FMEA Under IATF 16949: What Auditors Look For and How to Document Compliance

IATF 16949:2016 doesn't mention FMEA by name in its main clause text—but the automotive FMEA requirement is embedded in customer-specific requirements, the AIAG-VDA FMEA Handbook mandate, and IATF Sanctioned Interpretation R15. Auditors know where to look. Suppliers who treat FMEA as a PPAP checkbox document rather than an active risk management system get findings in three predictable places: linkage gaps between DFMEA and PFMEA, disconnects between PFMEA and the control plan, and open recommended actions with no closure evidence.

This covers the specific IATF 16949 FMEA obligations, what R15 requires regarding software, and how to structure FMEA documentation to pass a third-party audit.

Where the IATF 16949 FMEA Requirement Lives

The FMEA obligation appears in three places in the IATF 16949:2016 framework:

1. Clause 8.3.3.3 (Special Characteristics): Requires a documented process for cascading special characteristics from design through manufacturing. DFMEA is the primary source of Critical Characteristic (CC) and Significant Characteristic (SC) designations that flow into the PFMEA and control plan.
2. Clause 8.5.1.1 (Control Plan): Requires control plans traceable to the PFMEA. Auditors specifically check whether process steps in the control plan correspond to failure modes and controls in the PFMEA.
3. Customer-Specific Requirements (CSRs): Major OEMs—Ford Q1, GM BIQS, Stellantis, BMW Group, Volkswagen Group—reference the AIAG & VDA FMEA Handbook by name in their CSRs. For suppliers to these OEMs, the AIAG-VDA 2019 methodology is not optional.

IATF 16949:2016 mandates the use of APQP core tools, of which FMEA is one. The standard defers to the automotive core tool reference manuals (published by AIAG) for methodology detail.

What Sanctioned Interpretation R15 Requires

IATF SI R15 states that organizations shall use authorized software to develop FMEAs—not Excel. In practice, this means FMEA software that supports the AIAG-VDA methodology and produces audit-ready output. German OEM customers enforce R15 more aggressively than North American OEMs, but R15 applies uniformly under IATF 16949:2016 certification.

What "authorized software" means operationally:

• Supports AIAG-VDA Action Priority (H/M/L) in addition to or instead of RPN
• Maintains an audit trail of changes: who changed what, and when
• Links PFMEA rows to control plan entries, or exports in a format that makes the linkage traceable
• Supports FMEA version control so the current revision is identifiable

Excel satisfies none of these. Suppliers using Excel for FMEA development under an IATF 16949-certified QMS are technically non-compliant with R15. Many third-party certification bodies haven't enforced this consistently during surveillance audits, but OEM customer audits from German Tier 1 and OEM sourcing teams enforce it directly. R15 enforcement is one of the primary drivers for FMEA software adoption among mid-size automotive suppliers.

What Auditors Verify During an IATF Audit

A competent IATF 16949 auditor traces the quality evidence chain from a specific part through its DFMEA, PFMEA, and control plan. The standard sampling approach:

1. Start with a known quality escape or warranty return. Does the PFMEA contain this failure mode? If not, has the FMEA been updated since the escape? An FMEA that hasn't incorporated actual field failures is failing the living-document requirement.
2. Trace a CC/SC from DFMEA through the system. Pick a Critical Characteristic from the DFMEA. Is it in the PFMEA for the relevant operation? Is it in the control plan with an appropriate detection method? Is the characteristic being monitored via SPC or equivalent?
3. Verify recommended action closure. Select open recommended actions with past target dates. Is there a revised date? Is there evidence of completion—re-rating documentation, updated controls? Auditors specifically look for High AP rows where no action has been taken.
4. Check FMEA revision dates. If the part has had ECNs in the past 12 months, the FMEA should show corresponding revision dates. An FMEA with a revision date from initial PPAP that hasn't been updated since launch is a finding candidate.

Structuring FMEA Documentation for Audit Readiness

Audit-defensible FMEA documentation has four properties beyond methodology correctness:

• Version control with effective dates. Each FMEA revision should have a revision number, effective date, and summary of what changed. This is the minimum evidence that the document is maintained. Auditors look for it as the first proxy for whether the FMEA is a living document.
• Recommended action closure evidence. Completed actions need a completion date and description of what was done—not just a status field set to "complete." For AP High rows, include re-rated S/O/D and the resulting AP level as the evidence that risk was actually reduced.
• Control plan cross-references. PFMEA rows for special characteristics should reference the corresponding control plan operation and characteristic number. The PFD–PFMEA–Control Plan linkage covers how to structure these references consistently across the three documents.
• CC/SC designation flow. The DFMEA's CC/SC designations must appear in the PFMEA and control plan for the operations that produce those characteristics. Auditors trace this chain; gaps are nonconformances.

APQP Submission Requirements by Gate

For new model launches, OEM customers require FMEA submissions at specific APQP milestones. Common requirements across major automotive OEMs:

Missing High AP rows at PPAP submission without documented actions is a common customer quality concern escalation trigger. To verify AP levels against AIAG-VDA 2019 thresholds before a PPAP submission, the RPN and Action Priority calculator shows the AP lookup from S/O/D inputs using the published AIAG-VDA table.