Section 8.4 is the SQE’s rulebook
IATF 16949 builds automotive requirements on top of ISO 9001, and section 8.4 (control of externally provided processes, products and services) is where most supplier quality work sits. DQS’s guide to the section highlights a sequence: select suppliers on a documented basis, develop their quality management systems, monitor their performance, audit where risk requires it, and develop them where they fall short (DQS).
The standard itself is the 2016 edition, but the rules for certifying it changed: IATF Rules 6th Edition took effect January 1, 2025, and a revision of IATF 16949 aligned with ISO 9001 is in drafting, expected in late 2026 or early 2027 (Smithers).
The supplier lifecycle under 8.4
| Stage | Clause | SQE focus | Typical evidence |
|---|---|---|---|
| Selection | 8.4.1.2 | Documented selection process including risk, capability and business factors | Selection assessment, process audit or production run where required |
| Customer-directed sources | 8.4.1.3 | Directed suppliers skip selection but are still monitored | Customer direction, monitoring records |
| Statutory and regulatory | 8.4.2.2 | Requirements and special controls cascaded to suppliers | Purchase documents, supplier acknowledgements |
| QMS development | 8.4.2.3 | Move suppliers toward ISO 9001 certification and ultimately IATF 16949 | Certificates, second-party audit results, development targets |
| Embedded software | 8.4.2.3.1 | Software development capability for suppliers of embedded software | Software process assessment |
| Monitoring | 8.4.2.4 | Performance indicators reviewed regularly | Scorecards, delivery and quality data |
| Second-party audits | 8.4.2.4.1 | Documented criteria for need, type, frequency and scope | Audit plan, reports, auditor qualifications |
| Development | 8.4.2.5 | Priority, type and extent of development based on performance and risk | Development plans, follow-up |
Clause descriptions are summarized from DQS’s guide; the standard’s text is copyrighted.
Selection: write the logic down
DQS lists factors that selection should weigh, including the supplier’s change management, resource adequacy, financial stability and business continuity planning. Customer-specific requirements (CSRs) can add more: DQS reports, for example, that FCA required an on-site process audit and production demonstration run for suppliers not considered low risk, and Ford required at least an annual financial assessment of the supply chain. Always check the current CSRs of each customer you ship to.
QMS development: ISO 9001 first, IATF next
IATF 16949 asks organizations to develop suppliers toward certification. DQS describes a risk-based model where each supplier has a minimum and a target QMS level, with third-party certification or second-party audits against customer requirements as routes.
Monitoring: measure what affects the customer
Monitoring should focus on how supplier performance affects your conformity and your customer, such as delivered-product quality, delivery performance and disruptions passed on to the customer. Feed results into supplier development and risk analysis, as DQS notes.
Second-party audits: criteria, not habit
DQS quotes the requirement that the organization “shall document the criteria for determining the need, type, frequency, and scope of second-party audits”, based on risks such as product safety, supplier performance and QMS certification level. Auditors need competence in the automotive process approach, risk-based thinking, customer requirements and core tools. Some OEMs set more: DQS reported annual audits and IATF-certified second-party auditors for FCA, and qualified lead auditors with passing scores for GM.
Who you work with
- Purchasing: sourcing decisions and contracts.
- APQP / program teams: new parts and PPAP.
- Plant quality: incoming issues and containment.
- Logistics: delivery performance and premium freight.
- Customer SQEs: CSRs and escalations.
Common weaknesses
- Selection based on price with no documented risk assessment.
- No development targets for suppliers without IATF certification.
- Scorecards reviewed but not acted on.
- Second-party audits scheduled by habit rather than documented criteria.
- CSRs not checked for each customer.
Checklist
- Documented, risk-based selection process
- QMS development target for every supplier
- Monitoring indicators reviewed on a fixed cycle
- Documented criteria for second-party audits
- Second-party auditor competence records
- Development plans for underperforming suppliers
- Current CSRs mapped to supplier requirements
How AskDona helps
A supplier file can include certificates, audits, PPAP, scorecards and corrective actions. AskDona reads that file against IATF 16949 section 8.4 checkpoints and your customers’ CSRs and flags missing evidence, such as expired certificates or audits without follow-up, with page citations. Run a sample supplier evaluation review on one supplier. AskDona shows the evidence; your supplier quality team decides.
Editor’s note: Clause summaries rely on DQS’s December 2019 guide; IATF 16949:2016 is still the current edition, but OEM CSRs change often, so check the latest versions. The LinkedIn count was supplied by the client.
FAQ
Which IATF 16949 section covers supplier management? Section 8.4, control of externally provided processes, products and services.
Do suppliers need IATF 16949 certification? The standard aims to develop suppliers toward it, starting with ISO 9001; customer CSRs may set specific requirements.
How often should second-party audits happen? As often as your documented risk-based criteria require, plus any CSR minimums.
Is IATF 16949 being revised? Yes. A revision is in drafting, expected in late 2026 or early 2027.
References
All pages opened and checked by October 23, 2026.
| Source | Type | Used for |
|---|---|---|
| DQS: Expectations for IATF supply chain management, section 8.4 (Dec 19, 2019) | Certification body guide | Clause summaries, OEM CSR examples |
| Smithers: IATF 16949 news, 2025 rules and 2026 changes | Industry update | Rules 6th Edition, revision timing |