Key takeaways
- ISO 9001 is a generic management system standard; IATF 16949 adds automotive process requirements on top of it.
- Both certificates are site specific, so the scope has to name the factory and the processes that will make the part.
- IATF allows product design to be excluded but not process design, which matters for build-to-print suppliers.
- A certificate shows that a system was audited, not that the process is capable of holding your tolerance.
Two certificates, two different jobs
A supplier that holds ISO 9001 is not automatically an automotive supplier, and a supplier that holds IATF 16949 is not automatically right for every part. The two certificates describe different scopes, different audit regimes and different customer expectations. Reading the scope is more useful than reading the logo.
The practical question is not which certificate is better. It is which one the programme requires, and whether the certificate covers the site and the process that will make the part. A certificate issued to a head office or a trading arm says nothing about the factory that ships the parts.
What ISO 9001 covers
ISO 9001:2015 is a generic quality management standard. It asks an organisation to define its processes, understand risk, control documented information, measure performance and improve. It does not prescribe a manufacturing method, a tolerance, a sampling plan or a tooling policy.
That generality is the point. The standard can apply to a machine shop, a plater, a distributor or a design office. Certification is voluntary unless a customer or a regulation requires it, and it is issued by an accredited certification body after an audit of the management system.
For a buyer, ISO 9001 is a baseline. It suggests that the supplier has a system for complaints, calibration, document control and corrective action. It does not suggest that the system is applied with the same discipline to every product line, or to the part on your drawing.
What IATF 16949 adds
IATF 16949:2016 is an automotive quality management standard that builds on ISO 9001:2015. It applies to manufacturing sites that make automotive production or service parts, and it adds requirements the automotive industry treats as normal: APQP, PPAP, FMEA, MSA, SPC and control plans.
It also requires the site to include its customers' specific requirements, to plan for contingency, to control error-proofing devices and to maintain production tooling. The audit looks at the process and the product, not only at the management system.
An IATF certificate is site specific and is listed in the IATF database. The certificate number can be checked, and the scope should name the automotive products and processes covered by the audit. A supplier that cannot point to its entry in that database has an incomplete answer.
Scope statements and exclusions
The first thing to read on either certificate is the scope. It names the site, the products and the processes. A certificate for machining does not cover plating if plating happens at a different site, even when both sites belong to the same company.
Both standards allow some exclusions. Under IATF, product design can be excluded when design responsibility sits with the customer, but process design cannot. That distinction matters: a supplier that only machines to a customer drawing still has to design and control the process that makes it.
| Question | ISO 9001 | IATF 16949 |
|---|---|---|
| Who publishes it | ISO | IATF, aligned to ISO 9001:2015 |
| Who it applies to | Any organisation, any sector | Sites making automotive production or service parts |
| Design responsibility | May be excluded with justification | Product design may be excluded; process design may not |
| Core tools | Not prescribed | APQP, PPAP, FMEA, MSA, SPC and control plans |
| Customer requirements | Handled through contract review | Customer-specific requirements are part of the system |
| Certification | Accredited certification body | IATF-recognised certification body, listed in the IATF database |
| Audit cycle | Three-year cycle with surveillance audits | Three-year cycle with surveillance and defined unannounced audits |
Simplified for comparison. The current standard text and the certification rules set the actual requirements.
Audits, findings and the certificate cycle
Both certificates run on a three-year cycle with surveillance audits. The certificate is a record of the system at the last audit, not a guarantee about the next shipment. IATF rules also allow unannounced audits in defined circumstances, which changes how a site prepares for a visit.
Findings are graded, and a major nonconformity can suspend or withdraw a certificate. Ask for the latest audit summary and the evidence that findings were closed. A certificate that is still valid while a major finding is open is a question to resolve, not a reason to relax.
What the certificate does not prove
A certificate does not measure the capability of your part. It does not prove that the process capability meets your requirement, that the gauge is adequate, that capacity is available or that the quotation is sustainable. Those are programme questions answered by a site visit, a first article and a capability study.
It also does not prove that your programme will receive the same attention as the automotive work that justified the certificate. Ask who owns your part, how the line is scheduled and what happens when automotive demand rises. A quality system can be sound while the commercial priority sits elsewhere.
Questions to ask before you accept a certificate
Treat the certificate as the start of a conversation. The answers to these questions show whether the system covers the work you are buying.
- Is the certificate current, and does the scope name the site that will make the part?
- Which processes are excluded, and who performs them?
- Does the scope cover your product family, or only a related product line?
- Which customer-specific requirements apply to this part?
- Can we see the latest audit summary and the closure evidence for findings?
- Which core tools will be used, and who approves the PPAP?
- What is the escalation route if a quality issue reaches our line?
A certificate is an invitation to a site visit
The audit trail explains how the system is meant to work. The floor shows whether it does. Use both before you release a production order.
Frequently asked questions
Is IATF 16949 required for every automotive part?
The customer requirement decides. IATF 16949 applies to sites that manufacture automotive production and service parts within its defined scope, and some categories sit outside it. Confirm the requirement with the customer and check the supplier's certificate scope rather than assuming.
Can an ISO 9001 supplier make automotive parts?
It can, but the customer may require IATF 16949 or a development plan towards it. ISO 9001 covers the management system without the automotive core tools and customer-specific requirements. For a production part, ask what fills that gap.
Does an IATF certificate cover design?
Product design can be excluded when the customer holds design responsibility. Process design cannot be excluded. A build-to-print supplier still has to design, validate and control the manufacturing process.
How often are these suppliers audited?
Both schemes use a three-year certification cycle with surveillance audits. IATF rules also allow unannounced audits in defined circumstances. Ask for the latest audit summary and the status of any open findings.
Sources and further reading
- ISO 9001:2015, Quality management systems, Requirements
- IATF 16949:2016, Quality management system requirements for automotive production and relevant service parts organisations
- IATF, Rules for Achieving and Maintaining IATF Recognition, 5th edition
Qumek Quality Desk
Quality team
The quality team responsible for first article inspection, PPAP packs, supplier audits and the records shipped with production parts.
Checking a supplier certificate before award?
Send the certificate and the part scope. The quality desk will check the site, the exclusions and the evidence behind the claim.
Send the certificate