QM Management Depth (23) | Management Mechanism for Customer Special Requirements (CSR)

1. A List on the Client Audit Table That No One Can Match

A certain automotive parts company, with an annual revenue of 960 million yuan, is a Tier 1 supplier. It has 17 major clients, of which business from three original equipment manufacturers (OEMs) accounts for 61% of its revenue. The quality department has 18 employees, with no dedicated position for system or customer requirement management.

During the 2025 annual process audit, the auditor asked a straightforward question in the meeting room: In the "Supplier Special Requirements" document your company received, the requirement in section 4.7 is to conduct 100% online inspection of key characteristics and retain the data for 12 months. Which procedure document and record form does this correspond to? The meeting room was silent for several seconds. The system engineer said the document was on the shared drive, the Supplier Quality Engineer (SQE) said it could be downloaded from the client system, and the project manager said this version was provided when the contract was signed last year. No one could clearly state whether this document was the latest version, which requirements were already being implemented, and which had not yet been implemented.

The audit conclusion was one major nonconformity, with evidence of corrective action required within 60 days. Even more painful was another incident: a month later, another client picked out a batch of products worth 3.2 million yuan from the production line due to inconsistencies in the packaging label format with the client's latest requirements. These requirements were released three months ago through the supplier portal, but the company did not receive them, and no one checked. It took six days to rework the products, and the PPAP had to be resubmitted.

After the incident, an inventory was taken: out of the 17 clients, only 6 had formal CSR document ledgers. In the past 12 months, 5 clients had confirmed CSR updates, but the company could only provide update records for 2 of them. The problem is not a lack of diligence, but the absence of a single person responsible for the "client requirements ledger."

2. Judgment Framework: Three Misjudgments and One Main Thread

Misjudgment One: Treating CSR as "a few documents provided by the client." CSR is not a set of documents but a collection of requirements scattered across six or seven places: framework contracts and technical agreements, client supplier manuals, client portals or supplier systems, project launch and PPAP materials, client emails and temporary change notices, client audit reports, and on-site verbal clarifications. Simply creating a "client requirements" folder on the shared drive is like putting the ledger in an invisible drawer—files are there, but the version, responsible person, and implementation status are all unclear.

Misjudgment Two: Pushing CSR Interpretation to Sales or Projects, While the Quality Department Only Manages System Documents.

Sales focus on securing orders, and projects focus on milestones. Only the quality department has a cross-process perspective, methods for managing documents and evidence chains, and the ability to judge the consequences of unimplemented requirements. A reasonable division of labor is not for the QM to handle everything alone but: QM is the maintainer of the CSR ledger and the mapping relationship, while each business department is responsible for implementing their respective requirements. Without this single point of responsibility, CSR will always be "everyone's responsibility, but no one is actually in charge."

Misjudgment Three: Treating CSR as a One-Time Interpretation Action, Not a Continuous Stream of Changes.

Most clients update their CSRs several times a year, and the update paths are highly inconsistent: some send emails, some only post new versions on the portal, some verbally propose changes during annual audits, and some write them into temporary change notices. The most common pitfall for companies is not "not understanding the requirements," but "requirements changed, and we didn't know." Therefore, the true focus of CSR management is change tracking, with reading being a byproduct.

Main Thread: The Object of CSR Management is a "Requirements—Files—Evidence—Change" Mapping Network.

To determine whether a company's CSR management is effective, it is not about how neatly the file cabinets are organized, but whether the following question can be answered: For any special requirement in the client's directory, which internal document does it correspond to, who is responsible for its implementation, where is the evidence, when was the last change, and how was it confirmed? If the answer is clear, the mechanism is in place; if not, CSR is just a few PDFs lying on the drive.

3. Implementation Actions: Five Steps

Step One: Establish a CSR Ledger and Appoint a Single Maintainer. For each client, list the CSR document name and current version, effective date, acquisition channel (portal/email/contract annex/audit report), interpretation status, implementation status, responsible person, and the most recent update record. The maintenance responsibility must be assigned to a specific position (system engineer or a person designated by QM), not the "quality department as a whole." Criteria: 100% of active clients are documented; routine updates every two months; each client has at least one official acquisition channel that is traceable in the ledger.

Step Two: Create a Mapping Matrix from CSR to Internal Files, Identify Gaps. Map each client requirement to procedure documents, work instructions, control plans, and inspection specifications, and note the storage location and generator of the evidence (records/reports). The value of this step is not in the beauty of the table but in exposing items where client requirements lack internal documentation—most companies find a batch of requirements that everyone knows should be implemented but for which there are no documents or signatures. Criteria: Each CSR can be traced to a file and record; items without corresponding files are 100% listed as gaps, with clear handling methods and completion timelines.

Step Three: Integrate CSR Changes into the Change Control Process, Forming a "Client Confirmation" Loop. Create a CSR change tracking form. All updates obtained from any channel must be interpreted and the impact assessed within 5 working days, and internal impact notifications must be issued. Any changes involving internal documents, processes, suppliers, or label packaging must follow the formal change process. Any changes requiring written client confirmation must be confirmed before implementation. Criteria: The change form has a CSR impact confirmation section that requires mandatory signing; changes without completed impact assessments are not released; changes requiring client confirmation have written records of communication.

Step Four: Define Interfaces and Conflict Resolution Mechanisms. Draw a responsibility division chart: who is responsible for portal and email subscriptions, who leads the interpretation, who executes internal implementation, who communicates supply chain requirements, and who interfaces with clients. A conflict resolution mechanism must also be established: what to do when client requirements are stricter than company standards or when internal standards conflict. It is recommended to formalize this—QM proposes a conflict list (including impact and cost), and a cross-departmental meeting makes the decision, which is then recorded in writing and updated in the mapping matrix. Criteria: The responsibility division chart is issued to departments; conflicts have written decision records, not based on personal judgment, and no old accounts are revisited.

Step Five: Incorporate CSR Implementation into Internal Audits and Client Audit Preparation. Add a fixed item to the annual internal audit checklist: "sample 5-8 CSR items, trace back to files and evidence." Conduct a CSR self-assessment 30 days before the client audit (ledger completeness, gap closure rate, change records, and closure of the last nonconformity). Criteria: CSR is always checked during internal audits with sampling records; self-assessment reports are submitted to management before the audit; historical nonconformities are closed on schedule at a rate of 100%.

4. Case Development: Half a Person's Effort for Three Accounts

The QM did not write the corrective action as an apology report. He spent three weeks creating a ledger—17 clients, 212 CSR requirements. After mapping each requirement, he found that 47 requirements had no corresponding internal documents, 9 of which directly related to client on-site selection and PPAP approval conditions. He sent this matrix with the corrective action report to the client SQE for early confirmation and calculated three accounts: the risk of client downgrading due to major nonconformities (the client accounts for 23% of revenue), the rework and resubmission costs for the 3.2 million yuan products, and the potential impact of unimplemented requirements on the next on-site selection.

With these three pages, he secured two things: 0.5 FTE for a system engineer (part-time) and an annual budget of 80,000 yuan for client portal subscriptions and translation fees. In terms of authorization, he obtained a clear rule: all official client requirement channels are uniformly subscribed to and inspected by the quality department, and any client requirements received by business departments must be copied to the quality department.

12 months later, the report card: the ledger covers 17 clients; during this period, there were 19 CSR updates, all of which were interpreted and mapped back; 45 out of 47 gaps were closed, with 2 closed through written client clarifications; major nonconformities were closed on schedule, and the next two client audits had zero CSR-related nonconformities; on-site client selections due to unimplemented label and packaging requirements decreased from 3 to 0; the PPAP first-time pass rate increased from 72% to 91%.

The costs were also real. The first cost was horizontal conflicts: the engineering department complained that "your interpretation is stricter than the client's, treating everything as mandatory requirements even when the client didn't specify." QM adopted a three-color marking system (mandatory/conditional/referential), sending marked items to the client SQE for confirmation before distribution, significantly reducing disputes. The second cost was resource constraints: 0.5 FTE for interpreting and translating requirements from 17 clients was a high workload. The company was unwilling to provide a full-time position, so they relied on templates and a repository of interpretation points to reduce the cost per item—while the mechanism was established, efficiency still had a ceiling. The third and most significant cost: one client only posted CSR updates on the supplier portal without sending emails, and they missed it for five months until the client audit. The post-incident review directly led to a new rule: the client portal must be inspected weekly, with inspection screenshots archived—the cost of such errors could be a major nonconformity.

5. Self-Inspection Checklist

• All active clients have a CSR ledger, indicating the current version, effective date, official acquisition channel, responsible person, and updated every two months.
• Each CSR can be mapped to internal files and verifiable evidence, and items without corresponding files are listed as gaps with timelines and handling methods.
• All CSR updates obtained from any channel are interpreted and impact notifications are issued within 5 working days, and changes requiring client confirmation have written records.
• Conflicts between client requirements and internal standards have a written arbitration mechanism and decision records, and the responsibility division chart has been issued to departments.
• Internal audits regularly check CSR mapping and evidence, and a self-assessment is completed 30 days before the client audit, with historical nonconformities closed on schedule.

The focus of CSR management is change, not reading.

Knowledge code: 10.1.1

Version: v20261003

Author: QTank QTank is dedicated to providing systematic professional knowledge, methodologies, and practical tools for quality management practitioners, helping companies continuously improve their quality capabilities.