VDA 6.8 Supply Chain Process Audit
VDA 6.8 is a process-based audit standard developed by the German Automotive Industry (VDA) to assess indirect service providers whose activities influence product quality, safety, or delivery performance.
Unlike production-focused audits, VDA 6.8 targets services such as logistics, IT, engineering, testing, and maintenance, using a risk-based, maturity-oriented approach aligned with OEM expectations.
This guide breaks down what VDA 6.8 is, why it matters, and how audits are structured, in a clear, practical, and audit-ready format.
🎯 What Is VDA 6.8?
VDA 6.8 is an audit standard for service processes in the automotive supply chain.
It focuses on:
- process stability
- risk management
- service performance
- data and information security
- continuous improvement
VDA 6.8 ensures that non-production activities do not create hidden quality risks for OEMs and Tier 1 suppliers.
✔ Applies to external and internal service providers
✔ Used mainly by German OEMs (VW, BMW, Daimler, etc.)
✔ Not a certification standard — audit & evaluation only
🧩 Who Must Comply with VDA 6.8?
VDA 6.8 applies to organizations providing indirect services with potential impact on the final product.
Typical examples include:
- 🚚 Logistics & transport providers
- 💻 IT infrastructure & software development
- 🧠 Engineering & design services
- 🧪 Testing, validation, and calibration laboratories
- 🔧 Maintenance & technical services
- 📦 Packaging, labeling, warehousing
- 🎓 Technical training providers
👉 Key criterion:
If the service can affect quality, safety, compliance, delivery, or OEM data, VDA 6.8 applies.
🏗️ The Core Structure of VDA 6.8
Similar to other VDA standards, VDA 6.8 follows a process-oriented audit structure, focused on maturity and risk control.
🏛️ 1. Organization & Management Responsibility
This pillar evaluates leadership, structure, and governance.
Auditors expect:
- a clear organizational setup
- defined responsibilities
- measurable objectives
- management involvement
✅ Typical evidence:
- organization chart
- job descriptions
- quality policy
- management review records
- risk assessments
❌ Common gaps:
- unclear process ownership
- objectives without KPIs
- management review done “only on paper”
👥 2. Resource & Competence Management
Service quality depends heavily on people and know-how.
Auditors verify:
- employee competence
- training and qualification
- availability of key resources
- workload and capacity planning
✅ Expected tools:
- competence matrix
- training plan & records
- qualification approvals
- performance evaluations
❌ Frequent issues:
- “on-the-job” training without validation
- no requalification after changes
- subcontracted work without competence control
⚙️ 3. Service Process Management (Core of VDA 6.8)
This is the most critical section of the audit.
Auditors assess whether:
- service processes are defined and standardized
- risks are identified before execution
- changes are controlled
- performance is measured
✅ Expected elements:
- process flowcharts
- risk analysis (FMEA, risk matrix)
- service KPIs
- SLAs and service specifications
- documentation and traceability
❌ Typical nonconformities:
- undocumented processes
- no risk evaluation for services
- dependence on individual knowledge
- missing traceability of service execution
🔁 4. Change Management & Complaint Handling
Uncontrolled changes are one of the biggest risks in service processes.
VDA 6.8 requires:
- formal change management
- impact and risk analysis
- customer notification and approval
- structured complaint handling
✅ Examples of critical changes:
- IT system updates
- tool or software changes
- relocation or outsourcing
- key personnel replacement
✅ Accepted methods:
- PDCA
- 8D
- 5 Why
- Ishikawa analysis
🤝 5. Supplier & Subcontractor Management
If a service provider uses subcontractors, responsibility remains 100% internal.
Auditors check:
- supplier selection criteria
- monitoring and evaluation
- audit of subcontractors (if critical)
- contractual and NDA compliance
✅ Evidence:
- supplier scorecards
- audit reports
- performance reviews
- confidentiality agreements
🔐 6. Information Management & Data Security
This section is mandatory for IT, software, engineering, and labs.
Auditors expect:
- protection of OEM data
- controlled access to information
- backup and recovery plans
- employee awareness
✅ Typical evidence:
- IT security policies
- role-based access control
- backup logs
- recovery tests
- awareness training
🔗 Strong alignment with ISO 27001
📊 7. Performance Monitoring & Continuous Improvement
A mature VDA 6.8 supplier:
- measures service performance
- analyzes deviations
- improves processes continuously
✅ Typical KPIs:
- on-time delivery of services
- incident rate
- customer complaints
- system availability
- response time
Improvement must be systematic, not reactive.
🧮 How Is a VDA 6.8 Audit Evaluated?
The VDA 6.8 audit uses a standardized questionnaire and scoring system.
Scoring interpretation:
- ✅ ≥ 90% – very robust service provider
- ⚠️ 80–89% – acceptable, improvement actions required
- ❌ < 80% – high risk, not acceptable
🌟 Why VDA 6.8 Matters
Implementing VDA 6.8 helps organizations:
- control indirect quality risks
- gain OEM confidence
- improve service stability
- prevent data and compliance incidents
- differentiate from competitors
🧾 Final Thoughts
VDA 6.8 recognizes a critical reality of modern automotive operations:
services can be just as risky as production processes.
By applying structured audits, risk-based thinking, and performance monitoring, VDA 6.8 ensures that indirect service providers actively support quality — instead of undermining it.