IATF16949 in Practice (29) | Customer Communication and Engineering Change Notification: 8.2.3.1 Communication Matrix, Notification Lead Time Parameters, and Four-Level Risk Classification for Unnotified Changes

1. Scenario: Dimensionally and Functionally Qualified, but Returned in Full by the Customer

A car parts company supplies injection-molded structural components to a Tier 1 supplier. After three years of stable production, in the spring of the fourth year, the raw material supplier notified that the PA66 grade would be discontinued. The purchasing department found an equivalent grade with similar parameters, and the incoming quality control (IQC) inspection passed all tests. The process department adjusted the mold temperature, and a trial production of 200 pieces met the dimensional and performance tolerances. An internal ECN review was conducted, and the parts were signed off and switched to mass production two days later.

Throughout this process, there were no quality incidents. However, during an annual process audit three months later, the auditor compared the PSW attachments from three years ago with the current production. When they reached the material list, they paused: the material grade on the on-site bags did not match the approved records. The auditor then asked, "When did you notify us about this material change? What is the PCN acceptance number?" After ten minutes of searching through documents in the meeting room, they found an email sent to the customer's purchasing department stating, "We will be changing the raw material grade, please be informed." There was no reply, no acceptance number, and no attached verification data.

The audit conclusion was a major nonconformity: product changes were not approved by the customer as required. The subsequent actions included resubmitting the PPAP, the customer conducting a 100% key characteristic inspection on the first 3000 pieces, the scorecard dropping from the green zone to the yellow zone, and the next surveillance audit including this item as a mandatory check.

The most poignant comment during the post-mortem came from the customer's SQE: "I acknowledge that your parts are qualified. However, since this change is not recorded in my approval records, these parts are considered unapproved in my system."

This is the practical meaning of 8.2.3.1. It is not about whether the quality is good or bad, but about whether you have communicated, to whom, and when—communication itself is a part of the system requirements and is often the easiest to be treated as a soft requirement or considered as just "giving a heads-up."

2. Seven Categories of Communication Matters and a Single Responsible Person for Each

8.2.3.1 adds three mandatory requirements to ISO 9001's 8.2.1: the organization must designate personnel capable of answering customer inquiries; the language and format of communication must meet customer requirements; the effectiveness of communication must be confirmed (including interfaces and authorities). Note the terms "designate personnel" and "confirm effectiveness"—they exclude the ambiguous state of "everyone is responsible."

Breaking down the clause into the smallest executable units results in the following matrix. The core discipline is: each category of matter can only have one primary responsible position, and another position can only be a collaborator, not a co-responsible one.

The most frequently overlooked rows in this table are the 6th and 7th. CSR updates often quietly occur in the customer portal without anyone comparing them, and scorecard deductions are not assigned, leading to the discovery of deductions that have accumulated over half a year during the review meeting. The value of this table lies in: it turns the action of "communication" into a routine task with a responsible position, a lead time, and traceability, rather than relying on someone's memory.

A practical detail that can be directly applied: create a A4-sized "Customer Communication Interface Card" for the seven categories of matters, post it on the project team wall, and clearly write the name, phone number, and customer-side contact person's name and employee number for each category. The "person capable of answering customer inquiries" required by 8.2.3.1 will be the subject of on-site questioning by the auditor according to this card.

3. Determination: Is This Change Required to Be Approved by the Customer, Notified, or Internally Decided?

Almost all nonconformities due to "unnotified changes" are not because someone intentionally concealed them, but because the change classification table is too vague. A single sentence in the document, "major changes require prior notification to the customer," leaves the production floor with no clear criteria: does changing a secondary supplier count as major? Does adjusting the mold temperature from 265°C to 270°C count? Does changing the packaging box from five-ply corrugated to seven-ply count?

Formulate the determination into three questions that anyone on the floor can ask and answer:

1. Does this change alter any of the submitted elements of the approved PPAP? (material list, sub-supplier list, process flow diagram, PFMEA, control plan, MSA, dimensional results, performance tests, appearance approval report, PSW)
2. Does it change the interface of the part with the customer? (dimensions and mating surfaces, materials and surface conditions, performance and durability, identification and traceability information, packaging and line-up methods)
3. Does the customer's CSR, technical agreement, or quality agreement explicitly state that this type of change requires notification or approval?

If any of these questions are answered "yes," the customer-side process must be followed; if all three are answered "no," it can proceed to internal review. For changes that require customer-side processes, classify them according to the following three categories:

There are two typical misuses of this classification, with completely opposite directions and different consequences.

Misuse One: Treating Category A as Category C and Hiding It. The most common excuse is "just a minor adjustment," "equivalent replacement," or "parameters are similar." During audits, if the customer compares the on-site material grade, supplier code, equipment nameplate, and PSW attachments, this excuse will not hold. Moreover, such nonconformities often lead to multiple related issues: the control plan was not updated, the FMEA was not updated, the work instruction was not updated, and four or five related items are found in one audit.

Misuse Two: Treating Category C as Category A and Reporting It. Some companies, to be "safe," report all internal control tightening and shift adjustments. The result is that the customer receives dozens of notifications each month, leading to notification fatigue. When a genuine material change notification comes, it is treated as just another routine email and buried. The value of notifications comes from their scarcity; overuse is self-defeating.

4. Notification Lead Time: A Parameter Table Based on Change Type

The lead time must be clearly defined: the lead time is the most stringent of the customer CSR, quality agreement, and internal baseline. When there is a conflict, it is not averaged or chosen based on the most lenient one.

The lead time is not arbitrarily set but calculated in reverse. The formula is:

Lead Time = Customer Approval Cycle (P) + Verification Cycle (V) + First Batch Production and Shipment Buffer (B)

Example: For a certain change, the historical average customer approval time is 45 days, and the required dimensional and performance verification plus the first batch trial production is 30 days. The shipment and delivery buffer is 15 days. Therefore, P + V + B = 90 days, and the internal baseline is set to 90 days, which is written into the change procedure as a hard threshold for this type of change. The advantage of this formula is that the customer's approval cycle can be statistically determined—by calculating the median from the "submission date" to the "approval date" of the last 20 PCNs, which is more reliable than any experience-based estimate.

Two lead time disciplines must be written into the procedure:

• The lead time is calculated from the customer's receipt date, not the date of our submission. If the customer does not log into the portal for three days after submission, these three days do not count towards the lead time. This is why PCNs must be submitted through the customer portal and an acceptance number must be obtained—the acceptance number is proof of the receipt date.
• Notifications must be made before implementation, not after. "Switch first, notify later" is equivalent to shipping unapproved products in the customer's system, which is more serious than late notification. There are no exceptions; the only legal path is to apply for a deviation/concession before the fact, not to explain after the fact.

5. PCN Change Notification Form: 24 Fields, Divided into Five Groups

The reasons for customer returns are highly concentrated, and 80% are not due to inaccurate content but incomplete information. The following 24-field template is designed to enable the customer to independently make an approval decision, with five groups answering five questions: what is the change, what has changed, what is affected, how is it verified and switched, and how does the customer respond?

Submitting according to this table can eliminate most returns. Conversely, the five most common reasons for customer returns are precisely the gaps in these five groups:

1. Only writing the post-change status, not the pre-change status (Field 7 is empty). The customer cannot judge the extent and will return it.
2. No new and old comparison photos or data (Fields 18 and 19). Especially for appearance parts and assembly interfaces, textual descriptions are never enough.
3. Writing "resubmit all" for affected PPAP elements (Field 12). The customer wants precise elements; a vague answer indicates that you have not conducted an impact analysis.
4. Only writing work-in-progress for the scope of impact (Field 11). The customer is most concerned about the batch already shipped to their line-side and your consignment warehouse.
5. Writing "enhanced inspection" for the first batch isolation plan (Field 21). Without an identification method, isolation location, and conditions for release, it is not a plan.

6. Unnotified Changes: Four-Level Risk Classification and Six-Step Remediation

What to do when the change has already occurred? First, classify it, then take action. The sole basis for classification is the risk to the customer, not the degree of trouble for our side.

The standard remediation actions are six steps, and the order cannot be changed:

1. Stop—stop shipment, stop switching, stop further production. Stop the bleeding first; do not continue to release more before the cause is identified.
2. Circle—define the batch traceability range. The starting point is the batch where the change took effect, and the endpoint should be traced back to the "last batch with complete verification evidence," with all batches in between considered suspicious. This step determines the extent of the compensation.
3. Report—actively submit a PCN or deviation application. The price difference between active reporting and passive discovery is significant: the former usually results in "conditional approval + first batch enhancement," while the latter is typically "major nonconformity + resubmit PPAP + scorecard deductions + mandatory check in the next audit."
4. Verify—supplement verification. Fill in any gaps, focusing on new and old comparisons and first batch capability data; do not use "historical data has been stable" as a substitute.
5. Submit—resubmit the affected PPAP elements as per customer requirements and update the FMEA, control plan, and work instructions simultaneously.
6. Investigate—identify the root cause. The root cause of such issues almost always falls into three areas: the change classification table is too vague (unclear on the floor), CSR is not broken down to change types (unclear what this customer requires), and the contact person is not unique (everyone assumes the other will notify).

The difference between active and passive responses can be clearly illustrated in the following table:

7. Customer Response States: Handling and Switching Points for Approval, Conditional Approval, and Rejection

Many companies treat "the customer has responded" as "the customer has agreed." The mixing of these three states is the second most common issue—especially in the case of conditional approval, where the conditions are listed at the end of the email and no one takes them seriously, leading to uncompleted actions by the expiration date and the customer defaulting to revocation, making every subsequent shipment non-compliant.

The switching point must be allowed only when all four elements are met simultaneously: the customer's written approval date has arrived, the old material or parts have been depleted (or isolated and disposed of), the first batch of new parts has been identified, and the breakpoint switching form has been signed. If these four elements are not recorded on a single form and signed off, someone on the floor will inevitably "use the new material first and deal with it later."

Another often overlooked closure: approval of a change does not mean the change is complete. Within 30 days of approval, three things should be reviewed—whether the actual inspection results of the first batch match the submitted verification data, whether the control plan and work instructions have been synchronized to the workstation, and whether the old documents and materials have been cleared from the floor. If any of these three things are not done, the change will still be a nonconformity in the next audit, just under a different clause number.

8. Key Implementation Points and Common Errors

Key Implementation Points:

• First, create a card for the three questions in Section 3 and distribute it to the project, process, purchasing, and quality positions, moving the first gate of determination to the person proposing the change, rather than waiting for the ECN review meeting to ask "do we need to notify the customer?"
• Second, break down each customer's CSR into a "customer × change type" matrix, with the horizontal axis being the change type and the vertical axis being the customer, and the cells filled with "approval required / notification required / not required." This matrix is the most cost-effective table in the entire process.
• Finally, create a system form or controlled template for the 24 fields of the PCN, with mandatory fields that cannot be submitted if left blank. Fields that rely on human memory will inevitably be missed.

Common Errors:

1. Writing "notify the customer" into sales responsibilities without designating a single contact person. 8.2.3.1 explicitly requires designating personnel capable of answering inquiries; multiple interfaces equal no interface.
2. Only one sentence in the change classification: "major changes require customer notification." The floor has no way to determine, ultimately relying on personal experience, which will eventually lead to problems.
3. CSR is not broken down to change types. Each customer's PCN threshold, lead time, and submission format are different; using a single process for all customers will inevitably result in "missed notifications."
4. Calculating lead time from the date of our submission. Time when the customer does not log into the portal or open the email does not count; it must be based on the acceptance or receipt date.
5. Using email instead of portal submission. Emails do not have an acceptance number, making it impossible to prove notification after the fact.
6. PCN only writes the post-change status. Missing the pre-change status and comparison data, the customer cannot judge the extent and will return it.
7. Scope of impact omits in-transit and consignment inventory. The customer's biggest fear is "you only tell me after it has been shipped to my line-side."
8. Conditional approval not closed before expiration. The customer defaults to revocation, making every subsequent shipment non-compliant.
9. Only changing the drawing after the change, not the FMEA, control plan, and work instructions. This is the most common related nonconformity in audits, often resulting in three or four nonconformities at once.
10. Reporting internal control tightening. Once notification fatigue sets in, genuine major changes will be buried in a pile of routine emails.

Communication, often just a short line "communication with the customer" in system documents, spans sales, project, process, purchasing, and quality functions when implemented. It truly tests not the beauty of the process but whether someone, at the moment of change, raises the question: does the customer know about this? Companies that can make this a reflex will no longer treat 8.2.3.1 as a last-minute explanation.

Changes are not scary; what is scary is the customer not knowing.

Knowledge code: 2.1.2

Version: v20261009

Author: QTank QTank is dedicated to providing systematic professional knowledge, methodologies, and practical tools for quality management practitioners, helping companies continuously improve their quality capabilities.