Chapter 3.

Contingency Plans

Contents:
0) Introduction
1) 6.1.2.3 Contingency Plans (IATF16949)
2) SIs & FAQs 4
3) Q&A
3) Supplementary Notes
4) Exhibits

0) Introduction
There is only one applicable clause in this chapter. The reason why a whole chapter is devoted to this
is because the Clause is often misunderstood and poorly catered for. Many NCs have been written on
this clause alone.

1) 6.1.2.3 Contingency Plans (IATF16949)

(Clause Description-Paraphrase)
The organization shall ensure some critical points on contingency planning: (a) identification of
emergencies that can interrupt production and delivery. (A list of potential emergencies is given by
IATF), (b) Evaluation of the risks and provide appropriate preventive actions and countermeasures. (c)
conduct test out and annual review of these action plans, (d) for actual emergencies, notification of
customer and interested parties, (d) validation of product conformity after re-start, following an
emergency and improper shutdown. (Author: There is another item added ‘Cyber-attack’, via SI-5)

(Highlights of the clause)

• (Ref to old Standards) There has been a similar clause (6.3.2) of the same title, in the old
version of ISO/TS16949. The previous clause was skin deep. It only required the organization
to “prepare contingency plans to satisfy customer requirements in the event of an emergency”
• Now IATF provides 9 potential emergencies to be evaluated for contingency planning. Then
there is another item added -Cyber-attack, via SI-5.
• Total list therefore is: key equipment failures; interruption from externally provided products
processes, and services (shortage or nonconforming quality); recurring natural disasters; fire
(outbreak); utility interruptions; labour shortages; or infrastructure disruptions cyber-attack.
• The above list is minimum, you can add more items pertaining to your specific situation.

(Compliance Best Practice)

6.1.2.3 Contingency Plans
1. To comply with this clause, you need to list out all the potential emergencies. It shall
include the 10 items given in Clause Description + SI-5. See Exhibit 3-1.
2. Priority for action shall be based on production and delivery impact to customers (not
those of your organization).
3. These potential emergencies shall be analysed. You should use your operating history, and
your current preventives as the baseline for residual risks. You can use the 4X3 risk table
for the scoring, to derive the residual risks. See Exhibit 2-6.

1
 4. List out the response actions for each item at the extreme right column of the form. To
save time, bullet points can be used for most cases. Simple action plans or full project plan
should be used only in more critical cases.
5. Please note that point 4 above is referring to RESPONSE plan, not improvement plan.
Many such mistakes have been spotted in field practices.
6. For improvement and corrective actions, they shall be managed outside this form, as an
continual improvement plan etc.
7. AnnuallyAnnual review of the contingency plan is required, with involvement by Top
Management. See Exhibit 3-4.
8. Testing (sometimes called simulation) for the high-risk emergencies is also needed. See
Exhibit 3-2 and Exhibit 3-3.
9. Notify customer and interested parties as appropriate, when emergencies occur
10. Contingency Plans must include product conformity validation after the emergencies
(where applicable). The testing form has a space to record this point and point 9.

2) SI & FAQ

SI Nbr IATF Clause Description

2
 FAQ IATF Clause Questions and Answers

3) Supplementary Notes
Legend: HOC= Highlights of Clause, CBP= Compliance Best Practice, S&Q= SIs & FAQ, EXH= Exhibits
Clause Section Clarification Subjects
6.1.2.3 CBP SN3.1 What do you mean by “according to risk and impact to the
customers’?
6.1.2.3 CBP SN3.2 Can I change the baseline (current controls), after doing some
improvement?
6.1.2.3 CBP SN3.3 Can I use Business Continuity Plan, instead of contingency
plan?
6.1.2.3 CBP SN3.4 Must I use the exact wording for the various types of
emergencies, or am I allow to use my own description?
6.1.2.3 CBP SN3.5 If there is an emergencies that does not occur, will not occur,
do I still score the risks?
6.1.2.3 CBP SN3.6 If the final risk is low, do I still need to provide action plans?
6.1.2.3 CBP SN3.7 Why is there a need to score the final risk, when it is not
mentioned in the clause?
6.1.2.3 CBP SN3.8 Can I combine this analysis with Risks and Opportunities
analysis?
6.1.2.3 CBP SN3.9 Why are we concerned with response and not improvement
in this exercise?
6.1.2.3 CBP SN3.10 You said manage the additional improvement or preventive
measures outside the contingency form. How do I do that?
6.1.2.3 CBP SN3.11 What is meant by testing, or simulation?
6.1.2.3 CBP SN-3.12 Can actual incident be used for testing? How do we do
that?
6.1.2.3 CBP SN3.13 Is testing not same as review? Do I need to do both?
6.1.2.3 CBP SN-3.14 Do Top Management really need to be present in the
review?
6.1.2.3 CBP SN3.15 When to inform customer in the event of an emergency?
3
 6.1.2.3 CBP SN3.16. What is meant by “contingency Plans must include product
conformity validation after the emergencies”?

SN3.1 What do you mean by “according to risk and impact to the customers’?
It means prioritization shall be based on risk and impact to the customers, not to your own
organization. When you do risk scoring, this will be the criteria to use.

SN3.2 Can I change the baseline (current controls), after doing some improvement?
Of course you can. IATF expects you to do that too. If you have improved, then the document
(contingency planning sheet) shall be revised, and the final risks re-scored. Remember it has to be a
document revision so changes are tracked.

SN3.3 Can I use Business Continuity Plan (BCP), instead of contingency plan?
There is no prescribed form to use. Exhibit 3-1 is just an example of how to tabulating the contingency
plans. Business Continuity Plan tends to have a wider scope and has a slightly different meaning from
the Contingency Plan of IATF. But you can use it so long the requirements of IATF are included into
your BCP. There are some organizations doing so, and quite neatly too.

SN3.4 Must I use the exact wording for the various types of emergencies, or am I allow to use my
own description?
You only need to comply to the requirement in gist, not necessarily in the exact wordings used in the
Standard. Manpower shortage and workers-on-strike can mean roughly the same thing. You can use
either.

SN3.5 If there is an emergencies that does not occur, will not occur, do I still score the risks?
An emergency is something you cannot predict for sure. The big flood in Ayutthaya of Bangkok was
never expected, yet it happened, and flooding out thousands of factories there. The Covid-19
pandemic had never cross anybody’s mind yet it happened. You must still do the scoring for the risks
listed. You can score either ‘Low’ or even ‘NA’. The heading however, cannot be removed.

SN3.6 If the final risk is low, do I still need to provide action plans?
You can decide on this. It is not important and IATF auditors won’t split hair over a low risk finding.

SN3.7 Why is there a need to score the final risk, when it is not mentioned in the clause?
Rating the risk is not directly mentioned as such, but it is implied. 6.1.2.3 (a) states ‘identify and
evaluate internal and external risks…’ So you have to evaluate (score) the risks.

Another supporting point is that scoring the risks is good for you. With the final scores, you only have
to focus on the higher risks for simulation. Otherwise you have to do simulation on all risks, since there
is no indication which ones are important and which ones, not.

SN3.8 Can I combine this analysis with Risks and Opportunities analysis?
This is quite commonly done, presumably due to the creativity of some consultants. However, that is
not the intent of ISO. If it is, ISO would have used a single clause to cover the 2 requirements. Although
there are similar elements in both the analysis, their purposes are different. Risk and Opportunity
analysis is to understand where the R&O are, and then provide improvement where applicable.
Contingency plan, on the other hand, is about response to emergencies. Therefore the 2 exercises are
meant to be done on separate platform and documentation.

SN3.9 Why are we concerned with response and not improvement in this exercise?
Contingency plan is meant to deal with an emergency, despite of all the preventives and preparedness
in place. It is not about improvement at that particular point in time. What the customer wants is: you
4
continue to deliver the supplies on time, whatever happens. You have to figure out how you would do
that, and that is the response we are talking about. Investigation and improvement can come later,
after the customer’s key concern is addressed.

SN3.10 You said manage the additional improvement or preventive measures outside the
contingency form. How do I do that?
You can carry out the improvement as a continual improvement project. Alternatively, you can go
back to R&O and use the format there to manage areas of weaknesses. See 4.1 and 6.1.

SN3.11 What is meant by testing, or simulation?

Testing means to test out the response plan. It is usually done by means of simulation, similar to the
concept of fire-drill in EMS, or OHSMS, or a recall in FSMS. Organizations often show IATF auditors a
fire-drill, pull out directly from EMS as an evidence of Contingency Plan simulation. They missed the
point totally. Fire-drills are to primarily to protect lives and properties. The drill does not attempt to
review continued supply to customers, despite of the fire.

SN3.12 Can actual incident be used for testing? How do we do that?

Yes, actual incident can be used for testing. In fact it is more superior than a simulation. It has actually
occurred; and the response and results can be used to compare with the response plan to gauge
effectiveness. Improvements can then be suggested.

SN3.13 Is testing not same as review? Do I need to do both? How to I review a contingency plan?
Yes you have to do both. Let’s look at the clauses first. Review is 6.1.2.3f, and testing is 6.1.2.3e, which
state both are required. Most organizations do not carry out the review, thinking simulation
conducted will automatic cover this requirement. This is incorrect. Testing is only on 1-2 emergency
items, but the contingency plan has minimum 10 potential emergencies.
The best method for contingency plan review is to run a review meeting. You gather the relevant
people to make up the multi-disciplinary team required, and review through the contingency plan,
point by point. To save time, you may also ask each PIC to review on his/her own area and come to
the meeting to present the findings and conclusions. The group can then help to give feedback and
finalize the review. The conclusion of review may result in revisions to the contingency plans. In the
event there are no changes, evidence in the form of minutes taken, or remarks on the review
contingency plan copy retained. If you keep a document change history, changes and conclusions can
also be recorded here.

SN3.14 Do Top Management really need to be present in the review?

Yes, according to the Clause. But in reality, some flexibilities are allowed. This would be a little over-
killing to insist top management to sit through such a meeting. IATF Auditors do understand top
management is hard pressed for time. Requesting Top Management to approve the revised
documentation should suffice. It will be better if QMR can do a debriefing, in particular, on the changes.
It will even be best, if Top Management can be present for some parts of the review meeting to get a
feel how this is done.

SN3.15 When to inform customer in the event of an emergency?

This is according to the contractual agreement you have with the customer. Generally speaking, if you
are more confident of handling, you can take a longer time to inform. If you are not so confident, you
should inform the customer as early as possible. This is to allow them to make other arrangements or
assist you in some way. Otherwise you may be slapped by a big claim.

5
SN3.16. What is meant by “contingency Plans must include product conformity validation after the
emergencies”?
This does not apply to all situations. It is only applicable where the production run is interrupted e.g.
by machine break down, workers on wildcat-strike. The product in process may be deteriorated due
to extended exposure, a change of operating conditions, and processed not according to plan. Under
the circumstances, the product must go through the first piece buy-off again.

 Continuing 

6
4) Exhibits
Exhibit 3-1. Contingency Plan

7
Exhibit 3-3. Contingency Plan Testing - Simulation

8
Exhibit 3-2. Contingency Testing-Real Occurrence

9
Exhibit 3-4. Contingency Plan Review. Page 1

10
Exhibit 3-4. Contingency Plan Review. Page 2

>>End of Chapter 3 <<

11