Chapter 10.3 from IATF

There are many methods for continuous improvement activities, one of them is FMEA and risk analysis. But you don't have to write every improvement action here. FMEA can be updated especially if it is about the product and production process, and if it is about process improvement, the relevant process risk analysis can be updated.

Apart from this, improvement plans, kaizen studies, suggestion systems, etc. are also evidence for this issue.

You can detail the above-mentioned issues by defining the continuous improvement process.

Many thanks for clarification. So i should be update our internal procedure because i was confused about the way to do it. Thank you again

I just received an IATF16949 NCN for a YoY CI (Continual Improvement) project for a large $ scrap CI project that had the PPM and the cost listed as Current/Future desired state but it did not use the word "Risk" nor did it have an assessment of the risk.  The risk was assumed in the high cost and high PPM rate. Everything is contained within the four walls of the factory. There is no risk to the customer. It's a chronic issue driving internal costs.  The cause path is a Bill-Of-Design issue (a design issue internal to a software algorithm). My company does not do DFMEAs for this type of internal defect. The IATF auditor said all CI projects need a RIsk analysis because IATF16949 states the requirement as a "shall always do Risk Analysis for all CI projects". I tried stating the risk is assumed common sense due to the high cost and high PPM (saying it this way may of been my big mistake).  The countermeasure the auditor will accept is all CI projects will have a FMEA type risk analysis which is stated in the IATF16949 10.3.1 section. This means all our performance metrics which have thousands of CI projects per year will all require a FMEA Type assessment of risk.  Have you seen the new VDA/AIAG FMEA worksheet? This effort is going to cost a lot of money updating the CI process, training, doing, auditing, and figuring out a common risk analysis for all CI projects. I don't see the value from where I sit.  Does anyone know of a less-effort countermeasure that IATF will accept?                  

First of all, the issue of high scrap should be included in your company's risk analysis. As a result, risks are fed by unfulfilled goals, trends that go higher than expectations, internal and external changes, and chronic problems.

Meanwhile, the high amount of scrap affects not only internal costs and profitability but also timely shipment to the customer.

If I were you, I would mention these issues in my production or quality process risk analysis.

In addition, the 6.1.2.1 Risk analysis article of the IATF 16949 standard  mentioned that, 

"The organization shall include in its risk analysis, at a minimum, lessons learned from product recalls, product audits, field returns and repairs, complaints, scrap, and rework. The organization shall retain documented information as evidence of the results of risk analysis.’’

Therefore, such lessons learned shall be noted sometimes in the D-FMEA and sometimes in the P-FMEA. If your company is not responsible for the design, of course, it does not need to use D-FMEA, but there may be areas in P-FMEA that need to be updated.

Whether it is AIAG FMEA rev 4 or AIAG&VDA FMEA; Error type, error reasons, and actions can be updated due to these scraps, which is expected.

But I cannot say that every CI project should be subject to risk analysis or P-FMEA, it is necessary to look at it on a case-by-case basis.