs). If your scrap rates or on time delivery metrics have not improved or have worsened without documented corrective action, it is a red flag.
2. Have you addressed recurring nonconformances?
   If a Certification Body (CB) issued a nonconformance in Year 1 and a similar issue appears in Year 3, it indicates that your corrective action process is ineffective. Auditors look for systemic failures where the root cause was never truly resolved.
3. Was a full system audit completed recently?
   A common mistake is auditing only problem areas. IATF® requires a full system audit, including a review of Customer Specific Requirements (CSRs) and Sanctioned Interpretations (SIs), during the cycle.
4. Are customer defined audits (CQI, MMOG/LE) current?
   Many OEMs require specific self assessments (like CQI 9 for heat treating or CQI 11 for plating). If these are expired or missing, it is an automatic finding against your adherence to CSRs.
5. Is PPAP validation and annual layout up to date?
   Check your customer contracts. Many require an annual layout or validation of parts. If you have not performed these as scheduled, your Product Realization process is at risk.
6. Has the contingency plan been tested annually?
   It is not enough to have a binder that says Contingency Plan. You must show evidence of a simulation or testing plan (for example, a tabletop exercise for a cyberattack or a trial run for a backup utility) within the last 12 months.
7. Are regulatory support requirements met?
   Do not forget the basics that support your operations. This includes forklift operator recertifications, crane inspections, and environmental permits that intersect with your manufacturing processes.
8. Do process owners truly own their data?
   During recertification, auditors will interview process owners directly. Can your managers explain the risks of their process, the key measures they track, and how they use that data to drive improvement?
9. Are Management Review output actions actually finished?
   Auditors will trace the Output section of your management review meetings. If your leadership team assigned three improvement tasks six months ago and none are closed, your leadership commitment (Clause 5) will be questioned.
10. Does your record retention match customer mandates?
    Automotive records often have much longer retention requirements than standard ISO 9001 (sometimes 15+ years). Does your team have evidence of effective implementation and the ability to retrieve old records quickly?

How is a Recertification Audit Different from a Surveillance Audit?

During a recertification audit, the auditor uses a biased audit approach. This means they use your own data, complaints, scrap trends, and previous findings, to establish audit trails. They are not just looking for compliance; they are looking at the maturity and stability of your QMS. Surveillance audits occur annually (in years 1 and 2 of the 3-year cycle).  Surveillance audits are conducted to ensure the QMS is being maintained and focuses on key processes, reviewing previous findings, and assessing corrective actions to ensure continuous improvement.

Certification Body Audit Focus

During a recertification audit, the auditor uses an automotive process approach that results in a “biased” audit. This means they use your own historical data (complaints, scrap trends, and previous findings) to establish audit trails. They are looking for trends over the 3-year cycle to determine if the site qualifies for recertification or if the certificate should be withdrawn.

Ideally, a company will have a mature, stable IATF 16949® QMS that is prepared for any type of audit at any time. The risks come with the fact that every 3 years, a company’s certificate is expiring. Should there be a significant quantity of nonconformances or major nonconformances during the CB recertification audit that take a long time to close, or can’t be closed before the certificate expires, a company could be at risk of losing their certification.

How simpleQuE Reduces Your Recertification Risk

“Many companies look to simpleQuE as an internal audit expert and outside set of eyes to scrutinize and assess the robustness of their quality management system. They find we can expedite the results to effectiveness and ensure they are on the right path,” shares Deanne Sparr, President of simpleQuE. “We are often asked by our clients to perform internal audits with our industry experts to help identify weaknesses in the QMS.  Some clients are even adding more internal audit time in preparation for the CB recertification audit.”

To address the top issues that trouble automotive suppliers, read our blog Top IATF 16949® Audit Findings and How to Address Them in the QMS. SimpleQuE’s IATF 16949® experts have also created a free video series, IATF 16949® Audits – The Good, Bad & Ugly, for automotive suppliers who struggle with audit nonconformities. The twelve videos address the problem areas and share best practices to utilize, and critical areas to avoid, from the perspective of a Certification Body auditor.  

Are you one of those companies with a mature QMS that isn’t worried about a recertification audit?  Or would your company benefit from an outside set of eyes to challenge and test your QMS with a thorough audit? Contact us if you need help preparing for recertification. Whether it’s training, consulting or internal audits, we are able to reduce your risks and give you confidence going into your recertification audit.

Knowledge. Expertise. Experience.

Schedule A Free Consultation

Outsource Your Internal Audits

SimpleQuE is not associated with the IATF®, IAOB, ANAB®, IAQG®, and is not a certification body. SimpleQuE is an independent consulting, training, and internal auditing service provider that assists a company on a path for the company to obtain and maintain certification through accredited certification bodies.