1. Purpose and scope
The certification audit is the system's qualification. An accredited certification body, independent of the organisation and its customers, examines the system against the standards and decides whether to certify it. The audit follows the body's own rules, which in turn follow ISO/IEC 17021 and, for IATF 16949, the IATF Rules. The organisation does not control the audit, but it controls how well prepared it is and how well it answers what the auditors find.
The audit has two stages. The first stage is mainly a readiness check: the auditors review the documented information, the scope, the site conditions, the internal audit and management review records and, for automotive certification, the customer performance data the scheme asks for in advance. They report any areas of concern that could become nonconformities. The second stage, at every site in scope, tests implementation and effectiveness by sampling records, interviewing people at every level and following processes from customer requirements to delivery.
Findings in the second stage are graded by the certification body. Each nonconformity needs a response within the time the scheme sets: containment and correction of the immediate problem, a root cause analysis, a corrective action that addresses the cause, and evidence that the action has been implemented and, where required, is effective. The certification decision is taken by the certification body after it accepts the responses.
Out of scope: surveillance audits after certification, which belong to Surveillance Audits.
12 more sections for registered members.