What is the most common FMEA audit finding?

Weak alignment between PFMEA, Process Flow Diagram, and Control Plan is the most frequent finding during IATF 16949 and customer audits.

Do auditors verify Action Priority?

Yes. Auditors check that AIAG-VDA Action Priority is calculated correctly and that High AP actions were implemented, verified, and re-rated.

How often should PFMEA be reviewed?

At minimum annually and whenever process, tooling, supplier, material, customer requirements, or complaints occur.

Is PFMEA required by IATF 16949?

IATF 16949 clause 8.3 requires risk analysis during product and process development; PFMEA per AIAG-VDA is the expected method for automotive.

Should PFMEA and Control Plan always match?

Yes. Step IDs, characteristic IDs, controls, inspection methods, frequencies, and reaction plans must be traceable across both.

What evidence supports a Detection rating?

GR&R / MSA results, sample plan, automation level, and control type. A D rating without MSA evidence is the most common Detection finding.

What evidence supports an Occurrence rating?

Process capability (Cpk/Ppk), internal scrap rate, warranty ppm, 0-km defects, or similar-process history. An O rating with no data is treated as a guess.

Do auditors accept RPN instead of Action Priority?

Some legacy customer specifications still require RPN. Auditors expect both methods when required, with AP as the primary decision tool per AIAG-VDA 2019.

How do auditors verify PFMEA maintenance?

They cross-check 8Ds, complaints, engineering changes, and tooling changes against the PFMEA revision history. Missing updates is a high-severity finding.

Can FMEA software replace audit preparation?

It cannot replace cross-functional review, but it removes the most common findings — revision control, AP calculation, rating rationale, and PFMEA/Control Plan alignment.

Audit Checklist

FMEA Audit Checklist

3 min read Last updated June 2026

Use this checklist before internal audits, customer audits, IATF 16949 assessments, APQP reviews, or PPAP submissions. The goal is not merely compliance. The goal is proving that the FMEA reflects the actual process.

Generate your first FMEA Knowledge Center

What auditors actually look for

Most audit findings are not caused by incorrect Severity, Occurrence, or Detection ratings. Findings usually result from weak traceability, poor maintenance, outdated assumptions, and disconnects between PFMEA and Control Plan.

Area	Typical Finding
Scope	Process scope unclear
Failure Modes	Generic or vague descriptions
Controls	Prevention and Detection mixed together
Ratings	No rationale for S/O/D values
Action Priority	AP ignored or incorrectly applied
Control Plan	Characteristics do not match PFMEA
Traceability	Missing revision history
Maintenance	PFMEA not updated after process changes

PFMEA document structure audit

Document has revision number.
Approval signatures are present.
Customer/program identified.
Scope clearly defined.
Cross-functional team listed.
Review date documented.
Latest process flow referenced.
Current Control Plan referenced.

AIAG-VDA methodology audit

Verify that the organization follows the actual AIAG-VDA methodology, not simply a modified spreadsheet version.

Planning & Preparation completed.
Structure Analysis completed.
Function Analysis completed.
Failure Analysis completed.
Risk Analysis documented.
Optimization actions tracked.
Results Documentation completed.
Prevention and Detection controls separated.

Failure chain quality review

Element	Audit Question
Function	Is it measurable and specific?
Failure Mode	Can it actually occur?
Failure Effect	Does it describe customer impact?
Failure Cause	Is root cause actionable?
Prevention Control	Does it reduce occurrence?
Detection Control	Does it detect the issue?

Action Priority audit

One of the most common AIAG-VDA findings is organizations using Action Priority incorrectly.

AP calculated using official AIAG-VDA logic.
High AP items reviewed.
Actions assigned.
Owners identified.
Due dates defined.
Residual ratings documented.
Actions verified after implementation.

Control Plan alignment audit

This is one of the highest-value audit sections because many organizations fail here.

PFMEA	Control Plan
Process Step	Process Step
Special Characteristic	Characteristic
Detection Control	Inspection Method
Inspection Frequency	Sampling Frequency
Reaction Action	Reaction Plan

Evidence of FMEA maintenance

Auditors increasingly verify whether the PFMEA is maintained rather than simply created.

Updated after customer complaints.
Updated after process changes.
Updated after tooling changes.
Updated after supplier changes.
Updated after engineering changes.
Review records available.

Top 10 FMEA audit findings

Finding	Risk
Generic failure modes	Weak risk analysis
Missing functions	Broken failure chain
Optimistic detection ratings	False confidence
No AP follow-up	Uncontrolled risk
No residual rating	No effectiveness verification
PFMEA-Control Plan mismatch	Audit finding
Outdated PFMEA	Obsolete controls
No reviewer evidence	Weak governance
Missing ownership	Actions not completed
Copy-paste FMEA	Poor process representation

Evidence pack: what to bring to the audit room

Audits are won by evidence, not by argument. Bring this exact stack to the opening meeting and most PFMEA findings disappear before they get written.

Evidence	Purpose
Current PFMEA (signed, dated)	Proves revision control
Process Flow Diagram	Step-by-step alignment with PFMEA
Control Plan	Characteristic, control, frequency, reaction
MSA / GR&R studies	Backs Detection ratings
Cpk / Ppk reports	Backs Occurrence ratings
Warranty / 0-km ppm	Backs Severity and Occurrence with field data
8D and complaint log	Proves feedback loop into PFMEA
Action log with residuals	Proves AP follow-up
Revision history	Proves PFMEA is maintained, not frozen
Calibration set	Proves rating consistency across teams

Audit-by-audit playbook

Audit	Focus area	Most common finding
IATF 16949 (cert body)	AIAG-VDA methodology, action follow-up	AP exists but no residual rating
Customer SQA (OEM)	Special characteristics, PFMEA→CP linkage	Characteristic IDs do not match
VDA 6.3 process audit	Process risk vs current controls	Detection rating not justified by GR&R
Internal layered audit	Live process vs PFMEA controls	Operator runs a control not in the PFMEA
PPAP submission review	PFMEA, Control Plan, Process Flow set	Revision dates not aligned across the set

Common auditor questions (and what good answers sound like)

Auditor question	Strong answer
Why is this Detection a 3?	Automated vision, 100% inspection, GR&R 8%, MSA validated 2024-Q1
Show me the action for this High AP.	Action #14, owner J. Müller, closed 2024-09-12, residual AP Low, Cpk now 1.55
When was this PFMEA last reviewed?	Last revision 2024-10, triggered by 8D-2024-031
Why doesn't this characteristic appear on the Control Plan?	It does — characteristic ID CH-014, page 3, frequency 100%
Who approved this PFMEA?	Cross-functional team, signed 2024-10, list attached

Pre-audit checklist (run this 48 hours before)

Verify latest PFMEA revision matches the latest Process Flow and Control Plan revision dates.
Confirm every High AP has a closed action with residual S/O/D and effectiveness evidence.
Confirm every special characteristic in PFMEA appears in Control Plan with identical ID.
Confirm rating rationale exists for every S, O, D — at minimum for High AP rows.
Confirm last 12 months of 8Ds were reflected in PFMEA updates.
Confirm reviewer/approver list matches actual cross-functional roles.
Print or load on tablet: PFMEA, Process Flow, Control Plan, MSA, Cpk, 8D log, action log.
Walk one row end-to-end with the team to dry-run the auditor's path.