From evaluating suppliers to running a program
Supplier quality engineers evaluate individual suppliers. Supplier quality managers own the program: the rules for how all suppliers are selected, monitored, audited and developed, and the resources to do it. IATF 16949 section 8.4 sets the requirements; customer-specific requirements (CSRs) from each OEM add more (DQS).
The program also has to survive change. IATF Rules 6th Edition took effect January 1, 2025, and a revised IATF 16949 aligned with the expected ISO 9001 revision is in drafting, expected in late 2026 or early 2027, with more emphasis reported on software quality, cybersecurity, supply chain resilience, sustainability and risk-based thinking (Smithers).
Program design: five building blocks
1. Supplier segmentation
Segment suppliers by risk (product safety, special characteristics, process complexity, performance history) and by QMS level (IATF 16949 certified, ISO 9001 certified, neither). DQS describes the expected model as setting a minimum and a target QMS development level for each supplier.
2. Documented audit criteria
IATF 16949 requires documented criteria for the need, type, frequency and scope of second-party audits, based on risk. The manager owns those criteria and makes sure they are applied consistently.
| Segment | Example criteria | Typical audit approach |
|---|---|---|
| High risk, not IATF certified | Safety parts, special processes | Annual process audit plus QMS audit |
| High risk, IATF certified | Safety parts, good performance | Process or product audit on trigger or cycle |
| Medium risk | Standard parts, stable performance | Audit on performance trigger |
| Low risk | Catalogue items | No routine audit; monitor only |
3. Auditor competence
Second-party auditors need competence in the automotive process approach, risk-based thinking, customer requirements and core tools. Some customers set more: DQS reported that FCA required second-party auditors to hold IATF 16949 certification that is not suspended, and GM required qualified lead auditors or specified internal-auditor criteria.
4. CSR cascade
Every OEM you supply may add requirements: financial assessments, specific audit methods, sub-tier controls or waivers for small suppliers. Build a CSR matrix that shows, for each requirement, which suppliers it applies to and how it is cascaded.
5. Development and exit
Supplier development (8.4.2.5) uses monitoring results, audits and risk analysis to decide priority, type and extent. The program should also define when a supplier is put on controlled shipping, new business hold or phased out.
Governance and metrics
| Metric | Why it matters |
|---|---|
| Supplier-caused customer incidents | Direct impact on your customer |
| Share of suppliers meeting target QMS level | Progress of development |
| Audits completed versus plan, by risk tier | Program discipline |
| Corrective action closure time and effectiveness | Problem solving at suppliers |
| Suppliers on escalation status | Risk exposure |
Report these in management review and use them to argue for resources.
Preparing for the standard revision
The revision is not published yet, so avoid rebuilding the program now. Do the preparation that is useful anyway: document the risk logic, check which suppliers provide software or connected components, and look at supply chain resilience and continuity planning, all themes reported for the revision.
Who you work with
- Purchasing leadership: sourcing strategy and supplier exit.
- Plant quality managers: supplier issues at each site.
- Program management / APQP: new suppliers and launches.
- OEM supplier quality teams: CSRs and escalations.
- Certification body: how your program will be audited.
Common weaknesses
- Audit plans carried over year to year without risk review.
- CSRs read once and not cascaded.
- Development plans with no follow-up.
- No defined escalation path.
- Auditor qualifications not recorded.
Checklist
- Supplier segmentation by risk and QMS level
- Documented second-party audit criteria
- Auditor competence records
- CSR matrix for all customers
- Development and escalation rules
- Program metrics in management review
- Revision watch list (software, cybersecurity, resilience)
How AskDona helps
Running a program means comparing many supplier files against the same rules. AskDona reads supplier files, audit reports and CSRs and checks them against your program criteria, showing which suppliers are missing audits, certificates or development actions, with page citations. Run a sample supplier portfolio review on ten suppliers. AskDona shows the evidence; your supplier quality leadership decides.
Editor’s note: Clause and CSR examples rely on DQS’s December 2019 guide; OEM CSRs change, so check current versions. Revision themes are reported by Smithers and may change before publication. The segmentation table is illustrative. The LinkedIn count was supplied by the client.
FAQ
What is the difference between a supplier quality engineer and a supplier quality manager? Engineers evaluate and develop individual suppliers; managers own the program, criteria and resources.
What are CSRs? Customer-specific requirements that OEMs add to IATF 16949.
When will IATF 16949 be revised? Reportedly late 2026 or early 2027.
When did IATF Rules 6th Edition take effect? January 1, 2025.
References
All pages opened and checked by October 23, 2026.
| Source | Type | Used for |
|---|---|---|
| DQS: Expectations for IATF supply chain management, section 8.4 (Dec 19, 2019) | Certification body guide | Clause summaries, CSR examples |
| Smithers: IATF 16949 news, 2025 rules and 2026 changes | Industry update | Rules 6th Edition, revision themes |