FAQS RELATED TO AUTOMOTIVE SERVICES

Typically, an audit is an on-site assessment carried out by an auditor. In a remote audit, by contrast, at least part of the audit is performed off site – in other words, remotely, without the auditor being present on site. Instead, information and communication technologies (ICT) are used to perform the process in the virtual world. Remote audits have been approved since 2018 on the basis of the ISO 19011:2018 standard “Guidelines for Auditing Management Systems” for other standards. For automotive-industry standards such as IATF 16949 or VDA 6.x, “remote audits” were first approved in October 2020 and have become increasingly popular, due to the COVID 19 pandemic. Remote audits are only allowed in direct connection with the existing COVID 19 situation.

According to ISO 19011, remote audits are an auditing method which primarily serve as a complement to on-site audits. They are particularly useful for review activities or assessment of indicators, or for locations that are difficult to reach. However, many assessments included in an audit require auditors to use all their senses. This, together with reasons of efficiency, means that most audits cannot be performed entirely remotely. In the automotive sector, remote audits in accordance with IATF 16949 and VDA 6.X are only possible if an on-site audit is verifiably impossible due to the COVID-19. The reasons for a remote audit must be directly associated with the COVID-19 pandemic and must have been documented and submitted as evidence. Your TÜV SÜD account manager will be happy to work with you to review, on a case-by-case basis, whether and to what extent an audit or parts thereof can be carried out remotely.

Remote audits in the automotive industry are only possible if an on-site audit cannot be performed within the time window defined by the Rules for Achieving and Maintaining IATF Recognition 5th Edition (“Rules 5th Edition”), Section 5.1. The reasons for this must be directly related to the Covid-19 pandemic.

Current requirements, developments and further information can be found at:www.iatfglobaloversight.org (COVID-19 IATF RESPONSE).

If the production operations or the part of the company to be audited are closed or are not producing any parts on the due date of the audit, the certification body can propose an alternative audit date in accordance with the timeframe specified in the IATF Rules 5th Edition. If audit performance is still not possible, you may contact TMS to apply for a special concession (IATF Waiver)* at the competent Oversight Office. However, all necessary information on the current and expected situation at the location needs to be obtained and evaluated in both cases. The competent IATF Oversight Office will then decide on the new audit date applied for by the certification body.

^{*The special concession must be applied for and approved before the audit date.}

Remote audits have been eligible for all types of IATF & VDA 6.x audits (certification audit, surveillance audit, recertification audit, transfer audit, special audit, IATF 16949 Letter of conformance) for production sites, extended manufacturing sites (site extensions) and remote locations from 20 October 2020.

With effect from 1 February 2022, these audits can only be carried out in compliance with Revision 7 of the IATF COVID strategy “IATF Global Waivers and Measures in Response to the Coronavirus Pandemic (Covid-19)". Further revisions of this document shall be followed.

Remote auditing of quality management systems in the automotive industry in accordance with IATF 16949 or VDA 6.X cannot take place if the reasons submitted for a remote audit have no direct relation to the COVID-19 pandemic or if the IATF Oversight Office does not approve the application for a remote audit for extension of due dates.

Current requirements, developments and further information can be found at www.iatfglobaloversight.org.

To determine whether a remote audit in accordance with IATF 16949 is possible, companies must provide the auditor/account manager with various items of information related to the Covid-19 pandemic:

1. Duration of site closure, where applicable
2. Plan for recommencing operations and possible risks involved in medium-term closure (longer than one month) for all affected regions
3. Any extraordinary measures taken
4. Loss of resources (permanent or temporary)
5. Changes in policies or operating conditions (including regulations governing user safety)
6. List of customers located at the site, including operability information

Your safety and the safety of the auditor also play a key role.

If travelling to the site proves unreasonable for reasons such as possible health risks or travel restrictions, this constitutes an argument in favour of remote auditing. In addition, the technical equipment needed for a remote audit must be available. This includes, for example, suitable information and communication technologies (ICT) which meet the applicable criteria, e.g. data security, media resources and bandwidth.

On the basis of this audit planning process, the certification body assesses whether a remote audit may take place. The result of this decision must be clearly documented and retained within the scope of audit documentation.

Before the remote audit, the lead auditor checks the telecommunications equipment and carries out an applicability check for the audit with you, to ensure all intended methods and equipment are functioning correctly in all areas of the company.

Ultimately, a remote audit is similar to an on-site audit; the only difference is the use of information and communication technology. The auditors interview the employees in an audio and video conference and carry out digital reviews of scans, screenshots or other documents and IT systems.

In company areas with high noise levels, the audit team should request the use of noise-reducing microphone sets. The necessity of this measure shall be identified in a test of the telecommunications equipment within the scope of an audit trial (connection test before the remote audit + confirmation in the “Remote audit – Annex A” TMS document; the document can be obtained from your account manager).

When carrying out a remote audit, steps shall be taken to ensure that the preconditions that ensure a smooth audit process and have been agreed in audit planning are fulfilled. This means in particular that all necessary contact persons are available, all technical requirements fulfilled and regular break times are available.

In addition, there are some aspects that need to be documented in the report during the audit:

• Parts or activities that have not been effectively completed – e.g. because of a technology failure.
• Parts that were already excluded from the audit during audit preparation.
• Risks for (OEM) customers caused by adjustments made in the context of the COVID-19 pandemic

Any audit activities not conducted as planned need to be made up in the next audit. If this requires additional audit time, the audit team will inform you about this fact in the closing meeting. In addition, TÜV SÜD will identify remote audits as such in the IATF database entry.

If stage 2 of the initial certification audit was carried out as a remote or hybrid audit, the 12-month validity of the certificate must not be exceeded and the following audit must be a re-certification audit. 

^{* A hybrid or blended audit is an audit that is conducted partly remotely and partly on site. Further information on this topic can be found in current revision 7 applicable IATF document at www.iatfglobaloversight.org.} 

Please contact your competent account manager or auditor without delay and provide the relevant evidence that a remote audit is necessary in connection with the Covid-19 pandemic. The table below includes a list of possible reasons and the relevant evidence for IATF 16949 VDA 6.x remote audit. 

A support site or “remote location” is either a remote independent location or part of a production site that supports other production sites with non-production activities and/or functions including, but not limited to, warehouse, sales, development, laboratory, calibration, etc.

The support functions intended by IATF are available in the table below. 

In keeping with the above, a remote location audit is an audit performed at an independent support location. The audit of a remote function at a production site is carried out in parallel to the audit of the production site. In general, support services are audited at the location where the support function is provided. As part of a production site, the support function can only be considered as a stand-alone location if it operates under its own company name or has its own company address which differs from that of the production site.

Different support functions can be audited as stand-alone systems by various certification bodies. However, in practice, different certification bodies audit a complete remote location in most cases. This, in turn, is only possible if the certification body also certifies a production site of the same customer, since, in terms of calculation, the remote location always needs to be assigned to a production site.

Remote locations shall be audited before the stage 2 of the initial certification audit, and at least once more during the surveillance cycle and within the scope of the recertification audit. The only exception to the above rule comprises support functions with responsibility for product design. They must be audited at least once in every twelve-month period.

A transfer audit takes place if a customer certified in accordance with IATF 16949 decides to change to another certification body.

If a company is to benefit from added value beyond the certificate itself, the company, certification body and auditor need to work in perfect harmony. If this is not the case or if you are dissatisfied, changing to a new certification body may be the reasonable thing to do even in the middle of the certification cycle.

Yes, this is possible within the scope of a surveillance or re-certification audit. In this context it is important to study the IATF rules and comply with them, i.e. the client must not have changed certification body in the last three years and the client’s certificate must be valid at the time of transfer, i.e. the certificate must not be withdrawn, suspended or cancelled. For further rules, see below under “Criteria”

Once you have decided to change to another certification body, we will perform an (IATF) transfer audit.

You need to inform your current certification body of your intention to change certification body. This is best done in writing. Provided you have a valid contract, your current certification body must not use your information of the intended transfer as grounds for suspending or cancelling your current certificate. Don't cancel the contract.

No. You need to inform your current certification body of your intention to change to another certification body, but you should not terminate your existing contract before all transfer activities have been completed.

Your certificate needs to be valid at the time of the change. “Valid” means that all information given on the certificate must correspond to reality and to your quality management system. For this reason, we recommend that you do not relocate during a transfer. “Valid” also means that your certificate must not be suspended, withdrawn or cancelled. You must not be in IATF OEM special status condition. In addition, you must not have already changed your IATF certification body in the last three years. The new certification body must have IATF accreditation.

TÜV SÜD ensures compliance with the 3-year-rule; in other words, it will not assign any auditors to your case that have already audited your site within the last 3-year cycle.

To prepare for the audit, our auditor thoroughly reviews your quality management system documentation (document review) and the audit reports of the last three years. All nonconformities identified at the production site and remote locations must have been closed. Of course, we also review the effective implementation of corrective actions to all nonconformities issued by the previous certification body.

Before this is possible – in other words, prior to the start of a transfer audit – your current certification body must confirm that all nonconformities (also all 100% resolved nonconformities) have been closed. This also applies if you are in IATF OEM special status, which must be positively closed before application for the Transfer.

Before we can issue a TÜV SÜD certificate, the transfer audit – comprising the number of auditor days of a re-certification audit (without stage 1) – must be performed on site at your premises and NC Management must have been completed. We plan the transfer audit including NC management with you in such a manner that the final certification decision can be taken prior to expiry of your valid certificate. It may take up to 4 months from the last audit day.

Yes. After successful completion of your transfer audit, you will start a new three-year audit and certification cycle, starting with the date of the last day of your transfer audit. Do you need support with your transfer audit? Contact us!