VDA 6.3 is the process-audit standard almost every German automotive OEM expects its Tier-1 and Tier-2 suppliers to pass. It is not a system audit (that is IATF 16949) and not a product audit (that is VDA 6.5). It is a structured, evidence-based review of how a specific process actually runs on the shop floor. This page distills what the auditor opens, asks, and scores, with a printable self-assessment checklist.
VDA 6.3 is the process audit standard published by VDA QMC (Verband der Automobilindustrie Qualitäts Management Center). The current edition is VDA 6.3:2016 (3rd edition, sometimes referred to as “P1–P7”). It evaluates a specific process — e.g. your CNC turning cell, your heat-treatment outsourcing, your final inspection — against seven process elements (P1–P7), about 60 process steps, and a set of “star questions” (Sonderfragen) that are deal-breakers if you can’t answer them.
The most common confusion we see at Chinese CNC suppliers: a company passes its IATF 16949 surveillance audit and assumes the German customer’s process audit will go smoothly. It often does not — because IATF looks at the system; VDA 6.3 looks at the one process the customer cares about. You can have a textbook QMS and still score red on a VDA 6.3 P6 production-process audit if your CNC cell does not actually run to the PFMEA on the wall.
VDA 6.3 organizes every question into seven process elements. The auditor assigns a score per element and the worst-performing element drives the overall rating.
| Element | Focus | What the auditor actually checks at a CNC shop | Typical time spent |
|---|---|---|---|
| P1 — Potential Analysis | Supplier selection, project acquisition | Did you actually evaluate the risk before taking the order? Is there a documented project-acquisition gate? | 5–10% |
| P2 — Project Management | Planning, resources, milestones | Project plan with gates, roles, risk register, lessons-learned from similar parts | 10–15% |
| P3 — Product & Process Development Planning | DFMEA, PFMEA, control plan, special characteristics | PFMEA covers customer special characteristics (e.g. << or K), control plan matches PFMEA actions, Cpk target set | 10–15% |
| P4 — Product & Process Development Realization | Prototype, sample, validation, PPAP | Dimensional report, material cert (EN 10204 3.1), process capability evidence, MSA / Gauge R&R | 10–15% |
| P5 — Supplier Management | Sub-supplier qualification, monitoring | Approved-supplier list, sub-supplier audit reports, incoming-control of outsourced processes (e.g. heat treatment, plating) | 10–15% |
| P6 — Process Analysis / Production | How the process actually runs on the floor | Turtle diagram, work instructions, control plan adherence, operator training records, FAI, in-process inspection, reaction plan — this is where the auditor spends most of the time | 30–40% |
| P7 — Customer Satisfaction | Field failures, complaints, service | Complaint-handling log (8D on file), warranty PPM trend, lessons-learned fed back into FMEA | 5–10% |
Each of the ~60 process steps in VDA 6.3 is scored on a fixed 5-point scale. The score is per element, not per question.
| Score | Meaning | Auditor’s reaction |
|---|---|---|
| 0 | Not implemented, or no evidence | Immediate red flag |
| 4 | Partially implemented, major gaps | Concerning — usually triggers an action item |
| 6 | Implemented with minor deviations | Acceptable but documented as a finding |
| 8 | Fully implemented and effective | Pass |
| 10 | Best practice, exceeds requirement | Exceptional — used sparingly |
The element score is the worst question score in that element. So a single “4” in P6 caps P6 at 4 even if every other P6 question is 10. The overall audit rating uses a traffic-light system:
| Rating | Element score | What it means for business |
|---|---|---|
| Green (A) | All elements ≥ 8 | No restrictions. Audit pass. |
| Yellow (B) | One or more elements = 6, none < 6 | Conditional pass — documented action plan, re-check in 6–12 months |
| Red (C) | Any element = 4 or 0 | Conditional fail — new business on hold, existing business under review until re-audit |
Star questions are a small set of “must answer” items scattered across the elements. A “no” or a vague answer on a star question usually forces the rating to yellow or red regardless of the rest of your scores. They exist because they correlate with the most common reasons automotive parts fail in the field.
| Element | Star question (paraphrased) | What evidence the auditor wants to see |
|---|---|---|
| P3 | Are customer special characteristics (<< / K) called out in your PFMEA, control plan, and work instructions? | The exact symbol traced through PFMEA RPN, control plan row, and operator work-instruction header |
| P3 | Do you have a process-capability target (Cpk / Ppk) defined for every special characteristic? | Written target (typically Cpk ≥ 1.67 long-term, ≥ 1.33 short-term) on the control plan |
| P4 | Is the initial sample (PPAP / VDA / ISIR) traceable to a real production run, not a hand-picked prototype? | Sample-pull record showing the parts came from a documented production lot |
| P5 | Are your sub-suppliers (especially heat treatment, plating, coating) qualified and monitored? | Sub-supplier audit reports ≤ 12 months old, incoming-control records |
| P6 | Does the operator have the current work instruction, control plan, and drawing at the machine? | Physical check at the cell — the auditor will walk to a machine and ask |
| P6 | Is the reaction plan (out-of-control action) defined for every special characteristic? | Reaction plan column in the control plan filled in, not blank |
| P6 | Is there a documented change-management process (engineering change, process change, sub-supplier change) that is actually followed? | ECN log with sign-off, cross-reference to updated PFMEA / control plan revision |
| P7 | Are field complaints handled with a documented problem-solving method (8D / A3) and fed back into the FMEA? | Completed 8D with root cause, corrective action, and an updated PFMEA row |
<< to the operator card, nothing else saves the rating.The turtle diagram is the most common way to present a single process to a VDA 6.3 auditor. It has six legs plus the process name in the head. The auditor will probably ask you to draw it on a whiteboard during the audit — if you can’t, it signals you don’t really own the process.
For a CNC turning cell producing a solenoid valve body, a filled turtle diagram looks like:
| Leg | Filled-in content (example) |
|---|---|
| Inputs | Bar stock 1.4301 (304) per EN 10088-2, drawing rev. D, customer spec CSR-2024-017, CNC program OP10.001 |
| Controls | WI-CNC-OP10 rev. 7, Control Plan CP-2024-17 row 5 (special char Ø8 H7), PFMEA PF-2024-17 RPN 42 |
| People | 3 operators certified per WI-CNC-OP10; language: Chinese, English for audit support |
| Resources | Citizen Cincom L20, calibrated 2026-04; Okuma LB3000 EX; tool presetter; climate-controlled inspection room |
| Performance | Cpk 1.85 (Ø8 H7), 0 PPM past 18 months, OEE 82%, FPY 99.4% |
| Outputs | Conforming parts with FAI per AS9102, material cert EN 10204 3.1, packed per customer packaging spec |
Each star question needs a piece of evidence the auditor can touch, open, or read. Generic claims (“we train everyone”) score 4 at best. Specific, dated, signed evidence scores 8.
| Evidence type | Counts as evidence | Does NOT count |
|---|---|---|
| PFMEA | Excel/PDF, dated, signed, RPN scored, special characteristics marked, action status updated | PFMEA template filled in once and never reviewed; RPN cells blank |
| Control plan | Current rev, matches PFMEA, reaction plan filled in for every special char, signed | Control plan with the reaction-plan column blank; revision older than the latest engineering change |
| Work instruction | Laminated at the machine, current rev, in operator’s language, dated, with photo of correct setup | Work instruction only on the server; rev on server newer than the copy at the machine |
| Training record | Per WI, with date, trainer signature, operator signature, competence test pass | Sign-in sheet with no link to which WI was trained; no test |
| Calibration | Calibration cert from accredited lab (ISO 17025), in date, covers the gauge you actually use | In-house calibration with no traceability; cert expired last month |
| Material cert | EN 10204 3.1 with heat number, batch number, chemistry, mechanical properties, signed by the mill’s authorized inspector | EN 10204 2.1 (compliance only, no test results); mill cert without heat number |
| Sub-supplier audit | Documented audit (VDA 6.3 or equivalent), ≤ 12 months old, with action-item closure | Initial supplier qualification only; no recurring audit |
| 8D report | D1–D7 all filled, root cause validated, corrective action implemented, PFMEA updated, customer accepted | Open 8D with D4 root cause still “to be determined” after 60 days |
From our own audit history and what peers in the same Tier-1 supplier network report, these are the failures that show up again and again. Each is a score-4 item in the real audit.
| # | Failure | Why it happens | Fix |
|---|---|---|---|
| 1 | PFMEA has no special-characteristic symbol (<< / K) traced to the control plan | Engineering translates the drawing but doesn’t mark the symbol in the PFMEA template | Add a “Special Char” column to the PFMEA and force the symbol to be filled in for every row |
| 2 | Reaction-plan column is blank in the control plan | Team treated the control plan as a copy-paste exercise | Reaction plan is a separate SOP, but the control plan must list the trigger and the action for every special char |
| 3 | Work-instruction revision at the machine is older than the revision on the server | No controlled-distribution system for paper documents | Implement a one-document-one-rev system; old revs collected and shredded on new-rev issue |
| 4 | Sub-supplier (heat treat / plating) never audited | Initial qualification done, no recurrence | Annual sub-supplier audit, VDA 6.3 or equivalent, with documented action closure |
| 5 | Cpk study done once on the PPAP sample, never repeated on production | Team treats Cpk as a one-off, not a continuous KPI | Calculate Cpk from the last 30 production lots; trend it; trigger action if Cpk < 1.33 |
| 6 | No 8D — complaints handled in WeChat groups | No formal complaint-handling SOP | Customer-complaint SOP with mandatory 8D, 24-hour D2 containment deadline |
| 7 | Process change (new bar supplier, new tooling) made without ECN | No change-management discipline | ECN triggered by any of: material source, machine, tooling, parameter window, sub-supplier |
| 8 | Process description too vague (e.g. “finish to drawing”) on the router | Engineers treat the router as a placeholder | Router must list the operation, the machine, the work instruction rev, the inspection step, the control plan row |
Print this page and walk it through your own shop with your quality manager, your production manager, and your engineering manager in the room. Be honest. If you can’t answer “yes” to a row, that’s a 4 in the real audit, not a 6.
| # | Element | Question (paraphrased) | Y / N | Evidence on file |
|---|---|---|---|---|
| 1 | P1 | Do you have a documented supplier-selection / project-acquisition gate that you actually use? | ||
| 2 | P2 | Is there a written project plan with gates, roles, milestones, risk register? | ||
| 3 | P3 | Are all customer special characteristics called out in the PFMEA, control plan, and work instruction? | ||
| 4 | P3 | Does every special characteristic have a Cpk / Ppk target written in the control plan? | ||
| 5 | P4 | Is the PPAP / VDA / ISIR sample traceable to a documented production lot? | ||
| 6 | P5 | Do you have an approved-supplier list with sub-supplier audit dates within 12 months? | ||
| 7 | P5 | Do you inspect incoming material from sub-suppliers (especially heat treat / plating)? | ||
| 8 | P6 | Can the operator at the machine show the current work instruction, control plan, and drawing? | ||
| 9 | P6 | Is the reaction plan filled in for every special characteristic in the control plan? | ||
| 10 | P6 | Is there a documented change-management process and an ECN log? | ||
| 11 | P6 | Are inspection gauges calibrated by an ISO 17025 lab, in date, and listed? | ||
| 12 | P6 | Are operator training records per work instruction, with a competence test, dated and signed? | ||
| 13 | P6 | Is Cpk calculated continuously (not just on PPAP) and trended? | ||
| 14 | P7 | Are customer complaints logged, with 8D reports, and are they fed back into the PFMEA? | ||
| 15 | P7 | Are PPM / scrap / first-pass-yield KPIs visible on the shop floor and trended monthly? |
IATF 16949 audits the QMS — does your system exist, is it documented, is it maintained across all clauses. VDA 6.3 audits a specific process — does this one process actually run the way your documents say it does. You can be IATF-certified and still score red on a VDA 6.3 P6 production-process audit if your CNC cell doesn’t follow the PFMEA. VDA 6.3 is what the German customer’s SQE runs; IATF is the certification your registrar (e.g. TÜV, DQS) runs.
Typically 1.5–2.5 days on-site for a single process at a single site, depending on part complexity and number of special characteristics. P2–P4 (project / development) often run in the office for half a day. P6 (production) takes 1–1.5 days because the auditor walks the cell, opens routers, watches a setup. Add half a day for P5 (sub-supplier review) if you outsource heat treatment, plating, or coating.
From the audits we’ve seen and the peers we work with, the top three are: (1) PFMEA doesn’t trace the customer’s special-characteristic symbol (<< or K) into the control plan and the operator’s work instruction, (2) reaction-plan column is blank in the control plan, and (3) the work-instruction revision at the machine is older than the revision on the server. Each of these is a yellow at best, and if the gap is severe, a red.
Sometimes, but the color matters. A yellow (B) rating is a conditional pass — you submit an action plan, the customer re-checks in 6–12 months, and existing business continues. A red (C) rating usually means new business is on hold and existing business is under review. The hidden risk: a yellow rating after a 0-km field action is effectively treated as red by German procurement.
Direct costs (formal training, mock-audit consultant) are typically €3,000–€10,000 for a small CNC shop. Indirect costs (closing the gaps the mock audit finds) vary wildly — from a few engineer-weeks for documentation fixes to six figures if you need a new CMM, new gauge calibration, or new sub-supplier qualification. Compared to the cost of a red rating (lost orders, 8D cost, switching cost), preparation is almost always cheaper than non-preparation.
Not legally, but yes in practice. At a minimum, you need at least one person who has attended the official VDA 6.3 process auditor course (3–5 days, offered by VDA QMC licensed training providers) and can run an internal mock audit. Without that, you will not see the gaps in your own PFMEA, control plan, and turtle diagram before the customer’s SQE walks in.
We are a CNC machining supplier that has passed a German Tier-1 automotive VDA 6.3 process audit. We can review your PFMEA, control plan, and turtle diagram against the P1–P7 checklist before the auditor arrives.
Request a Quote