Quality managementReading time 12 min

When the auditor arrives, what can you actually produce?

Plenty of factories do the work and still cannot show evidence at audit time. The standard's logic is blunt: no record means it did not happen.

ISO

01Two terms people mix up

	Documented information, maintained	Documented information, retained
Commonly called	Documents	Records
Nature	States how the work should be done	Proves the work was done
Revised?	Yes, needs revision control	No, only added to
Examples	Procedures, work instructions, drawings	Inspection records, training sign-in sheets, audit reports

Since ISO 9001:2015 the quality manual and the six mandatory procedures are no longer required, but the record requirements got more explicit.

02Records ISO 9001 explicitly requires you to retain

Calibration and verification records for monitoring and measuring equipment (7.1.5.2)
Evidence of personnel competence (7.2)
Results of the review of product and service requirements (8.2.3.2)
Design and development inputs, controls, outputs and changes (8.3)
Evaluation, selection and performance monitoring of external providers (8.4.1)
Evidence of product release and the person authorizing it (8.6)
Disposition of nonconforming output, including concession records (8.7.2)
Monitoring and measurement results, internal audits, management review (9.x)
The nature and results of nonconformities and corrective actions (10.2.2)

03What IATF 16949 adds

Topic	Additional IATF requirement
Product safety	A documented process is required, covering special controls and authorization of personnel for safety parts
Control plan	Required for prototype, pre-launch and production, and consistent with the PFMEA and work instructions
MSA	All measurement systems require a measurement systems analysis (GRR and so on)
SPC	Special characteristics require capability studies and ongoing monitoring
PPAP	New and changed parts require submission and customer approval
Embedded software	A software development capability self-assessment is required
Record retention	Production part records are kept for the length of production plus one year, plus one calendar year
Plant layout	Must be evaluated for material flow, space utilization and synchronous flow
Layout inspection	Performed at the customer-specified frequency, with records retained

IATF is built around prevention, most of the added requirements sit in the preparation done before mass production begins.

The five core tools are IATF's backbone: APQP, FMEA, MSA, SPC and PPAP. They must be consistent with each other, an auditor will lay the PFMEA, the control plan and the work instruction side by side and compare.

04The most common audit findings

Finding	Root cause
Control plan and work instruction disagree	One got updated and the other did not
Gauge past its calibration date still in use	No mechanism reminds anyone the date is coming
Corrective action never verified for effectiveness	Someone wrote a countermeasure and closed the case
A change made without going through change control	Someone on the floor "just tweaked it"
Drawing revision on the floor differs from the system	No process for pulling back paper drawings
Training with no evaluation of effectiveness	Only a sign-in sheet exists
Supplier evaluations done for form's sake	Last year's copied over each year

In machining, "drawing revision mismatch" comes up at practically every audit.

05A practical approach

Do not build a second set of documents for the auditor. Take the forms people genuinely use and add the signature, date and revision.
Get revision control right on drawings first. It is the item that goes wrong most and costs the most.
Move records off paper. Paper's real problem is not storage, it is that nobody can find anything.
Consistency before completeness. Three documents that contradict each other is a far worse finding than one missing document.