IATF 16949 Cl. 4.3.2 - Customer Requirements vs. Customer Specific Requirements

The IATF definition for Customer-Specific Requirements states:

interpretations of or supplemental requirements linked to a specific clause(s) of this [the IATF] QMS standard.

Click to expand...

I'm curious as to how others interpret the phrase "linked to a specific clause" from the definition. Does this specifically mean that the format of the customer's document must include a reference to the applicable clause for it to be considered a CSR? (Keep in mind CSR, *NOT* "Customer Requirements" must be built into the scope of the QMS per cl. 4.3.2. The distinction here can make a huge difference for companies lower in the supply chain with a large number of automotive customers.)

For example, If I have a customer document titled "Supplier Quality Manual" and it discusses records, but does not link to an IATF clause, is this considered "linked to a specific clause", and therefore a CSR?

IATF FAQ #8 attempts to answer the question but isn't incredibly clear:

A way to identify if any customer-specific requirements exist is to compare sections of the IATF 16949 standard where the term « if required by the customer » exists and verify if the existing customer requirement document lists any specific requirements that are related to a requirement in the IATF 16949 standard. If yes, that customer and their requirements should be added to the document (which could be a table, a list or a matrix) in the quality manual.

Click to expand...

The phrase "If required by the customer" is only found in IATF clauses 8.3.4.4, 8.3.6.1, 8.5.1.1, and 8.7.1.4. Using the FAQ definition and the prior example, we are still no closer to knowing if "Supplier Quality Manual" is a CSR or not... unless the SQM covers one of the topics found in one of those four IATF clauses. The question then becomes, should the entire SQM be considered a CSR, or just those few clauses?

Bran said:

The IATF definition for Customer-Specific Requirements states:


I'm curious as to how others interpret the phrase "linked to a specific clause" from the definition. Does this specifically mean that the format of the customer's document must include a reference to the applicable clause for it to be considered a CSR? (Keep in mind CSR, *NOT* "Customer Requirements" must be built into the scope of the QMS per cl. 4.3.2. The distinction here can make a huge difference for companies lower in the supply chain with a large number of automotive customers.)
?

Click to expand...

Good day @Bran ;
Good question and one that has come up numerous times.

Please allow me to commingle and re-post some responses I have provided before (you can search this forum via "CSR" to find historical discussions on this topic)...

Please note section 3.1 (Terms and definitions....) of the IATF 16949 standard. Note the following two terms and definitions...
* customer requirements:
All requirements specified by the customer....

* customer-specific requirements (CSR):
Interpretations of or supplemental requirements LINKED to specific clause(s) of this Automotive QMS Standard.

As you can see by the definitions applied by the standard, ONLY those requirements "...linked to specific clause(s) are CSR.

Reminder to all... "CSR" (Customer Specific Requirements) is a very specific cardinal term as prescribed by IATF 16949.

For example, Honda has specific requirements unique to Honda. While these CAN be included in an internal organizational matrix/document, they are not "Customer Specific Requirements" as defined by the IATF 16949 standard. There are two reasons for this....
1- Honda (as an example) is not an IATF participant.
2- The definition per IATF 16949 = "Interpretations of or supplemental requirements linked to a specific clause(s) of this Automotive QMS Standard".

Again, including a customer unique requirement in an internal "CSR" list is not necessarily wrong if it assists you as an organization, however, it is important to note that only "Customer Specific Requirements" as documented by each participating OEM are indeed CSR per the standard. A list of all can be obtained @ ...Customer Specific Requirements – International Automotive Task Force

Hope this helps.
Be well.

There were and sometimes still there are two customers' approaches regarding how they form their CSRs.
First one is "ready to use", where customer mentioned standard's clause and wrote what else he requires from his suppliers.
This approach was and is still used by GM, Ford.
Second one is "read and match", where customer creates own requirements in form of manual, where sections titles or even content are not referring any of standard's clauses. Supplier job is match them with standard's clauses according to their content.
This approach was used by VW, Toyota, Honda. Since introduction of IATF 16949, VW has switched to "ready to use" approach, but mentioned Japanese OEM still keep it. Maybe they are not so perfect examples, because of their stance against IATF. Still some of Tier-1 use this approach in their "supplier manuals".
As I have some experience in case of Japanese OEMs, I can say, that Honda has CSR related to e.g. control plan, PFMEA, process design planning and monitoring and it is supplier's duty to address them within own quality management system and internal auditors to verify its implementation.

John C. Abnet said:

Good day @Bran ;
For example, Honda has specific requirements unique to Honda. While these CAN be included in an internal organizational matrix/document, they are not "Customer Specific Requirements" as defined by the IATF 16949 standard. There are two reasons for this....
1- Honda (as an example) is not an IATF participant.
2- The definition per IATF 16949 = "Interpretations of or supplemental requirements linked to a specific clause(s) of this Automotive QMS Standard".

Click to expand...

Is it stated anywhere that a customer must be an IATF member in order for their requirements document to be a CSR? The Visteon customer requirements document comes to mind as one that links to specific IATF clauses, yet they are not an IATF member (actually, about 95% of their document is copied from Ford CSR if I'm remembering correctly). I had to build this one into my matrix because it meets the IATF definition for CSR.

Sebastian said:

Second one is "read and match", where customer creates own requirements in form of manual, where sections titles or even content are not referring any of standard's clauses. Supplier job is match them with standard's clauses according to their content.

Click to expand...

We know from FAQ #8 that suppliers do not need "convert" customers' supplier manuals into CSRs that match up with the IATF clauses. What I am still unclear on is around having to build these "read and match" supplier requirements into the scope of a QMS. IATF cl. 4.3.2 appears to be black and white that only CSR need to be addressed within the QMS. From this, I think it's very nice that Honda has a 100+ page supplier document, but I'm not seeing anywhere that is forcing me to do anything with it from the "address these requirements within the QMS" perspective, other than where the wording « if required by the customer » exists ?

--

My questions come from the perspective of a supplier that has over 80 automotive customers (per the IATF rules definition for "automotive"), some with IATF CSR, some with documents titled "customer specific requirements" from customers that are not IATF members, some with supplier manuals, ...really everything. I get heavily questioned on these things seemingly during every audit, and it would be nice to have more of a definitive answer on in-scope vs out of scope when it comes to what needs addressed within the QMS.

Bran said:

Is it stated anywhere that a customer must be an IATF member in order for their requirements document to be a CSR? This would help out tremendously. The Visteon customer requirements document comes to mind as one that links to specific IATF clauses, yet they are not an IATF member (actually, about 95% of their document is copied from Ford CSR if I'm remembering correctly).


We know from FAQ #8 that suppliers do not need "convert" customers' supplier manuals into CSRs that match up with the IATF clauses. What I am still unclear on is around having to build these "read and match" supplier requirements into the scope of a QMS. IATF cl. 4.3.2 appears to be black and white that only CSR need to be addressed within the QMS. From this, I think it's very nice that Honda has a 100+ page supplier document, but I'm not seeing anywhere that is forcing me to do anything with it from the "address these requirements within the QMS" perspective?

--

My questions come from the perspective of a supplier that has over 80 automotive customers (per the IATF rules definition for "automotive"), some with IATF CSR, some with documents titled "customer specific requirements" from customers that are not IATF members, some with supplier manuals, ...really everything. I get heavily questioned on these things seemingly during every audit, and it would be nice to have more of a definitive answer on in-scope vs out of scope when it comes to what needs addressed within the QMS.

Click to expand...

So what we do in these cases is just put a note in the specific procedure to refer to the CSR. For example, a lot of customers have their own quirks regarding PPAP, forms and such. So in our PPAP procedure, we would just say "for customer xyz confirm process with their latest CSR."

Bran said:

We know from FAQ #8 that suppliers do not need "convert" customers' supplier manuals into CSRs that match up with the IATF clauses.

Click to expand...

I took a look on FAQ#8 again. It is up to organization what document would be created as evidence that any of customer's documents, which due to content shall be treated as CSR was identified and addressed within organization's QMS. For any of direct customers. There is "are not expected...", but not "must not". Do what you want, but if there is no better option "convert them into CSR format ...". It is one of possible solutions., but not the only one.

Bran said:

What I am still unclear on is around having to build these "read and match" supplier requirements into the scope of a QMS. IATF cl. 4.3.2 appears to be black and white that only CSR need to be addressed within the QMS. From this, I think it's very nice that Honda has a 100+ page supplier document, but I'm not seeing anywhere that is forcing me to do anything with it from the "address these requirements within the QMS" perspective, other than where the wording « if required by the customer » exists ?

Click to expand...

You are forced by 4.3.2 and definition of CSR in 3.1.
Example - your direct supplier is Honda. In Supplier Manual there is section called Process Quality Control Table. One of process design process outputs is control plan. AIAG Control Plan format was used for this purpose in case one of parts supplied to Honda. As long there is no agreement made with Honda stating that alternative format may be used, it is clear evidence that direct customer's requirements were ignored.
Honda is not "linking" (per CSR definition in 3.1) any of own requirements, e.g. PQCT to specific clause of Automotive QMS Standard, but ignoring it is not what is required by intent of requirements of section 4.3.2.

Sebastian said:

You are forced by 4.3.2 and definition of CSR in 3.1.
Example - your direct supplier is Honda. In Supplier Manual there is section called Process Quality Control Table. One of process design process outputs is control plan. AIAG Control Plan format was used for this purpose in case one of parts supplied to Honda. As long there is no agreement made with Honda stating that alternative format may be used, it is clear evidence that direct customer's requirements were ignored.
Honda is not "linking" (per CSR definition in 3.1) any of own requirements, e.g. PQCT to specific clause of Automotive QMS Standard, but ignoring it is not what is required by intent of requirements of section 4.3.2.

Click to expand...

I may be taking things too literally, but my interpretation is that the entire Honda does not become a CSR, only the specific clauses. Is this misguided?

What I have done up to this point (using Honda as an example) is below:

1. Identify which IATF clauses contain the "If required by the customer" wording. This is present in IATF clauses 8.3.4.4, 8.3.6.1, 8.5.1.1, and 8.7.1.4 - or PPAP, Product design changes after PPAP, Control Plan, and Control of Reworked Product respectively.
2. Go through the Honda document looking for anything related to these clauses only. If there is content related, these are Honda CSR that must be included on on the internal CSR Matrix document.
3. Address these items within the QMS.

I completely agree that the organization must comply with the remainder of the Honda document, but my understanding is that I do not need to show compliance specifically within the QMS.

Taking into account "if required by the customer" leads to ignoring some (maybe even most) of customer's requirements. It's a very narrow view of CSR. Definition of CSR presented in 3.1, shows a wider view of this aspect and how it should be properly addressed in my opinion, I will present on Honda example.

I do not have Honda SQM with me, nor I do not know it by heart, but if I remember it correctly, there were "...supplemental requirements linked to a specific clause(s) of this Automotive QMS Standard", as e.g. 7.5.3.2.1 (strictly defined retention timing), 8.3.3.3 (vital items, marked as Y in PFMEA) and few more.

Same applies to Toyota and also "big" Tier-1 who had established own "supplier manuals".

It is very important for internal auditors, to grasp within second this "special ingredients" of organizational QMS they work for and verify its "effective implementation" as required by 9.2.2.2. It can be not so well managed in case of 3rd party audits, as certification rules require organization per 6.5.1 h) to submit to certification body only "list of automotive customers and their customer-specific requirements". Of course there is also quality manual submitted, which shall include per 7.5.1.1 d) "a document (for example, a table, a list, or a matrix) indicating where within the organization's quality management system their customer-specific requirements are addressed.", but there are still QM, which don't comply with this requirement.

Jack Chiew said:

I just joined the group but noticed your question is over 2 years old. Not sure my input is still useful. I am a 3P auditor and have just written a book for sharing on IATF 16949 compliance. My answer to your question is attached. You can download the full book, it is free.

Click to expand...

Hi, Jack
I've just read your reply, I'm interested in getting your book, but I can't find it. Do you have a link to get chapters? This only link only let me read the chapter 6.

Jack Chiew said:

I just joined the group but noticed your question is over 2 years old. Not sure my input is still useful. I am a 3P auditor and have just written a book for sharing on IATF 16949 compliance. My answer to your question is attached. You can download the full book, it is free.

Click to expand...

Hi Jack! Thank You for offering your book for learning purposes. Could you please provide a link from where the book could be downloaded?