Selecting quality assurance software: The practical guide

Anyone responsible for quality in a manufacturing company will be familiar with the situation: an IATF audit is imminent, the process data is in three different systems and the question "Which part was screwed together with which torque?" takes 40 minutes and two phone calls. This is not an isolated case - it is part of everyday life in companies that use quality assurance software but have not selected it systematically.

The market for quality management software is blurred. Manufacturers use the same terms for fundamentally different products: CAQ system, QMS, MES module, process data platform - everything is supposed to be "digital quality assurance". What is missing is an honest selection logic: what does your company actually need, which requirements are mandatory and which systems can reliably meet these requirements?

This guide provides quality managers and production managers with a structured basis for software selection with specific evaluation criteria for test automation, traceability and audit-proof documentation. No feature lists, no product advertising. Just the questions you need to ask a software provider before making a purchase decision.

What does quality assurance software really do in production?

The term is broader than it sounds. In practice, "quality assurance software" covers a wide variety of systems: small CAQ modules that manage inspection plans; full-blown QMS platforms that organize ISO documentation; MES-related process monitor tools that record machine transfer data; and archiving systems that store production data in an audit-proof manner. None of them are the same.

The decisive differentiation is not based on the range of functions, but on the data reference: Does the system work at component level (serial number or batch number) or does it only aggregate at shift or day level? The difference determines whether you can carry out a targeted partial recall in the event of a callback or have to block the entire production.

Typical mistake: A company buys a QMS system that manages documents, approvals and training certificates and discovers in the first serious audit that the inspection process on line 3 is not documented with component accuracy. The QMS is not a quality assurance system for production. It is a document management system.

Criterion 1: Test automation - What does this mean in concrete terms?

Automated quality inspection is not the same as digital quality inspection. Digital means that results are recorded in a system. Automated means that the system controls, monitors and documents the inspection process without any manual intermediate steps. The difference is practical: with true automation, no tool can be released if its calibration has expired and no component can leave the station before the mandatory tests have been documented.

In practice, this means for safety-relevant screw connections: The system plans the random samples in accordance with VDI/VDE 2862, controls the test cycles, records measured values directly from the test keys, evaluates IO / NOK against defined tolerances and writes the result with a time stamp to the component file. No manual export, no subsequent entry.

At Audi Neckarsulm, QST from CSP performs precisely this function: daily spot checks on screw connections in risk classes A and B are planned, carried out and archived completely automatically. According to the site, the automated documentation is particularly important, especially for the prescribed machine capability test for new systems.

The critical questions for supplier discussions:

• Which joining technologies (screwing, riveting, gluing, pressing, welding) are natively supported?
• Can the system test tools from different manufacturers simultaneously?
• How are test plans updated when products are changed - manually or via an ERP connection?
• What happens if a test device measures NOK values - does the system automatically block the line?

Criterion 2: Traceability - more than just storing data

Traceability is one of the most misunderstood concepts in manufacturing quality. Many companies believe they are traceable because they store data. In fact, they are only traceable if this data is linked to a specific component or batch and can be queried system-wide. The data can be available in ERP, MES and paper archives, but if they are not linked to each other, this is not proof of traceability.

IATF 16949 section 8.5.2 requires component-specific traceability for Class A safety-relevant components. This means that for each individual component, the material batch, process parameters, test results and release decisions must be linked to the same serial number or batch number and be retrievable within minutes in the event of an emergency.

According to practical experience from production projects, the difference between a targeted partial recall and a full recall often lies in the question of whether the traceability data can be queried system-wide. If you only track at batch level, you may have to block more than necessary. Savings in the six-figure range are possible if the recall can be limited to the components actually affected.

Critical test questions for system comparison:

• Can the software generate a component-accurate verification across all production stages in under 5 minutes?
• Are process parameters (torque, press-fit value, temperature) automatically linked to the component ID?
• Can the system perform a forward and backward batch query?
• Can the component file still be retrieved after a system change or database upgrade?

Criterion 3: Audit-proof documentation - what standards actually require

Audit-proof is not a marketing term, it is a technical and legal requirement. A database is audit-proof if four conditions are met: The data is stored unalterably (audit trail without gaps), it is complete (all events relevant to the obligation are present), it can be found (targeted search without specialist IT knowledge) and it is permanently readable (open formats even after a system change in 15 to 25 years).

The retention periods that manufacturing companies must adhere to are longer than most expect: IATF 16949 requires at least 15 years for quality data, while the EU Product Liability Directive 2024 (2024/2853/EU) stipulates up to 25 years for latent damage to safety-relevant products.

The critical problem: many quality assurance systems in manufacturing archive data in proprietary formats or in databases that are tied to the continued operation of the original software. Anyone who buys QA software today implicitly buys its archiving model for the next two decades. This commitment must be explicitly checked during the selection process.

System comparison: What types of software are available and what can they do?

The market does not offer a standardized category of "production quality assurance software". Instead, there are system types with different functional focuses. The right decision depends on which requirements are dominant in your company.

Step-by-step: How to choose the right QA software

The selection of quality assurance systems often fails not because of the wrong product, but because of an incomplete requirements analysis. If you go into a discussion with a provider without first having defined your own mandatory requirements, you will look at feature demos and end up deciding on the best price.

Frequently asked questions

Which standard prescribes quality assurance software in production?

No standard prescribes a specific software. IATF 16949 section 7.5 requires traceable documents and records; section 8.5.2 requires traceability for safety-related parts. ISO 9001:2015 clause 9.1 requires data-driven monitoring and measurement. What these standards require are results - complete proof, component-specific traceability - and these can only be reliably achieved with suitable software.

Does quality assurance software have to be manufacturer-independent?

Technically, manufacturer independence is not mandatory, but it is an important criterion in practice: anyone who buys a system that can only inspect tools from one manufacturer is tied down in the event of technology changes or supplier consolidations. Manufacturer-independent systems such as Manufacturing OS from CSP support different tool manufacturers at the same time and are therefore more flexible and more cost-effective in the long term.

Can I integrate quality assurance software into my existing ERP system?

Yes, modern QA systems offer open interfaces (OPC-UA for the machine level, REST-API for the ERP connection). The integration enables production orders from the ERP to be automatically transferred to the QA system as inspection specifications and inspection results to be reported back. Typical integration projects take 6 to 12 weeks and cost 30,000 to 80,000 euros, depending on complexity and master data quality.

How long must quality data from production be stored?

The retention periods vary depending on the standard and industry: IATF 16949 requires at least 15 years after the last delivery, while the new EU Product Liability Directive 2024 stipulates up to 25 years for latent defects. OEM specifications (BMW, VW, Mercedes-Benz) may stipulate longer periods. For safety-relevant production data, 25 years is therefore recommended as a planning parameter. The selected archiving system must guarantee these periods without a system change.

From what size of company is a specialized QMS system worthwhile?

There is no fixed lower limit, but companies with at least 50 to 100 manufacturing jobs and an IATF certification requirement or OEM supplier relationship are a sensible starting point. The manual effort required for a complete quality assurance system is often greater than the benefits. Modular systems such as Manufacturing OS from CSP enable a step-by-step introduction with individual modules without having to introduce the entire suite at once.

Can artificial intelligence in quality assurance software make autonomous approval decisions?

No. In safety-critical production areas, fully autonomous approval by AI systems is not permitted by regulation. The EU AI Act classifies AI systems in safety-relevant production processes as high-risk systems with mandatory human supervision. AI can provide valuable support in quality assurance - anomaly detection, predictive error warning, evaluation automation - but the approval decision must always be made and documented by a qualified employee.