Chapter 6: Internal Audits and Layered Process Audits in Automotive Plants

Clause 9.2 requires planned internal audits covering all QMS processes annually, but automotive suppliers layer in CQI-9 (heat treat), CQI-11 (plating), CQI-12 (coating), CQI-15 (welding), CQI-17 (electronics), CQI-23 (molding), and CQI-27 (casting) special-process audits per the AIAG CQI series, plus daily Layered Process Audits (LPA) at the production-station level. The integrated audit program: 1 annual full-system audit, 4 quarterly process audits, 12 monthly product audits, plus daily LPAs by supervisors and managers. PinnacleQMS clients schedule and track all of these in one calendar — accredited auditors specifically check that LPA findings feed into the formal CAPA system.

The audit program is the single most-cited clause when automotive suppliers fail surveillance audits. Registrars do not just want to see audit reports filed in a binder; they want evidence that audits actually drive improvement, that operators on the floor know what is being checked and why, and that special-process certifications are current. The checklists below show exactly what accredited auditors verify in a North American automotive plant — and what plant teams should verify themselves before the registrar arrives.

Annual internal audit checklist (the clause 9.2 baseline)

The annual full-system audit is the backbone of ISO 9001 compliance. Auditors expect the program to cover every QMS process at least once per certification cycle, with high-risk processes audited more frequently. The following items must be verifiable before the registrar arrives:

1. Audit program covers all QMS processes (sales, design where applicable, purchasing, receiving, production, calibration, shipping, customer service) on a documented schedule.
2. Audit schedule is risk-based — processes with prior nonconformities, high customer complaint rates, or new product launches are audited more frequently than stable processes.
3. Auditor competency records exist for every internal auditor (training certificate, witnessed audit log, independence from the area being audited).
4. Audit checklists reference specific clauses of ISO 9001 and, for IATF 16949 suppliers, the corresponding IATF clauses and customer-specific requirements.
5. Every audit has documented objective evidence — sample sizes, document numbers reviewed, interviewees by role (not name), and physical observations.
6. Nonconformities are classified as major, minor, or opportunity for improvement, with the classification rationale recorded.
7. Audit findings are issued within five working days of the closing meeting and assigned to a responsible owner with a target close date.
8. Process owners — not the auditor — write the corrective action, including root cause analysis using 5-Why, fishbone, or 8D depending on severity.
9. Effectiveness verification is performed at least 30 days after action closure, with sampled evidence that the nonconformity has not recurred.
10. Audit results are reported to top management at the next management review, including trend data on repeat findings and overdue actions.
11. The audit program itself is reviewed annually and adjusted based on QMS changes, customer escalations, and prior-year findings.
12. Customer-specific audit requirements (Ford Q1, GM BIQS, Stellantis CSR, Honda QAV) are mapped into the schedule so nothing is missed at the next surveillance.
13. Special-process audits (the CQI series below) are scheduled separately but tracked in the same calendar, with current certifications visible to operations leaders.
14. Layered Process Audit results are summarized monthly and reviewed alongside formal audit findings.
15. Audit records — schedules, checklists, findings, CAPAs, effectiveness checks — are retained for the period stated in the customer-specific requirements (typically three years past production plus service).

Layered Process Audit (LPA) program — daily floor audits

LPAs are the automotive industry's most effective tool for catching standard-work drift before it becomes a customer complaint. The AIAG CQI-8 guideline defines the structure, and accredited auditors expect every operator to know an LPA is happening that shift. Roles run from operator self-check up to plant manager, with each layer auditing a smaller subset of stations more deeply:

1. Operator self-audit at start of shift — workstation organization, tool condition, gauge calibration date, current revision of work instruction, FIFO compliance, PPE.
2. Supervisor LPA — minimum one station per shift, verifying the operator self-audit was completed and that the operator can explain the critical-to-quality characteristics at that station.
3. Manufacturing engineer or quality engineer LPA — minimum two stations per week, verifying that the control plan, PFMEA severity ratings, and reaction plans match what is actually happening at the press, weld cell, or assembly line.
4. Plant manager LPA — minimum one full line walk per week, with documented observations and at least one item escalated for action.
5. LPA questions are short, closed-ended, and rotate quarterly so operators do not memorize answers — typical questions include "show me the last calibration record for this gauge" and "what is the reaction plan if dimension X falls below LSL?"
6. Findings are recorded the same shift, photographed where applicable, and entered into the CAPA system within 24 hours if classified as a quality risk.
7. Red findings — anything that could ship a nonconforming part — trigger an immediate stop-and-fix and a same-day notification to the plant manager and quality manager.
8. Repeat findings (same station, same issue, two LPAs in a row) are auto-escalated to the formal corrective action process and trended in management review.
9. LPA completion rates are posted on the plant scorecard alongside scrap, first-time-through, and customer PPM, so operations leadership sees compliance and quality together.
10. The LPA program itself is audited during the annual internal audit — auditors check that supervisors and managers are doing their layers, not just operators.

AIAG CQI special-process audit checklist (which CQI applies to which process)

The AIAG CQI series covers special processes where the result cannot be fully verified by inspection of the finished part — heat treat, plating, welding, and similar processes where in-process control is the only safeguard. Automotive suppliers must self-assess against the applicable CQI annually and submit results to the customer when required:

1. CQI-9 — Heat Treat System Assessment. Triggered if the supplier or any subcontractor performs annealing, normalizing, hardening, tempering, carburizing, nitriding, or induction hardening on production parts. Pyrometry (System Accuracy Tests, Temperature Uniformity Surveys, instrument calibration) is the most-failed section.
2. CQI-11 — Plating System Assessment. Triggered for zinc, zinc-nickel, chrome, nickel, copper, tin, or anodize processes. Bath chemistry, rinse-water management, and hydrogen embrittlement relief are the high-risk areas.
3. CQI-12 — Coating System Assessment. Triggered for liquid paint, e-coat, powder coat, and similar finish processes. Pretreatment, cure-oven profile, and film-thickness control drive most findings.
4. CQI-15 — Welding System Assessment. Triggered for resistance, arc (MIG/MAG/TIG), laser, projection, and stud welding. Welder qualification records, weld schedules, and destructive-test frequency are the typical gaps.
5. CQI-17 — Soldering System Assessment. Triggered for printed circuit board assembly, wave solder, reflow, and selective solder operations. Solder-paste storage, profile validation, and IPC-A-610 acceptance criteria are the focus.
6. CQI-23 — Molding System Assessment. Triggered for thermoplastic and thermoset injection, compression, and transfer molding. Material drying, process-monitoring parameters, and tool-condition records are common findings.
7. CQI-27 — Casting System Assessment. Triggered for sand, die, investment, and permanent-mold casting. Melt chemistry, degassing, mold-temperature control, and rework limits are scrutinized.
8. Each CQI assessment must be performed by a qualified internal auditor (CQI-9 specifically requires AIAG-recognized training) and reviewed by the customer SQE on request.
9. Job audits (process-specific runs at the customer-required frequency) are performed in addition to the annual system assessment — typically one per part family per quarter.
10. Findings from CQI assessments feed the same CAPA system as ISO 9001 internal audits — there is no separate, parallel corrective-action workflow.

Quarterly process audit pre-flight

Quarterly process audits dive deeper into one or two manufacturing or business processes per quarter, complementing the annual full-system audit. Before the auditor enters the area, the following must be confirmed:

1. Turtle diagram or SIPOC for the process is current and matches the actual flow on the floor.
2. Process inputs (specs, drawings, BOMs, work instructions) and outputs (finished goods, records, scrap data) are listed with current revision numbers.
3. Key Performance Indicators for the process — first-time-through, scrap rate, OEE, on-time delivery — are posted and trending in the right direction or have an active CAPA if not.
4. Linkage to PFMEA and control plan is verified — every special characteristic has a control method and a reaction plan that operators can demonstrate.
5. Calibration status of every gauge, tester, and CMM used in the process is current and the calibration records are accessible from the workstation.
6. Training records for every operator on the line cover the current revision of the work instruction, not a superseded one.
7. Last LPA findings for stations in this process are reviewed by the auditor as a starting point — repeat issues become major findings.
8. Customer complaints and warranty data tied to this process for the past 12 months are pulled and root-cause status confirmed.
9. Any engineering changes, tooling changes, or supplier changes since the last audit are listed and tied to PPAP or change-control records.
10. The process owner is on site for the audit — not delegated — because clause 9.2 specifically expects process owners to engage with findings.

Closing audit findings into CAPA (the integration auditors verify)

Accredited auditors do not just check that audits were done — they check that findings actually closed the loop. The integration between audit programs and the CAPA system is where most automotive suppliers either pass with confidence or get a major nonconformity:

1. Every audit finding (annual, quarterly, LPA, CQI) creates a CAPA record in the same system, with the same workflow stages — open, root cause, action, verification, closure.
2. Root cause analysis depth matches finding severity — a major nonconformity gets an 8D, a minor gets a 5-Why, an LPA red gets a same-day containment plus 5-Why within a week.
3. Containment actions are recorded separately from corrective actions — auditors check that suspect product was identified, segregated, and dispositioned before the long-term action was developed.
4. Effectiveness verification uses a different sample or a later production run than the one the corrective action was implemented on, with documented evidence.
5. Trend analysis flags repeat findings across audits — three identical findings in 12 months trigger a systemic-issue review, not just another local fix.
6. Management review includes audit-finding aging, repeat-finding trends, and CAPA effectiveness rate as standing agenda items.
7. PFMEA and control plan updates triggered by CAPA closures are traceable — auditors sample one or two and follow the chain back to the originating finding.
8. Customer notification, when required by customer-specific requirements (escapes, warranty issues, recurring complaints), is logged and the response file retained.

Common internal-audit nonconformities in automotive plants

After hundreds of audit-readiness engagements, the same patterns appear repeatedly in North American automotive plants. Plant teams that pre-screen against this list typically reach the 98% first-pass certification rate that PinnacleQMS clients have averaged across 250+ engagements:

1. Auditor independence violation — a supervisor audits the production line they manage, or a quality engineer audits a process they wrote the work instruction for. Easy to fix with cross-departmental auditor pools.
2. Audit checklist not tailored — generic ISO 9001 checklist used in an IATF 16949 environment, missing customer-specific requirements and special-process triggers.
3. LPA program exists on paper but supervisors and managers are not completing their layers — only operators are, which defeats the layered intent.
4. CQI-9 pyrometry records (System Accuracy Tests, Temperature Uniformity Surveys) are out of date or missing the required thermocouple traceability.
5. Audit findings closed without effectiveness verification — the corrective action was implemented but no one checked 30 days later that it actually worked.
6. Repeat findings across consecutive audits with no escalation — the system finds the same issue three times and treats it as three separate fixes instead of one systemic problem.
7. Audit results not reaching management review — findings are filed but do not surface as a trend in the quarterly leadership meeting, so investment in process capability never gets prioritized.

A defensible audit program is the single biggest indicator that a QMS is working as intended — registrars know it, customer SQEs know it, and operators on the floor feel it when supervisors actually walk the line. PinnacleQMS consolidates the annual schedule, quarterly process audits, monthly product audits, daily LPAs, and AIAG CQI assessments into one calendar with automated reminders, auditor-competency tracking, and direct CAPA integration — accredited auditors can pull every finding, root cause, action, and effectiveness check from a single dashboard. To map an integrated audit program against current customer-specific requirements before the next surveillance, contact PinnacleQMS for a plant-specific audit-readiness review. Reference standards are published by ISO and the International Accreditation Forum.