IATF16949 Practical Application (25) | Internal Auditor Competence and Witnessed Audits: Four-Dimensional Competency Matrix, Three-Level Qualification Criteria, and 100-Point Scoring Form
On the third day of the external audit, the auditor flipped to the internal audit records and pointed to one, asking the accompanying system engineer: Who audited this 8.5.1? The answer was: Zhang, from the Process Department. The auditor then asked: What did he base his judgment on that the on-site operations were consistent with the work instruction? Can we retrieve his audit notes and sampling records from the system? The reply was, "He signed the record form, which indicates he has audited it." The auditor then requested proof of the internal auditor's qualifications, and the company provided a 2021 training sign-in sheet and a screenshot of an internal network exam score.
The nonconformity was identified under 9.2.2.3: The organization should maintain a list of qualified internal auditors, who should possess the corresponding competencies in the automotive industry process approach, customer-specific requirements, core tools, and the product and process knowledge of the audited scope. However, the company could only provide evidence that the person had "attended training," with no proof that they could actually identify issues on-site.
The root of such problems does not lie in whether the internal audit system is well-written, but in treating "training" as "competence" and "lists" as "qualifications." This article breaks down the internal auditor's competence into four directly applicable tables: the four-dimensional competency matrix, three-level qualification criteria and permissions, a 100-point witnessed audit scoring form, and annual maintenance and revocation rules.
1. The Clause Requires Verifiable Competence, Not Just a Sign-In Sheet
The requirements of 9.2.2.3 can be summarized into six blocks, each of which must have corresponding evidence. If any block is missing, the auditor will question it:
| Competency Element | Specific Requirement | Evidence Carrier | Common Shortcomings |
|---|---|---|---|
| Understanding of System Requirements | Familiar with ISO 9001 and IATF 16949 clauses, able to judge "conformity/nonconformity" | Written test scores + clause judgment practice papers | Only training hours, no judgment practice |
| Automotive Industry Process Method | Able to use the turtle diagram to break down processes, identify interfaces and risks, rather than checking documents clause by clause | A complete process audit trail (sampling path) | Audit trail is just a list of clauses with checkmarks |
| Customer-Specific Requirements | Knows which CSR applies to the company and which processes they affect | CSR comparison list + audit questioning form | Internal audits never check CSR |
| Core Tools | Able to read and question APQP/PPAP/FMEA/MSA/SPC, not just check if they are done | Case judgment questions (find the failure chain breakpoint in a PFMEA) | Only asks "whether it is done" |
| Product and Process Technology | Knows the key characteristics and main measuring tools of the current process | Position technical knowledge assessment + on-site questioning record | Audits unfamiliar workshops by just looking at documents |
| Audit Skills | Questioning, listening, sampling, evidence fixation, nonconformity statement | Witnessed audit scoring form | No witnessing, no evaluation of on-site performance |
The first five blocks can be addressed through training and assessment, while the sixth block can only be resolved by "someone observing them conduct an audit on-site." The sole reason for the existence of witnessed audits is that this block cannot be proven through a written test.
2. Four-Dimensional Competency Matrix: Writing "Competence" as Observable Behaviors
The value of the matrix lies in making "whether this person is qualified" a checkable judgment, rather than a subjective impression from a supervisor. Each dimension is divided into three levels, and the descriptions must be observable behaviors on-site, avoiding vague terms like "familiar" or "understand."
| Dimension | L1 Trainee (Following) | L2 Internal Auditor (Independent) | L3 Lead Auditor (Leading) |
|---|---|---|---|
| A Clauses and System | Can find which company document corresponds to a clause | Can explain the applicable clauses and any missing clauses for any process and provide a judgment | Can judge conflicts between clauses and the validity of the company's tailoring |
| B Process Method and Risk | Can fill out the six boxes of the turtle diagram template | Can independently draw the turtle diagram for the audited process, point out more than two interface risks, and trace them to evidence | Can identify systemic failures from multiple process interfaces and judge the effectiveness of risk control |
| C Product and Process Technology | Knows the key characteristics and main measuring tools of the current process | Can ask questions about parameters, capability, and measuring tools for key characteristics | Can audit design outputs (8.3) and second-party audits, judging the rationality of technical solutions |
| D Audit Execution | Can record, organize evidence, and clearly state facts | Can independently conduct a single-process audit, issue general nonconformities, and write sections of the audit report | Can serve as the audit team leader, compile the annual audit plan, determine major nonconformities, witness others, and sign off on internal audit reports |
The judgment rule must be clear: A person is considered to have reached a level if they have independently completed the highest behavior in that dimension at least three times. For example, "B dimension L2" means this person has independently drawn the turtle diagram and traced interface risk evidence in at least three audits, and these audit trails are archived and retrievable. Upgrading based on a single good performance is the most common source of distortion in the competency matrix.
The matrix is updated every six months; a new row is added for new products, new processes, or new process introductions, without waiting for the six-month period.
3. Three-Level Qualification: What Each Level Can and Cannot Do
Qualification is not just about "whether they can audit," but also "whether they can sign off and determine nonconformities." If the boundaries of authority are not clearly defined, it can lead to situations where trainee auditors issue nonconformities independently, and the audited department does not recognize them on the spot.
| Item | L1 Trainee Auditor | L2 Internal Auditor | L3 Lead Auditor |
|---|---|---|---|
| Entry Conditions | 16 hours of system and core tools training; written test ≥80 points; accompanied audits ≥2 times and cumulative ≥2 person-days | L1 for 6 months; independent audits ≥3 times; covers ≥2 process categories (COP/SP/MP); witnessed audit ≥80 points | L2 for 12 months; leads teams ≥2 times; covers three process categories; witnessed ≥90 points; completes 8.3 and second-party audit specialized training |
| Independent Responsibilities | Accompanied record-keeping, evidence organization, initial screening of clause evidence | Single-process audit, clause conformity judgment, issuance of general nonconformities, section writing of audit reports | Serve as audit team leader, compile annual audit plan, determine major nonconformities, witness others, sign off on internal audit reports |
| Explicit Prohibitions | Independent signing, independent nonconformity judgment, independent participation in closing meetings | Leading team audits, auditing 8.3 design and development (requires specialized authorization), determining major nonconformities | Auditing processes they are directly responsible for (avoidance) |
| Authorization Validity | 12 months | 24 months | 36 months |
Three easily overlooked boundaries:
Avoidance Rule. L3 cannot audit processes they are responsible for. It is a common technical scenario that a system engineer both compiles system documents and audits their implementation, leading to a natural bias. When scheduling audit teams, use "the auditor's direct responsibility for the process" as a hard filter condition.
Special Authorization for 8.3. Design and development audits require the highest level of technical judgment. Even if an L2 auditor has a high overall score, they must complete a specialized 8.3 training and a DFMEA judgment exercise to join the design audit team. Otherwise, design audits may degrade into "checking if there is a DFMEA document."
Additional Qualifications for Second-Party Audits. 8.4.2.4.1 requires the organization to determine the capability criteria for supplier auditors. Internal auditors conducting second-party audits must, in addition to the four dimensions, possess: knowledge of the process for the category, ability to judge supplier process capability, and ability to interpret quality agreements and PPAP status. Do not use the internal auditor list directly as the second-party auditor list.
4. Witnessed Audit: A 90-Minute On-Site Sampling
A witnessed audit is not just "following around for a tour"; it has clear sampling targets, observation points, and outputs.
Who Conducts the Witnessing. Preferably, the company's L3 lead auditor, who has no direct responsibility for the audited process. If there is no suitable candidate, external resources (certification body auditors, customer SQE, external consultants) can be used, but the same auditor should not be witnessed by the same witness more than three consecutive times to avoid solidifying the witnessing relationship.
What is Witnessed. A complete single-process audit, from document review to the closing meeting, typically takes 90 to 120 minutes. The witness only does three things: record behaviors, score according to the scoring form, and provide written feedback within 5 working days after the audit. The witness must not ask questions on behalf of the auditor or take over the audit midway.
Mandatory Fields in the Witnessing Record Form:
| Field | Description |
|---|---|
| Audited Process and Clauses | Process name, turtle diagram number, list of covered clauses |
| Audit Trail | Sampling objects, sampling path (from which record to which record) |
| Key Question List | At least 8 questions, marked as open-ended or closed-ended |
| Evidence Number | Record number and photo number corresponding to each judgment |
| Nonconformity Draft | Whether the three segments of facts, criteria, and gaps are complete |
| Scoring Details | Scores and reasons for deductions in six dimensions |
| Conclusion and Follow-Up | Pass/fail, re-audit deadline, improvement items |
Frequency Requirements. L1 must be witnessed at least once before upgrading to L2; L2 and L3 must be witnessed at least once per year, with no more than 24 months between two consecutive witnessed audits. The scheduling of witnessed audits should be done alongside the annual internal audit plan, not on an ad-hoc basis.
5. 100-Point Scoring Form: Six Dimensions and Deduction Details
The scoring form serves to provide a common language for "whether the audit was conducted well." The six dimensions total 100 points, and the passing line is total score ≥80 and no dimension score below 60% of its value.
| Dimension | Points | Excellent (Full Score) Performance | Typical Deduction Points |
|---|---|---|---|
| 1 Audit Preparation | 15 | Completes document review in advance, lists clause mappings and evidence to be checked, and pre-designs the audit trail | Flips through documents upon arrival: deduct 5-8 points; missing clause mappings: deduct 3 points; no checklist: deduct 4 points |
| 2 Opening Meeting and Scope | Clearly explains the purpose, scope, criteria, and schedule, confirms process interfaces and accompanying personnel | Fails to explain scope boundaries: deduct 3 points; fails to confirm interfaces: deduct 3 points; exceeds 10 minutes: deduct 2 points | |
| 3 Application of Process Method | Uses the six boxes of the turtle diagram to advance, identifies more than two interface risks and traces them to performance data | Asks questions clause by clause: deduct 8-12 points; only checks documents without on-site observation: deduct 6 points; does not touch performance indicators: deduct 5 points | |
| 4 Sampling and Evidence | Explains sampling logic (shifts/cavities/batches/time span), evidence is traceable to record numbers | Sampling lacks logic: deduct 8 points; samples concentrated in one shift: deduct 5 points; evidence lacks numbers: deduct 6 points | |
| 5 Nonconformity Judgment and Statement | All three segments of facts, criteria, and gaps are complete, can distinguish between general and major nonconformities | Missing criteria references: deduct 5 points; writes opinions as nonconformities: deduct 4 points; incorrect grading: deduct 6 points | |
| 6 Closing Meeting and Communication | Clear conclusions, clear rectification requirements and deadlines, records disputes on the spot | Ambiguous conclusions: deduct 4 points; no deadlines: deduct 3 points; disputes not recorded: deduct 3 points |
Three Immediate Failures (disqualify without considering the total score):
- Makes a judgment but cannot provide evidence, or the evidence cannot be traced to specific records;
- Nonconformity statement lacks the "criteria" segment, only stating "on-site operations did not meet requirements";
- Uses the audited party's conclusions instead of their own observations (judges conformity based on reports).
Accompanying Feedback Deadline: Scores and written feedback must be provided within 5 working days after witnessing; if the auditor fails, they must undergo another witnessed audit within 30 days. If they fail again, they are demoted one level and cannot independently sign off during the demotion period.
6. Annual Maintenance and Revocation: Three Red Lines and Demotion Process
Qualification is not a lifetime status. If a person on the list has not conducted an audit for two years, the clause requirement to "maintain a list of qualified internal auditors" is no longer met.
Maintenance Conditions (verified every 12 months):
| Item | Threshold |
|---|---|
| Complete Audit Times | ≥2 times, cumulative ≥4 person-days |
| Witnessed Audit | At least 1 time and ≥80 points (interval no more than 24 months) |
| Number of Processes Covered | ≥2 categories (L3 must cover COP/SP/MP three categories) |
| Clause Coverage | At least touches one core clause within their authorized scope (e.g., L2's 8.5.1/8.6/9.1.1) |
Three Revocation Red Lines:
- Competence Red Line: Two consecutive witnessed audits score below 80 points, or a single audit scores below 60 points;
- Omission Red Line: The responsible clauses are found nonconforming in third-party or customer audits, while their internal audit records judge "conformity" without reasonable explanation;
- Integrity Red Line: Accepts meals or gifts from the audited party, helps the audited party organize or supplement evidence, or conceals discovered nonconformities.
The first red line leads to demotion (L2 to L1, L3 to L2). After demotion, the auditor can apply for restoration if they complete two qualified witnessed audits within 6 months. The second red line requires re-evaluation of the clause authorization scope, and they cannot audit similar processes until re-evaluated. The third red line results in immediate revocation, and they cannot reapply for 12 months.
Mandatory Fields in the Annual Ledger: Name, department, current level, authorized clause scope, number of audits and person-days in the current year, date and score of the most recent witnessed audit, next verification date, status (valid/suspended/demoted/revoked). This ledger is the "list of qualified internal auditors" required by 9.2.2.3. If the list lacks these fields, the auditor can easily see that it is a shell.
7. Implementation Points and Common Errors
Implementation Points
- Define the behavior descriptions in the competency matrix before setting the qualification entry criteria; reversing the order will result in unverifiable conditions.
- Schedule witnessed audits in the annual internal audit plan and issue them in batches with audit projects; do not grab people on the spot.
- Attach the audit trail (sampling path) to each internal audit report; this serves as evidence of competence and a basis for self-checking when omissions occur.
- Keep the qualification ledger and training records separate: training records prove hours, while witnessing and audit records prove competence.
- Maintain a separate list for second-party auditors, do not derive it directly from the internal auditor list.
Common Errors
| Error | Consequence | Correct Approach |
|---|---|---|
| Using the training sign-in sheet as a qualification proof | Direct nonconformity under 9.2.2.3 | Qualification = training + written test + audit times + witnessed score, all four must be complete |
| Internal auditor list only includes names and departments | Unable to prove "maintaining qualification" | The ledger must include authorization scope, audit person-days, witnessed score, and validity period |
| Witnessed audit conducted by the auditor's supervisor | Biased conclusions, losing the meaning of witnessing | The witness must have no direct responsibility for the audited process |
| Trainee auditor independently issues nonconformities | Audited department does not recognize, disputes cannot be resolved | L1 can only record and organize, signing and judgment are the responsibility of L2/L3 |
| Audits only once a year, not the rest of the time | Unnoticed competence degradation, maintenance conditions not met | Each person must conduct ≥2 complete audits per year, evenly distributed across four quarters |
| Witnessed scoring only considers the total score | Serious deficiencies in individual dimensions are masked by the average score | Total score ≥80 and each dimension ≥60%, three hard failures result in immediate disqualification |
| Audits the documents they compiled | Systematic bias, highest risk of omissions | When scheduling audit teams, enforce avoidance for the processes they are responsible for |
The issue of internal auditor competence, in essence, is a chain of evidence: training proves they have learned, written tests prove they understand, audit trails prove they can audit, witnessed scoring proves they audit correctly, and the annual ledger proves they remain on this path. If any link in the chain is only "supposed to have" but lacks records, the clause is not considered met. Conversely, solidifying these five elements can truly make internal audits a substitute for some external audit preparations, rather than just a yearly performance.
Internal auditor qualifications depend on witnessed scoring, not just sign-in sheets
Knowledge code: 2.1.2
Version: v20261009
Author: QTank QTank is dedicated to providing systematic professional knowledge, methodologies, and practical tools for quality management practitioners, helping companies continuously improve their quality capabilities.