Audit management is planning, running and following up internal and supplier audits so that they find risk instead of filling a calendar. IATF 16949 clause 9.2.2 asks for a risk-based internal audit programme that covers the quality management system and every manufacturing process on every shift, including the shift handover, within a three-year cycle, and that audits products at defined stages. ISO 19011 gives the guidance for managing the programme and conducting each audit.
Zometric starts from an audit universe: QMS processes, manufacturing processes, products, suppliers, software development and remote support functions. Each item gets a risk score from its open findings, its last audit result, customer complaints, High Action Priority chains in the PFMEA and recent changes. The score proposes an interval, a person confirms it with a written reason, and the audit client approves the year's programme.
Each audit then follows one lifecycle from preparation to closure. VDA 6.3 process audits and P1 potential analyses are scored by the product, and Layered Process Audits run on their own schedule of layers and areas, following the practice described in AIAG CQI-8.
Six problems audit programme managers describe in their own words — and what changes when the programme, the audits and the layered audits share one record.
Each step has its checks: 48 audit rules flag what is missing, and open errors block the step they guard.
Universe · Risk
List the processes, products, suppliers and functions to audit, with the shifts of each manufacturing process. The risk score proposes an interval of 3, 6, 12 or 36 months; a person confirms it with a reason of at least 20 characters.
Programme · Approval
Propose the plan, and Zometric adds an audit for every item that is due or missing in the cycle, with the missing shifts and the handover. The audit client approves it, and the approved programme is kept as a numbered revision.
Preparation
Set objectives, scope, method and catalogue, and choose the VDA 6.3 elements. The lead auditor's eligibility is checked, and a manufacturing process audit records the released PFMEA and Control Plan revisions in force.
Fieldwork
The opening meeting starts the audit. Every finding needs a criterion, evidence and, for a nonconformity, a grading rationale; three questions propose major or minor. An immediate risk notifies the auditee representative and the audit client at once.
Report
The closing meeting sets the report due date, 14 days later by default. Issuing the report stores the VDA 6.3 results, opens the nonconformities with their due dates, closes observations and good practices, and freezes the report as a numbered revision.
Response · CAPA
The response owner answers with containment, root cause, an action plan and similar processes checked, plus a correction for a minor. A nonconformity can open its CAPA instead, and the finding then follows the CAPA's progress.
Verification
Someone other than the response owner verifies completion, which schedules the effectiveness check 90 days later by default. If the action was not effective, the finding returns to work, and a minor nonconformity against the corrective-action process is drafted or put to the programme manager.
Layered audits
Supervisors, area managers and plant management get their slots in a rolling schedule. They answer a short check sheet on a phone, and every “No” is followed up, notified and, if it repeats, escalated to a CAPA.
Each capability is tied to a decision your team is already trying to make.
List everything that can be audited — processes, areas, suppliers, shifts — and let risk set the frequency: open findings, the last audit result, complaints. The programme shows coverage at a glance, including the shifts nobody has audited yet.
One lifecycle from planning through fieldwork, report and follow-up to closure. Scope, audit team, checklist, evidence and report on one record, with the report issued as a frozen, numbered version.
Answer the questions and the result is computed for you — element scores, overall compliance, the downgrading rules and the final A / B / C classification, including the potential analysis. Load your licensed questionnaire once and use it on every audit.
A grading assistant proposes the severity, due dates are set when the report is issued, and a finding can open its CAPA directly. Implementation and effectiveness are verified as separate decisions — and the finding closes only when its CAPA does.
Auditor qualifications and evaluations on record, with team eligibility checked as you assign people — so the audit a customer later questions was demonstrably run by a qualified, independent auditor.
Layers, areas, schedules and a question bank that can be generated from the Control Plan. Auditors answer on a phone — offline if the signal drops — and every "No" records what was seen and the action taken, with a photo if needed. A repeated "No" escalates to a CAPA.
Second-party audits of suppliers, who answer their findings through the Supplier Portal. Completion rates, the Pareto of LPA "No" answers and programme effectiveness are ready for the management review without a week of slide-building.
Each question scores 0, 4, 6, 8 or 10. An element's result is its points as a share of the points possible, the overall result pools every audited question, and the class follows: A from 90 %, B from 80 %, otherwise C. Downgrading rules then cap the class, so a high score alone does not guarantee an A.
| Element | Questions | Points | Possible | Result % | Check |
|---|---|---|---|---|---|
| P5 Supplier management | Questions7 | Points66 | Possible70 | Result %94 | CheckNo rule triggered |
| P6 Production process analysis | Questions26 | Points228 | Possible260 | Result %88 | CheckStar question P6.2.3 scored 4 |
| P7 Customer care, satisfaction and service | Questions5 | Points48 | Possible50 | Result %96 | CheckNo rule triggered |
| EG(P5P6P7) overall | Questions38 | Points342 | Possible380 | Result %90 | CheckA by score, capped at B |
Audits read risk from the engineering documents and hand their problems to CAPA, so nothing is retyped between modules.
A nonconformity opens one CAPA, due on the finding's dates. CAPA progress moves the finding, and its effectiveness is confirmed only after the CAPA closes. A repeated LPA “No” opens a CAPA too, and a CAPA's prevention step can create a draft LPA question.
LPA questions are generated as drafts from the rows of a released Control Plan, with its reaction plan. Process audits record the Control Plan revision in force, and the Control Plan's station view lists the LPA questions for that station.
High Action Priority chains at a process step raise its audit risk, and process audits record the released PFMEA revision. LPA questions can name a PFMEA cause or control as their source.
Complaints of the last 12 months raise an item's risk score and open frequency reviews. The LPA programme lists recent complaints in its areas that no LPA question covers yet.
Universe items, LPA areas and VDA 6.3 process steps are linked to Process Flow operations, so findings and CAPAs carry the right project and step.
Suppliers answer second-party audit findings from a secure link. The answer arrives as a submitted response, and the auditor accepts or rejects it.
Maintains the universe, the programme and the auditor records, issues reports and manages findings. Quality managers have the same rights.
Approves the audit programme or sends it back with a comment. Only the audit client named on the programme can approve it.
Prepare and conduct the audit, record answers, evidence and findings, and verify responses — never a finding they own themselves.
See their audit, acknowledge or dispute findings, and submit the response for the findings they own.
Run the layered audit programme and its follow-up actions. Area owners manage their own area, and overdue follow-ups escalate to the process owner.
Perform the LPAs scheduled for them, including slots they take over as a substitute. Supplemental, visitor and practice LPAs are open to others when the programme allows them.
| Zometric Audit Management vs paper checklists and a spreadsheet | Paper checklists and a spreadsheet | Zometric Audit Management |
|---|---|---|
| Audit frequency | Set by habit, rarely revisited | Proposed from a risk score, confirmed with a reason, reopened by complaints and changes |
| Shift coverage | Not tracked per shift | Every shift and the handover shown as covered, planned or missing in the three-year cycle |
| VDA 6.3 class | Formulas in a workbook, downgrading applied by hand | Computed with the downgrading rules, the two-thirds rule and P1 classification |
| Auditor eligibility | A separate qualification matrix | Checked when a person is assigned: qualification, experience, VDA 6.3 exam, independence |
| Finding deadlines | Typed into the report | Set from the closing meeting when the report is issued, with overdue flags |
| Closure | Closed when the answer arrives | Completion and effectiveness verified separately; a finding with a CAPA waits for the CAPA |
| Layered audits | Paper sheets typed up at the end of the week | Answered on a phone, offline if needed; a repeated “No” escalates to a CAPA |
| Checks | None | 48 audit rules and 20 LPA rules; errors block the step they guard |
Export the programme to Excel: the month-by-month plan per universe item, cycle coverage with shift gaps, programme effectiveness, and risks and opportunities.
The issued report with a print layout, and Excel workbooks of the report and findings and of the VDA 6.3 result matrix, including the P6 question-by-step matrix and the P1 summary.
Paste your licensed question texts and minimum requirements from Excel into the seeded VDA 6.3 structure. Codes that do not match are reported, never created.
Export LPA results to Excel — completion by layer, conformance by area, a Pareto of “No” answers and every “No” with its action — and the weekly check sheet of an area.
Audits, their status transitions, answers, findings and results, and layered audits — start, answer, complete and KPIs — are available through the REST API.
Straight answers to the questions teams ask before a demo.
It keeps the internal audit programme risk-based and complete. Zometric lists every process, product, supplier and function to audit, proposes each interval from a risk score, shows which shifts and shift handovers are covered in the three-year cycle, and follows every nonconformity from the report to verified effectiveness, so the programme can be shown to a certification auditor as one record.
Each universe item gets a risk score from open findings, its last audit result, customer complaints, High Action Priority PFMEA chains, recent changes and an ineffective CAPA. By default, 0–2 points is low risk (36 months), 3–6 medium (12), 7–11 high (6) and 12 or more very high (3 months). A low-risk item that is not fully compliant gets the medium interval, and a person confirms every interval with a written reason.
Each question scores 0, 4, 6, 8 or 10 points. Zometric computes the element, P6 sub-element, process-step and overall percentages, classifies A from 90 %, B from 80 % and C below, then applies the downgrading rules: an element or step below 70 % or a star question scored 0 caps the class at C; an element between 70 % and 80 %, a sub-element below 80 %, a star question scored 4 or any question scored 0 caps it at B.
No. Zometric ships the VDA 6.3 (2023) structure — elements P2 to P7, 59 questions, 18 star questions and the P1 potential-analysis set — with short labels only. You load your licensed question texts and minimum requirements once by pasting them from Excel, and every audit then uses them.
Due dates count from the closing meeting and are set when the report is issued. By default, a major nonconformity needs its first response in 15 days, the full response in 60 days and verification in 90 days; a minor nonconformity needs its response in 60 days. A customer's own response times or the audit type can replace these defaults.
A nonconformity closes only after two separate decisions by someone other than its response owner: completion verified, then effectiveness verified, by default 90 days later. If the finding opened a CAPA, effectiveness can be confirmed only after the CAPA is closed. Observations and good practices close when the report is issued.
Layers such as supervisors, area managers and plant management are scheduled across areas and shifts. Auditors answer Yes, No or N/A on a phone, and answers are kept on the device if the connection drops. A “No” needs a comment and the action taken; a repeated “No” on the same question in the area within 30 days escalates to a CAPA by default.
Yes. For a second-party audit, a supplier answers each nonconformity through the Supplier Portal with containment, root cause, a corrective action plan and the similar processes checked. The answer arrives as a submitted response, and the auditor accepts or rejects it with a reason before the finding moves on.
A 30-minute discovery call. A 2–3 week pilot on real factory data. Then scale at your pace.
