When an external audit – such as a customer or certification audit – is approaching, many organizations activate the same mechanism. The quality department reviews the documentation, follows up on open actions and asks process owners to complete missing records. Such a review can organize the evidence, but it cannot repair decisions that have not been made outside the quality department for months.
A customer audit does not only check whether procedures exist. It also shows whether requirements have been translated into process management and whether assigned roles are actually fulfilled. In addition, it reveals whether the organization responds to risks, problems and changes. As a result, a visible gap often appears in the quality area even though its source lies in production, engineering, purchasing, HR or top management.
The following seven gaps form a QualityWise expert diagnostic list, not a statistical ranking of audit findings. We present each gap using the same five-part framework. It moves from the symptom visible to the auditor, through the real source of the problem, to the division of responsibility and a question for the process owner.
Audit readiness is not created during a document review. It is created when process owners make the right decisions, respond to risk and can demonstrate the effectiveness of their actions.
1. Problems are closed, but not effectively solved
What the auditor may find:
The register contains closed complaints and corrective actions, yet similar problems keep returning. Root cause analysis stops at operator error, while the chosen response is limited to training. Meanwhile, the effectiveness review merely confirms that the assigned task was completed. In another scenario, an 8D report remains open because the team lacks data, a technical decision or an agreement with the customer.
Where the problem really began:
Usually, it began before anyone opened the 8D form. The organization did not establish who owns the problem or who is responsible for protecting the customer. It also failed to define who provides process data and who can approve a change. Without these decisions, even a correctly selected method becomes a documentation exercise. This logic is reflected in the approach to problem solving as a management process, rather than the exclusive domain of quality.
Why the Quality Manager cannot fix it alone:
The quality department can facilitate the analysis, safeguard the method and challenge weak evidence. However, it cannot independently change process parameters, tooling design, the maintenance plan, purchasing rules or production priorities. If the cause lies in one of these areas, effective action requires a decision by the relevant process owner.
How to divide responsibilities before the audit:
The process owner is responsible for eliminating the cause and sustaining the result. Quality supports the choice of method, the consistency of evidence and quality-related communication with the customer. Engineering, maintenance, logistics or purchasing implement the actions arising from the cause. Management resolves competing priorities and provides resources when the problem exceeds the capability of a single process.
Question for the process owner:
How will you know that the mechanism causing the problem has been eliminated, rather than only the assigned tasks being closed?
2. PFMEA, the Control Plan and work instructions describe different versions of the process
What the auditor may find:
A characteristic identified in the PFMEA does not appear in the Control Plan. The inspection frequency in the work instruction differs from the frequency specified in the Control Plan. The setting used at the workstation also differs from the approved documentation. Alternatively, the operator performs an additional inspection that has never been formally incorporated into the system.
Where the problem really began:
The source is usually not a single editorial error but ineffective change management. A change to the product, process, tooling, supplier or material did not trigger a review of all related documents. The same can happen when a change is introduced in response to a problem. Consequently, the PFMEA, Control Plan and work instructions no longer reflect one agreed method of controlling the process.
Why the Quality Manager cannot fix it alone:
Consistency cannot be restored simply by rewriting documents. Someone must assess the technical risk and confirm the actual process flow. The team must then agree on the characteristics and control methods and verify implementation at the workstation. These are decisions for a cross-functional team, not an administrative correction by quality. It is also important to remember that IATF 16949 requires a multidisciplinary approach when working with FMEA.
How to divide responsibilities before the audit:
The change owner should initiate an assessment of its impact. Technology and process engineering update the process logic and technical data. Quality verifies the connection between risk, controls and the reaction plan. Production confirms implementation at the workstation, while the supervisor checks whether employees know the current standard.
Question for the process owner:
Is the most recent significant change reflected in the PFMEA, Control Plan, work instruction, employee training and actual work at the workstation?
3. The organization has training records but no confidence in competence
What the auditor may find:
An employee is recorded as trained but cannot explain the reaction plan, identify a nonconformity or perform an inspection correctly. The competence matrix is complete, yet its levels have no clear criteria. The assessment ends with a signature on an attendance list, without confirmation of practical performance.
Where the problem really began:
The organization equated attendance at training with competence. However, the process owner did not define what the employee should be able to do. The process owner also failed to specify the conditions for demonstrating competence and who would evaluate the result. HR can manage deadlines and records, but it cannot replace technical competence criteria.
Why the Quality Manager cannot fix it alone:
The Quality Manager can identify a system gap and support the content of quality-related training. However, they do not observe the daily performance of every operation. Therefore, they should not independently approve competence in processes owned by production, the laboratory, logistics or maintenance.
How to divide responsibilities before the audit:
The process owner defines the required skills and assessment criteria. A supervisor or authorized expert confirms competence in practice. HR provides the record-keeping system and ensures that assessments are completed on time. Quality manages competence requirements for auditors, quality methods and inspection activities when these fall within its scope.
Question for the process owner:
What evidence—other than an attendance list—will confirm that the employee can respond correctly to a deviation?
4. Supplier problems are detected, but the system does not manage them
What the auditor may find:
The same material or component nonconformities keep returning, incoming inspection becomes a permanent containment measure, and supplier actions remain open without a clear escalation path. The periodic evaluation shows poor performance but does not lead to a specific purchasing, development or technical decision.
Where the problem really began:
Several sources are possible. They include supplier selection, incomplete communication of requirements, weak risk assessment, a change in the supply chain or a failure to respond to deteriorating performance. If the organization reduces supplier quality assurance to complaints and incoming inspection, it acts only after the effect has occurred.
Why the Quality Manager cannot fix it alone:
Quality can assess the nonconformity, require an analysis and monitor actions. However, it does not independently set commercial terms or approve the source of supply. Nor does it always have the authority to initiate a technical change or second sourcing. Without the involvement of purchasing, engineering and management, a quality escalation may have no business consequence.
How to divide responsibilities before the audit:
Purchasing is responsible for the terms of cooperation and the use of agreed escalation mechanisms. Supplier Quality leads the quality assessment and supplier development. Engineering defines technical requirements and evaluates changes. The owner of the process that uses the supplied product determines the operational risk. Management makes the decision when the risk requires a change of source, additional resources or acceptance of containment costs.
Question for the process owner:
What decision follows from the supplier’s current risk level, and who has the authority to make it?
5. Customer requirements are known but have not been implemented in the processes
What the auditor may find:
The organization has a document containing customer requirements but cannot show where individual requirements have been translated into processes, criteria, forms or responsibilities. The document version is outdated, or the people performing the process do not know which requirements apply to their work.
Where the problem really began:
No one owns the full cycle: identifying the correct sources, assessing applicability, assigning requirements to processes, confirming implementation and monitoring changes. Customer-specific requirements do not become part of the system simply because they have been entered in a register. Moreover, their scope and current status depend on the specific customer. Current documents published for individual OEMs should be checked in the relevant official source, such as the IATF Customer Specific Requirements page.
Why the Quality Manager cannot fix it alone:
Not every requirement concerns a process managed by quality. Some affect design, logistics, purchasing, production, performance reporting, product approval or commercial communication. The Quality Manager can coordinate the system, but each process owner must determine how the requirements will be implemented and provide evidence.
How to divide responsibilities before the audit:
The function that communicates with the customer ensures access to the correct sources and contractual information. Quality maintains the agreed mechanism for identifying requirements, assessing applicability and controlling changes. Each process owner implements the assigned requirements. Management resolves conflicts, sets priorities and provides resources.
Question for the process owner:
Which requirements of this customer apply to your process, and how will you demonstrate their implementation through actual practice rather than an entry in a register?
6. Internal audits confirm conformity but fail to detect weak signals
What the auditor may find:
The most recent internal audits ended without significant findings, even though the customer quickly identifies conflicting documents, recurring problems or overdue actions. The checklists are complete, but the records do not show sampling, interviews with employees, process observation or the tracing of evidence across related areas.
Where the problem really began:
The audit program was driven by the calendar and completion of the plan rather than by risk and process performance. The audit checks whether system elements are present but too rarely verifies their consistency and effectiveness. In addition, the auditor may lack sufficient process knowledge or the independence needed to challenge an established practice.
Why the Quality Manager cannot fix it alone:
The Quality Manager can design the program, develop auditors and evaluate the quality of audit records. However, they cannot single-handedly ensure the availability of competent auditors from other functions. They also cannot create sufficient time for robust sampling or guarantee the involvement of process owners in post-audit actions. If internal auditing is treated as a quality department task, the other functions remain merely auditees rather than jointly responsible participants in the system.
How to divide responsibilities before the audit:
The person managing the audit program plans it based on the significance of processes, changes, risks and previous results. Management provides competence, time and conditions that support independence. Auditors collect evidence that allows them to evaluate how the process works. Process owners analyze the findings, eliminate causes and confirm the effectiveness of actions.
Question for the process owner:
Which known risk or poor result should be examined in the next audit, and what evidence do you expect the auditor to find?
7. Management review reports problems but does not lead to decisions
What the auditor may find:
Presentations contain indicators, complaints, audit results and action status, yet the minutes do not show decisions, owners or deadlines. The same problem appears in subsequent reviews. Objectives remain unmet, resources remain insufficient and risk is discussed without a formal resolution.
Where the problem really began:
The meeting became a recurring report prepared by quality. Data are presented, but they do not lead to decisions about priorities, resources, changes or the accepted level of risk. A management review should support the direction of the management system, rather than merely confirm that the required topics were discussed.
Why the Quality Manager cannot fix it alone:
The Quality Manager can prepare consistent data, identify systemic relationships and monitor actions. However, they cannot independently approve investments, change operational priorities, resolve a conflict between functions or accept risk on behalf of top management.
How to divide responsibilities before the audit:
Top management makes and documents decisions concerning the quality management system. Process owners present the causes behind results, propose actions and fulfill the commitments made. Quality organizes reliable inputs, highlights systemic relationships and oversees the status of agreed actions, but it does not assume responsibility for management decisions.
Question for the process owner:
What decision do you need from management to change the process result, and does that decision have an owner, a deadline and a method for confirming completion?
Audit readiness starts with process owners
The biggest mistake in preparing for a customer audit is asking only, “Does quality have all the documents?” A better question is, “Can process owners demonstrate that they make the right decisions and sustain the agreed actions?” Documentation is necessary, but it should be evidence of a functioning system, not a substitute for one.
Before the audit, the organization should therefore move from collecting files to reviewing responsibilities. For each gap, determine:
- which signal indicates ineffectiveness;
- where the decision affecting the result is made;
- who owns the action and who must support them;
- which evidence will demonstrate implementation and effectiveness;
- which unresolved issues require a management decision.
Such a review does not guarantee a particular audit result. However, it helps distinguish a functioning process from a declaration and a complete set of documents from consistent evidence. It also separates a formally assigned role from responsibility that is actually fulfilled.
FAQ
Who should be responsible for preparing the organization for a customer audit?
The quality department may coordinate the preparation, but process owners are responsible for the readiness of their respective processes. Top management is responsible for decisions, priorities and resources that cannot be resolved within a single process.
Does complete documentation mean that the organization is ready for a customer audit?
No. Documentation should be consistent with the actual process and supported by evidence of use. Current forms cannot replace effective action, employee competence or an appropriate response to deviations.
Is a positive internal audit enough to consider the organization ready?
It provides no such guarantee. The audit scope, auditor competence, sampling method and quality of the evidence all matter. It is also important to determine whether previous findings led to effective actions.
What evidence shows that a process works effectively?
The evidence depends on the process and the audit criteria. It should usually combine results, observation of actual practice, current documents, people’s competence, responses to deviations and implementation of decisions. A single record is rarely enough to evaluate the entire mechanism.
Where should the organization start once a customer audit has been announced?
Start with known problems, changes, poor results, complaints and open actions. Then assign each signal to a process owner, verify the evidence of implementation and escalate unresolved decisions to the appropriate management level.
Listen to the podcast
If you want to move from diagnosing gaps to preparing the entire organization in practice, listen to “How to Prepare for a Customer Audit Without Panic.” This episode is part of the “Specifically About Quality” podcast.
The podcast is also available on Spotify, Apple Podcasts and Amazon Music.
Check your organization’s readiness before the audit
If you want to turn the analysis above into a specific review of your own organization, use QualityWise’s free “Audit Your System Without Panic” checklist. It allows you to identify, step by step, where consistent evidence of readiness already exists. It also shows where a decision, action or confirmation of effectiveness is still needed.
Complete the system audit readiness checklist, then use the result as the basis for a discussion with process owners and top management.
All content on the qualitywise.pl website is a private interpretation of publicly available information. Any convergence of the described situations with people, organizations, companies is accidental. The content presented on the website qualitywise.pl does not represent the views of any companies or institutions.