IATF 16949 Foundry China: What the Certificate Hides

The PPAP package lands on your desk on a Tuesday. Level 3, eighteen documents, and stapled to the front a photocopy of an IATF 16949 certificate with a certification-body logo you half recognise.

Two weeks later your SQE finds the problem.

The certificate is genuine. The scope reads: manufacture of aluminium alloy castings by gravity die casting. Your part is gravity die cast and machined. The machining is subcontracted to a shop forty kilometres away that nobody has ever audited. Nobody lied to you. Nobody told you, either.

I have sat through eleven supplier audits in China in the last three years, and that scenario has come up in some form on at least four of them. The certificate was never the problem. The gap between what the certificate covers and what your part actually needs — that's the problem.

This is the checklist I now run before a Chinese foundry ever gets an RFQ from my team. A longer version, with the documents to request and the answers worth pushing back on, sits in the foundry audit checklist.

Certification is granted to a site, not a company

This is the single most misunderstood fact about IATF 16949, and it costs importers money every month.

Your supplier's parent group holds the certificate. The certificate lists one address in large print and then, in smaller print, one or two "extended sites" — a second plant, a satellite machining hall, a warehouse that does rework. Everything outside those addresses is out of scope. Anything done there is not covered by the audit, not covered by the certification, and not covered by the quality system you thought you were buying into.

This isn't an accident of how Chinese suppliers present themselves. The IATF scheme is built around a single manufacturing site, and clause 4.3 of the standard requires the scope statement to name the products and services that site actually provides. The certificate and clause 4.3 should tell you the same story. When they don't, the difference is your exposure.

The common shapes of this in Chinese foundry sourcing:

• The trading company with a borrowed certificate. You negotiate with an exporter in Ningbo. The certificate belongs to a foundry in Jiangsu. The exporter appears nowhere on it. You have no IATF-covered relationship at all.
• The foundry that outsources machining. Casting is in scope. CNC turning is not. Since 80% of your drawing tolerances live in the machined features, this is the part you actually care about.
• The foundry with a second plant. Volume grows, the supplier shifts your part to a newer facility up the road, nobody updates the PPAP, and the certificate never mentioned that address.
• The expired certificate. Chinese certificates from the 2016 revision are long dead. If a supplier's PDF shows a 2017 expiry and a smiley, ask why.
• The suspended certificate. This is the nastiest one, because the supplier may not know. Certification bodies suspend certificates over unpaid fees, missed surveillance audits, or unresolved nonconformities. The supplier's copy looks fine. The database says otherwise.

China holds more IATF 16949 certificates than any other country — the IATF's public database lists tens of thousands of active Chinese sites, and the counts are published quarterly. That's a good thing for availability and a bad thing for your due diligence, because volume makes it easy to find a certificate and hard to verify the right one.

How to actually check

Don't accept a PDF. Pull the record yourself from the public IATF certificate database, which is linked from iatfglobaloversight.org, or check the certification body's own register — TÜV, SGS, Bureau Veritas, Intertek and DNV all publish searchable client lists, and a cross-check between the two takes about four minutes. Then do five things:

1. Match the legal entity name and the full site address, character by character, against your purchase contract.
2. Read the scope statement word by word. If your process isn't in that sentence, it isn't certified.
3. Check the status field. Active, suspended, withdrawn. Anything but active is a stop sign.
4. Note the expiry date and the certification body. Then check that the body is IATF-recognised — some Chinese "certification centres" issue certificates that look right and mean nothing.
5. Save a screenshot of the status page with the date visible and put it in the supplier file. It's the only evidence you'll have that the certificate was live on the day you released the PO.

Roughly half of the certificate problems I have found were not fraud. They were drift — a supplier that grew, moved a line, changed a subcontractor, and never updated its scope because nobody asked it to.

The scope line is where procurement decisions get made

Here's a habit worth building. Before you read anything else on the certificate, read the scope sentence. It is usually between eight and twenty words, and it tells you more about your risk than the entire rest of the document.

Two of those four scopes are common in China. The first is by far the most common, and it is the one that bites hardest, because a casting-only scope with an outsourced machine shop gives you a supplier that is fully compliant on paper and structurally unable to control your critical dimensions.

If you need machining inside the certification, you have two clean options: find a foundry with machining in scope, or accept a foundry with a casting-only scope and treat the machine shop as a separate supplier you audit yourself. Both are workable. What isn't workable is assuming.

Clause 8.4.2.1 closes part of this hole on paper — the foundry has to apply selection, monitoring and development requirements to its own external providers, the same discipline you apply to the foundry. Clause 8.4.2.4.1 lets it discharge some of that through second-party audits. Ask to see those audits. In my experience, that's the point where the conversation goes quiet.

PPAP in China: the paperwork is usually fine, the process capability isn't

Let me be fair to Chinese foundries here. Most of the ones I deal with can produce a complete Level 3 PPAP submission on request, on time, correctly formatted, with all eighteen elements present. The standard demands it under clause 8.3.4.4, and the document management is genuinely good. Some of these teams run better document control than Tier-2 plants in Eastern Europe.

The weakness is almost always in the numbers behind the documents.

Where the file and the floor disagree

Capability studies. Ask for the raw measurement data behind a Ppk of 1.67 and you'll often get twenty-five parts from a single cavity, a single shift, on a single day, with the operator standing next to the gauge. That's not a capability study. That's a photograph of a good afternoon. Clause 9.1.1.1 asks for evidence that the process can hold the tolerance — which means multiple cavities, multiple shifts, and a tool that has some wear on it.

MSA. The gauge R&R form will be there. Whether the three appraisers were three different people, or the same person filling out three columns, is worth asking about. I have seen the latter more than once. Clause 7.1.5.1.1 exists because gauge error is supposed to be measured, not assumed.

Material certs. Heat numbers on the mill certificate are printed. Whether they match the heat number on the casting you're holding is a different question. In one audit, the traceability chain broke at the melting furnace log — the numbers had been transcribed from the material cert rather than recorded at the furnace. That is exactly backwards, and it's the kind of thing you only find by walking to the furnace.

Dimensional reports. The ballooned drawing is fine. The CMM report is fine. The two being from the same part revision is the thing to check. Chinese foundries change drawings faster than they change report templates, and the report template often wins.

Sub-tier control is the real gap

IATF 16949 requires you to know and control your sub-suppliers. Clause 8.4.2.5 goes further and asks for supplier development — monitoring sub-tier performance and improving it where it falls short. In a Chinese foundry, that usually means:

• Scrap steel and pig iron from local traders with no certificate of analysis and no heat traceability
• Heat treatment outsourced to a shop that runs a furnace with a chart recorder from the 1990s
• Impregnation done by a three-person operation in the next industrial park
• Surface treatment — zinc plating, powder coat, anodising — sent out with a delivery note and nothing else

None of that shows up in the PPAP. All of it shows up in your warranty claims eighteen months later, usually as a corrosion failure or a heat treat hardness reading that drifts by ten points.

Special processes: where IATF 16949 foundries in China break down

IATF 16949 leans hard on special processes — the ones whose output you can't fully verify by inspecting the part afterwards. Heat treatment, welding, plating, coating, and in the casting world specifically, the melting and pouring operation itself. Failures hide inside the material and come out months later.

The AIAG has published assessment frameworks for exactly these: CQI-9 for heat treat, CQI-11 for plating, CQI-12 for coating, CQI-15 for welding, and CQI-27 for casting. A serious foundry will know these numbers. A foundry that has never heard of CQI-27 is telling you something about how deep its IATF implementation actually goes. Ask for the last completed CQI-9 or CQI-27 assessment and the action plan that came out of it, not just the certificate of completion.

Three special-process questions I now ask every Chinese casting supplier, and why:

"Who calibrates your furnace chart recorder, and can I see the calibration certificate?" The answer separates a plant that runs a quality system from a plant that runs a furnace. If heat treatment is outsourced, this question needs to be asked at the subcontractor, not the foundry.

"Show me the quench delay for the last three production lots." In aluminium solution treatment, the window between coming out of the furnace and going into the quench is measured in seconds. If nobody in the plant knows the number, the process is not controlled — it's hoped for.

"Where is the X-ray or ultrasonic inspection done, and who reviews the films?" For safety-critical castings, NDT is often subcontracted to a third-party lab. Clause 7.2.1 requires competence for anyone whose work affects conformity, and for NDT that means a certified Level II — not whoever is free that afternoon. It also matters whether the foundry ever rejects a part based on the film, or just files it.

The on-site audit: what to look at and what to skip

You have two days on site. Most buyers spend the first one in the meeting room going through the quality manual, which is the least informative thing in the building.

Here's what I do instead.

Hour 1: walk the floor before anyone presents anything

Do this first, before the management presentation, before the coffee. Walk to where your part is made and watch. You're looking for small things that tell you large things:

• Is the work instruction at the machine the right revision? Check the document number against the drawing revision on your PO.
• Is there a reject bin, and does it have anything in it? A plant with an empty reject bin all day is not a good plant — it's a plant that isn't segregating.
• Are the gauges in the inspection area under a current calibration sticker? Pick one up and read the date.
• Is the SPC chart on the wall actually filled in, or is it a printout from three months ago with the same handwriting pattern every day?
• Is the set-up sheet at the machine signed and dated for this shift? Clause 8.5.1.3 asks for verification of job set-ups after a change; the signature tells you whether the clause reached the floor or stopped at the quality manual.
• Where do the raw materials sit? Covered, tagged, segregated by alloy? Or in a pile by the door in the rain?

Hour 2: the traceability walk

Pick a finished casting from a shipping carton. Ask the quality manager to trace it back to the heat number, the furnace log, the pouring date, the operator, and the incoming material certificate.

Then time them.

A plant that can do this in fifteen minutes is in control. A plant that needs to make three phone calls and comes back after lunch with a reconstruction is not tracing — it's reverse-engineering a story. Clause 8.5.2.1 requires traceability through the production process; in practice, that requirement lives or dies in the furnace log book.

Hour 3: the nonconformity file

Ask for the last twelve months of internal and external nonconformities, plus the corrective actions. Then ask to see the effectiveness verification for three of them.

This is the highest-signal document in the entire audit. A plant with a thick, well-managed NC file and closed 8Ds is a plant that finds its own problems. A plant with three NCs in a year is a plant that classifies everything as "not a nonconformity." Clause 10.2.3 is about problem solving that reaches root cause, and the file is where you see whether that happened or whether the 8D stopped at "operator retrained."

Skip or shorten

The management presentation. The corporate brochure. The plant tour route that conveniently avoids the cleaning and finishing area. And the "our company culture" slide, which has never once told me whether a casting will leak.

Common mistakes buyers make with Chinese IATF foundries

Treating the certificate as a substitute for an audit. Certification is a minimum bar, not a performance guarantee. Two plants can hold identical certificates and sit at opposite ends of the quality curve.

Not checking certificate status at the point of PO issue. Check it at sourcing, check it again before you release the first production PO, and check it every year at minimum. Suspensions happen quietly, and the supplier's PDF never updates itself.

Assuming the machine shop is covered. It usually isn't. Follow the part, not the certificate.

Accepting a scope that doesn't name your process. If the certificate says sand casting and you're buying investment castings, you have no coverage. This sounds obvious and still happens constantly.

Auditing the foundry and not the sub-tier. Heat treat, plating, impregnation, NDT. If these are outside the walls, they're outside the audit you just paid for.

Letting the PPAP become a one-time event. The file is a snapshot from the day of approval. Tool wear, staff turnover, and a new subcontractor can move you a long way from that snapshot in eighteen months without anyone updating a single document. Clause 8.5.6.1 puts the obligation on the supplier to notify you of process changes — but only if you have told them, in writing, what you consider a change.

Reading the IATF certificate and skipping the customer-specific requirements. Your OEM's CSR sits on top of IATF 16949, as clause 4.3.2 makes clear, and is often stricter. A foundry that has never read your customer's CSR has not really been qualified for your program.

FAQ

Is IATF 16949 mandatory for a Chinese foundry supplying automotive castings?

For any part that goes into a production vehicle, effectively yes. Most OEMs and Tier-1s make it a contractual requirement, and IATF 16949 itself requires certification for organisations in the automotive supply chain. A foundry making aftermarket or non-automotive castings may only hold ISO 9001, which is a different and much lower bar.

How do I verify a Chinese IATF 16949 certificate is real?

Use the public IATF certificate database — linked from iatfglobaloversight.org — rather than the supplier's PDF, and confirm four things: the legal entity and site address, the exact scope wording, the certificate status (active vs suspended), and the certification body's IATF recognition. The bigger certification bodies also publish their own client registers, so a second lookup costs you a minute. If anything doesn't line up, email the certification body directly. They respond.

What's the difference between IATF 16949 and ISO 9001 for a casting supplier?

ISO 9001 is a general quality management standard. IATF 16949 adds automotive-specific requirements on top: product approval processes (PPAP), part approval and traceability, sub-tier supplier development, special process controls, total productive maintenance, and MSA. In practice the biggest difference you feel as a buyer is that IATF requires documented process capability and a formal corrective action system, not just a quality policy on the wall.

Can a Chinese foundry be IATF 16949 certified if it outsources machining?

Yes, and this is exactly where buyers get hurt. The certificate will then cover casting only. The outsourced machining — which typically holds most of your critical tolerances — sits outside the certification and outside the audit. Either audit the machine shop yourself or find a supplier with machining in scope.

How much does IATF 16949 add to the piece price in China?

It varies too much to quote a figure, but the general pattern is that certified plants carry more overhead in inspection, documentation, calibration and maintenance, and that shows up in price. A casting-only IATF-certified foundry with outsourced machining is often priced close to an ISO 9001 shop with the same process, because the scope of the certification is narrow. Ask what's in scope before you assume the premium buys you what you need.

What to do before your next RFQ

Before a Chinese foundry gets a drawing from you, get five things in writing:

1. A current certificate copy plus the database record, with the scope highlighted and the site address matching your contract
2. A written list of every process in your part's routing, marked as on-site or subcontracted
3. The name and address of each subcontractor for heat treat, plating, coating, NDT and machining
4. The last internal audit report and the last certification body surveillance report
5. A named quality contact who can answer a traceability question in under a day

If a supplier can't produce all five within a week, that's information. It isn't necessarily a reason to walk — plenty of good foundries are just disorganised — but it does tell you how much of your own time this relationship will consume.

The certificate is the beginning of due diligence, not the end of it. The plants worth keeping are the ones that hand you the file before you ask, and then walk you to the furnace to show you the log book.