Quality Management Audit – ISO 9001 and IATF 16949

A quality management audit answers a fundamental question: does the system really protect the customer, the process and company performance, or does it merely look good in the documentation? We check compliance and, above all, effectiveness: decision-making, risk management, process stability and the organisation’s ability to prevent errors.

Quality management audit: ISO 9001 and IATF 16949 in practice

LeanTrix and QualiTeam experts conduct audits against the applicable requirements of ISO 9001 and, in automotive, IATF 16949, current Sanctioned Interpretations and FAQs and customer-specific requirements (CSR). We build the audit programme in line with ISO 19011:2026 guidelines, using a process approach, risk, auditor competence and objective evidence.

ISO 9001 provides a universal quality management foundation: customer focus, leadership, the process approach, evidence-based decisions and continual improvement. IATF 16949 extends this for automotive with requirements covering product safety, special characteristics, Core Tools, suppliers, contingency plans, complaints and OEM requirements, among other areas. We tailor the scope to the industry, product, location and audit objective.

What do we check during an audit?

System, process and product: whether the three levels form one functioning mechanism.
Leadership and quality objectives: their links with KPIs, management review and process owner accountability.
Voice of the customer: contractual requirements and CSR, satisfaction, complaints, PPM, returns and warranties.
Risk: product safety, special characteristics, traceability, changes and contingency plans.
Core Tools consistency: the chain APQP → PFMEA → Control Plan → work instruction → MSA/SPC → PPAP.
The process in the gemba: alignment of actual shift practices with agreed standards and records.
Suppliers and outsourced processes: qualification, development, quality performance and risk response.
Nonconformities and corrective actions: root cause analysis quality, 8D/A3, non-recurrence and evidence of effectiveness.
The internal audit programme: scope, risk-based frequency, independence and auditor competence.

Depending on needs, we extend the quality management audit with a VDA 6.3 process audit, VDA 6.5 product audit, AIAG CQI special process assessments, a supplier audit or a rehearsal Audit 0 before certification.

What does the organisation receive?

The report goes beyond a list of comments. Each finding is linked to a requirement, objective evidence and business risk. The organisation receives a maturity map, priorities, quick wins, systemic actions, owners, deadlines and effectiveness measures. The quality management audit therefore begins improvement rather than ending as a one-off inspection.

Explore our support for ISO, IATF and VDA certification and implementation (in Polish) and Lean Six Sigma.

Our role: from independent diagnosis to Audit 0

We combine LeanTrix’s operational excellence experience with QualiTeam’s management system expertise. The expert team includes Dr Marcin Paska, a quality management systems expert and practising ISO 9001, IATF 16949 and VDA 6.3 QMC auditor. We consider standard requirements, actual process performance and the effect of quality on organisational results together.

We audit collaboratively while retaining independence. We speak with senior management, process owners, quality, maintenance, logistics and operators. We work where quality is created: in the gemba, with products, data and decisions. We prepare the organisation for an independent certification audit through support extending beyond document review.

We define the audit objective, criteria and boundaries, including current ISO, IATF, SI/FAQ and CSR requirements.
We map processes, risks and audit trails from customer order to product and quality record.
We select samples based on risk, performance, changes, complaints and previous findings.
We verify evidence through documents, interviews, gemba observation and data rather than declarations.
We check connections between PFMEA, the Control Plan, work instructions, MSA, SPC, PPAP and change management.
We organise nonconformities, observations and improvement opportunities by risk and customer impact.
We facilitate root cause workshops and support 8D/A3 actions.
We help define owners, deadlines, KPIs and escalation rules.
We develop internal auditors’ and process owners’ competence.
We conduct follow-up audits and Audit 0 to confirm effectiveness and certification readiness.

Every quality management audit ends with a joint management review: what to contain immediately, what to improve systemically and how to sustain the effect in the next PDCA cycle. Where needed, we connect actions with TWI, standardised work and leadership development, because a strong quality system works through people.

audit levels: system, process and product

Core Tools families covered by verification

action plan with owners and effectiveness verification

We provide support based on the Kata process, which allows us to adapt our activities to the specifics of your organization, taking into account the jointly set goals. The Kata process consists of four key elements that enable effective implementation of assumptions.

Determining the course of action

Designing a concept that responds to the organization's goals and challenges.

Determining the current state

Learning about the current situation and collecting input data to define the next step.

Determining the target state

Determining the desired and measurable end result and a plan for its implementation.

Experiments - consultations

Implementation of activities in accordance with the established cooperation model, based on PDCA cycles.

P

PLAN

We define the objective: gap assessment, internal audit, supplier audit, pre-certification audit or Audit 0.
We establish the criteria: current ISO 9001, IATF 16949, SI/FAQ, CSR and, optionally, VDA and AIAG CQI.
We define locations, products, processes, work shifts and outsourced processes.
We map processes and owners and analyse previous audits, complaints, warranty claims and changes.
We establish baseline KPIs: PPM, FPY, scrap, rework, COPQ, delivery performance and supplier results.
We prioritise risks: product safety, special characteristics, new launches and quality bottlenecks.
We select a competent, independent audit team in accordance with ISO 19011:2026.
We prepare the sampling plan, audit trails, agenda, interviewees and required evidence.

D

DO

We begin with an opening meeting to confirm the objective, criteria and communication rules.
We audit by process, following customer requirements through to process outcomes rather than only checking clauses individually.
We observe work in the gemba on representative shifts and trace a selected product or order.
We combine four sources of evidence: documents, interviews, observations and data.
We verify leadership, quality objectives, management review, responsibilities and quality culture.
We check the Core Tools chain: APQP, PFMEA, Control Plan, instructions, MSA/SPC and PPAP.
We examine product safety, traceability, measurement control, changes and contingency plans.
We assess suppliers, customer complaints, warranty claims, nonconformities and 8D/A3 actions.
We record objective evidence and discuss key findings at the closing meeting.

C

CHECK

We substantiate every finding against a specific criterion and objective evidence.
We classify nonconformities, observations and improvement opportunities according to the agreed method and risk.
We check whether an issue is isolated or systemic across other products, shifts or plants.
We compare results with KPIs, customer requirements, CSR and quality objectives.
We assess internal audit coverage of processes, auditors’ competence and independence.
We verify root cause analysis quality, the suitability of 8D/A3 and evidence of non-recurrence.
We develop a maturity and risk map covering system, process, product and certification readiness.
We present the report to management and jointly approve priorities, quick wins and systemic actions.

A

ACT

We introduce immediate containment where customers, products or safety are at risk.
We assign actions to owners, deadlines, resources, KPIs and a clear escalation route.
We eliminate root causes using 8D, A3, 5 Why or Ishikawa, depending on the problem.
We update PFMEA, the Control Plan, instructions, PPAP, change management and organisational knowledge.
We train employees and confirm competence in practice, beyond a signature on an attendance sheet.
We conduct a follow-up audit to assess implementation and the actual effectiveness of actions.
We standardise quick wins and good practices and transfer them to similar processes and locations.
We initiate supplier development where the source of risk lies in the supply chain.
We conduct Audit 0 before the independent certification audit.
We build the next risk-based audit programme and begin another PDCA cycle.

(…) Mr. Kamil Müller led each workshop in a very interesting and engaging way. The workshops were 100% practical, based on many examples and exercises. Mr. Kamil was very willing to share his knowledge and experience with the workshop participants, creating a great atmosphere (…)

(…) Each training conducted by Leantrix Sp z o.o. was conducted reliably and adapted to the needs of our organization, which additionally strengthened the effectiveness of the activities. The experience of the trainers allowed us to meet the challenges posed by our specific production.(…)

(…) Leantrix Sp. Z o.o. demonstrated reliability. The company was open to our comments and suggestions, ready to modify the training program and develop individual solutions to enhance the effectiveness of the activities.(…)

Quality Management Audit – ISO 9001 and IATF 16949

Why do you need this service?