Quality Data in Audits: What Reports Auditors Want to See

An audit day usually has one of the following sequences. Version A: The inspector asks for the test report for part no. X from week 08. Within 90 seconds it is on the table - complete, with measuring equipment reference, inspector ID and approval decision. The inspector nods, makes a note and moves on. Version B: The same inspector asks the same question. Three employees search in three different systems. After 45 minutes, something is found - but without a measuring equipment reference. The examiner writes a finding.

The difference between version A and version B is not the quality of the process. It is the quality of the report infrastructure. Auditors not only evaluate what is documented - they also evaluate how quickly and how complete it is available. Those who search in the audit give the impression that the system has not been mastered.

This article shows which eight reports are really asked for in quality audits - not as a theoretical list, but from the auditor's perspective: what must be included, what looks good, what triggers questions.

What auditors really assess - and what annoys them

Auditors are not document collectors. They are system evaluators. When an auditor asks for a report, he doesn't just check the content of the report - he checks whether the company has mastered its own quality process. The submission time, completeness and linking of information are indicators of exactly that.

What annoys auditors - three universal audit annoyances

First: Searching. If several people start searching in different systems after a report request, this is an immediate signal that there is no structured quality management system in place. Auditors make a note of this - before they see the results of the search.

Secondly: fragmentation. An inspection report without a measuring equipment reference, a CAPA without proof of efficacy, a batch record without a delivery bill link. Individual documents that do not talk to each other are not a system - they are a collection of documents.

Thirdly: Subsequent additions. 'I'll add this' or 'This wasn't up to date' in the audit are red flags. Auditors want to see documents that have been created during ongoing operations - not those that have been prepared for the audit.

Report matrix: Which report for which audit type

Not every report is needed in every audit. The following matrix shows which of the 8 core reports are mandatory (●●), recommended (●) or optional (○) for which audit type.

Key to the abbreviations: PP = Test report - SPC = Control chart/Cpk - RV = Traceability report - CAPA = CAPA register - KAL = Calibration certificate - WE = Goods receipt - LS = Delivery bill link - 8D = 8D report

The 8 core reports in detail

Each of the following 8 reports has a specific function in the audit. The cards show for each report: which content is mandatory (missing mandatory content = finding risk), which additional content creates confidence, the most common error - and what the auditor thinks when the report is complete.

1. audit report (PP)

2nd SPC control chart (SPC)

3. traceability report (RV)

4th CAPA register (CAPA)

5. proof of calibration (KAL)

6. goods receipt test report (WE)

7. delivery bill with serial numbers (LS)

8. 8D report (8D)

The auditor's perspective: What he thinks when he sees the report

The following table simulates the thoughts of an experienced audit setter in different report situations. It shows which signals a report sends - and which follow-up questions it triggers or prevents.

Auditors don't test documents - they test systems. A perfect document that takes 45 minutes to find loses more trust than an incomplete one that is on the table in 60 seconds.

-Korbinian Hermann Managing Director, CSP Intelligence GmbH

Quick export: How long does the retrieval take with and without the integrated system?

The following table shows realistic retrieval times for all 8 core reports - once without an integrated system (manual search in several sources) and once with CSP IPM. The time difference defines the operational leeway in the audit.

Common report errors and how to avoid them

The following errors occur regularly in audit practice - regardless of the size of the company. Each one is avoidable if the reporting infrastructure is set up correctly.

All 8 core reports at the touch of a button

Frequently asked questions

What is the maximum duration of a report retrieval in the audit without attracting negative attention?

As a rule of thumb: < 5 minutes for each mandatory report, without searching. If a complete report is not available within 5 minutes, the auditor begins to question the underlying system - regardless of the result. For reports that come at the auditor's request ('Show me ...'), less than 2 minutes is optimal. Anything over 10 minutes systematically creates mistrust and increases the likelihood of follow-up questions in other areas.

Does the 8D report have to be submitted in the OEM's original format?

That depends on the customer. BMW Group, Volkswagen and Mercedes-Benz have their own 8D forms, which must be submitted via customer portals (Q-Portal, MBDC etc.). No OEM-specific formats are required in the internal IATF audit - a complete internal 8D in accordance with the AIAG or VDA standard is sufficient. The content (D1-D8 with proof of effectiveness) is decisive, not the format. Anyone who keeps an OEM 8D for external submission and an internal 8D for audit purposes should ensure that both have the same content and the same status.

Can I submit historical reports for products from before the system was introduced?

For audits, the auditor will ask about the current status of the system, not the completeness of historical data. For an IATF surveillance audit, reports from the last 12 months are typically relevant. If you introduced an integrated system 6 months ago, reports from the time before that will be searched for in the old archive (paper or legacy system). Recommendation: Clearly document the cut-off date for the 'old system' and communicate it transparently in the audit - auditors accept migration if it is traceable.

What should we do if an auditor requests a report that we cannot provide?

Firstly: honesty. 'We don't currently have it in this form' is better than a long search process or an improvised document. Secondly, explanation and action. 'We don't have this report because ... We'll be ... by [date]' shows the auditor that the system is understood and there is a willingness to improve. Thirdly, if the report is a mandatory document according to the standard, this is a finding - in most cases a minor NC if it is not a systemic pattern. The handling of the finding is then more important than the finding itself.

Is Excel-based test report management sufficient for the IATF audit?

Technically yes - IATF 16949 does not prescribe a specific format or system. But Excel-based systems have three systemic weaknesses in the audit: firstly, editability (auditors can argue that data has been subsequently changed), secondly, lack of links (links to gauge ID, serial number and calibration certificate are not created automatically) and thirdly, retrieval time (Excel search is slower than system query). Excel can temporarily suffice for small companies with few inspection characteristics - but for scalable audit readiness, an integrated system is the more robust solution.

Is there a difference between an audit report and a quality record?

Yes - a quality record is the internal document that is created during ongoing operations: the inspection log, the batch booking, the CAPA form. An audit report is the prepared presentation of these records for the auditor - sometimes identical, sometimes a summary of several records. In the IATF context: The auditor usually wants to see the original quality records, not subsequent summaries. A report that acts as a 'summary' can even give the impression that the original data is to be concealed.

How do I store audit reports securely?

Audit reports are quality records and are subject to the same retention rules: IATF practice recommends at least the product life + 1 year (in the automotive industry typically 15 years for safety related parts). EU PLD prescribes 10-25 years for liability-relevant parts. GoBD for accounting-relevant documents 10 years. Recommendation: audit-proof archiving - stored unalterably, with a time stamp, in a format that can still be read in 15 years (PDF/A). Paper archives are technically accepted, but difficult to retrieve and susceptible to loss.