Templates and records · IATF 16949 · Clause 4.3.2

IATF 16949 customer-specific requirements matrix

Every manufacturer adds its own rules to the standard. The matrix maps them against the IATF clauses and the plant’s processes, so nobody discovers a customer requirement during the audit.

In one sentence

The customer-specific requirements matrix lists, customer by customer, every requirement their CSR document adds to IATF 16949, the clause of the standard it affects, the process that applies it and the evidence that it is met, because clause 4.3.2 requires those requirements to be evaluated and included in the scope of the system; the standard does not demand a matrix format, but it is the usual way of demonstrating compliance.

Content reviewed on 17 October 2026

Where the standard requires it: IATF 16949 · Clause 4.3.2 Clauses are those of IATF 16949:2016, which always applies together with ISO 9001:2015. The AIAG and VDA manuals cited are industry references that apply when the customer requires them; they are not part of the standard.
Type of information: Good practice Clause 4.3.2 requires CSRs to be evaluated and included; the matrix is the usual method
Who fills it in: Customer quality manager With each process owner affected; management signs off on any resources required
When: When a customer is won and at every revision It pays to check periodically whether the customer has published a new version of its CSRs
How long it is kept: Current, with its versions Keeping earlier versions lets you explain what applied at any given time

What the standard requires

What IATF 16949 demands and what it leaves to your judgement

IATF requires each customer’s specific requirements to be evaluated and included in the management system. The certification audit is carried out against the standard and against those requirements, and the auditor picks a sample of customers to check that they are applied.

CSRs touch almost everything: the FMEA method, the default PPAP level, the problem-solving tool, the complaints portal, response deadlines, internal auditor training or the type of process audit.

What the standard leaves to the company is how to organise it. A matrix per customer, with one row per requirement and its link to the process, is the most common approach because it shows at a glance what changes when the customer publishes a revision.

Read it in context: Context of the organization, in the IATF 16949 Academy

Structure

Fields the template should include

Customer, CSR document, version and date
Specific requirement, with its reference in the customer’s document
IATF 16949 or ISO 9001 clause it adds to
Plant process, document or record where it is applied
Owner
Evidence of compliance
Status: implemented, in progress, not applicable with justification
Date of the last matrix review

Example

Example: three rows from one customer’s matrix

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Customer	Fictitious manufacturer OEM-B · CSR version 6, March 2026
Requirement 1	FMEA according to the AIAG-VDA handbook · affects 8.3.5.2 · engineering process · implemented
Requirement 2	Initial complaint response within 24 hours and full 8D within 10 working days · affects 10.2.3 · customer quality
Requirement 3	Process audit to VDA 6.3 · affects 9.2.2.3 · audit programme · VDA 6.3 auditor training in progress
New in version 6	Annual test of the contingency plan against cyberattacks · affects 6.1.2.3 · IT · in progress, due 30 June
Review	Matrix updated on 4 April 2026 after version 6 was published

At the audit

Mistakes auditors commonly flag

The matrix uses a CSR version the customer has already superseded.
Only vehicle manufacturers’ CSRs are captured; those of Tier 1 customers are left out.
Requirements marked as implemented with no evidence or associated process.
Internal auditors are unaware of the CSRs they are supposed to audit.
Nobody reviews the matrix when a new customer is won.

In Kimobox

How this record is kept in Kimobox

1Each customer’s specific requirements are recorded on the relevant project or process record.
2The process map shows which CSRs apply to each process.
3Each outstanding requirement becomes an action with an owner and a date, with an alert if it slips.
4Customer documents are stored under version control, so you know which version was in force at any time.

Frequently asked questions

What people ask us before getting started

What is a CSR?

A customer-specific requirement: the interpretation of, or supplement to, IATF 16949 that a customer adds for its supply chain. It is published in a document of its own and is auditable just like the standard.

Do I need a matrix if I only have one automotive customer?

The standard does not require the matrix, but it does require that customer’s CSRs to be evaluated and included. Even with a single customer, a table with the requirement, the process and the evidence is the quickest way to demonstrate it and to spot changes.

Do Tier 1 customers have CSRs too?

Yes. Tier 1 suppliers usually cascade their customers’ requirements down their supply chain and add their own. For a Tier 2 supplier, those are its customer-specific requirements.

Keep your IATF 16949 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

IATF 16949:2016 — Quality management system requirements for automotive production and relevant service parts organizations IATF · First edition, October 2016
IATF 16949 Sanctioned Interpretations and FAQs IATF Global Oversight · Continuously updated