Supplier Monitoring – ACQ.4 in Automotive SPICE®

Why is this process important? Building cars involves many complicated supply chains. OEMs have suppliers who in turn have sub-suppliers who in turn have sub-sub-suppliers. There is so much that can go wrong along these chains. For example, missed subcontractor deadlines have delayed the OEM's start of production. Or a subcontractor’s quality problems causing expensive returns. And nothing in a supply chain works automatically. It requires hard and systematic management at all levels of the chain. And this is what this process is about. Actually, "Supplier Management" would be a more appropriate name for ACQ.4.

By the way, what are "suppliers" in this context? There is no official, binding definition for the kind of suppliers used in this process, so the focus is on suppliers who develop a component of our product, typically a software component or a combination of hardware and software, such as a sensor. The component should be developed according to our specification, as this requires considerable management effort. In contrast, the purchase of commercial off-the-shelf products does not require much management.

The following are the most important aspects of Supplier Monitoring in Automotive SPICE®:

• Define the way of cooperation. You should establish a written agreement on the co-operation. In project management terminology, this is usually called a "supplier statement of work." Here you define interfaces, responsibilities, meetings, joint activities, common processes, reporting and so on. I consider this to be particularly important:
  1. What are your requirements for the supplier development process? In particular, what kind of Automotive SPICE requirements do you request from the supplier?
  2. When, and in what format, will you provide the supplier with your requirements?
  3. How does the requirements review and acceptance by the supplier work?
  4. How do you deal with conflicts if the supplier does not accept requirements?
  5. What tests are performed after the supplier has implemented the requirements?
  6. Which tests are carried out by the supplier and which by you as a customer?
  7. What kind of support do you expect from the supplier after the tests are completed so that their product works in your environment?
• Provide appropriate resources to manage the supplier. It is a common mistake to severely underestimate the capabilities required to manage a supplier. Talking to the supplier from time to time is not enough. An experienced person must invest a reasonable amount of time in managing the supplier. For a large corporation this can be a full-time person who deals with the supplier on a daily basis. Especially for suppliers with cultural and language barriers, the effort can be many times greater compared to a local supplier next door.
• Establish effective means to monitor the supplier's progress. There are two methods:
  1. There is the technical meeting where you can discuss and clarify requirements, technical questions, problems and quality issues. You maintain a list of open items and manage the points until closure. 
  2. And then there is the management part, where you check progress against the schedule, check effort and costs (if it is a time and material contract) and deal with change requests, forecasts and risks. 

Supplier Monitoring – the process according to Automotive SPICE® 

The purpose of the Supplier Monitoring Process is to track and assess the performance of the supplier against agreed requirements. 

BP1: Agree on and maintain joint processes, joint interfaces and information to be exchanged. Establish and maintain an agreement on information to be exchanged and on joint processes and joint interfaces, responsibilities, type and frequency of joint activities, communications, meetings, status reports and reviews. 

NOTE 1: Joint processes and interfaces usually include project management, requirements management, change management, configuration management, problem resolution, quality assurance and customer acceptance. 

NOTE 2: Joint activities to be performed should be mutually agreed between the customer and the supplier. 

NOTE 3: The term “customer” in this process refers to the assessed party. The term “supplier” refers to the supplier of the assessed party. 

BP2: Use the defined joint interfaces between customer and supplier for the exchange of all agreed-upon information. 

NOTE 4: Agreed-upon information should include all relevant work products. 

BP3: Review development with the supplier on a regular basis, covering technical aspects, problems and risks and also track open items to closure. 

BP4: Review progress of the supplier regarding schedule, quality and cost on a regular basis. Track open items to closure and perform risk mitigation activities. 

BP5: Take action when agreed-upon objectives are not achieved to correct deviations from the agreed-upon project plans and to prevent recurrence of problems identified. Negotiate changes to objectives and document them in the agreements. 

Output work products: Commitment/agreement, acceptance record, communication record, meeting support record, progress status record, change request, corrective action register, review record, analysis report 

What is the benefit of Supplier Monitoring?  

With continuous monitoring and control of the supplier relationship and deliverables, the project is aware of the supplier’s performance and ability to deliver their product and to take corrective actions if required. 

What is the content of the Supplier Monitoring Process? 

• Common processes and interfaces are agreed upon and maintained (BP1). 
• Relevant information is regularly exchanged between the customer and the supplier (BP2). 
• The technical development is regularly checked with the supplier and technical aspects, problems and risks discussed (BP3). 
• The progress of the supplier regarding dates, quality and costs is regularly checked. If necessary, risk mitigation measures are implemented. (BP4) 
• Corrective actions are taken when objectives are not achieved. Changes to the agreements are approved and documented between the parties (BP5). 

Experiences, problems and hints: 

• ACQ.4 is required if development of a component is subcontracted, or a purchased component needs to be adapted to a project’s requirements. 
• This can refer to both external and internal development of product components. Supplier control is also helpful and necessary for internal suppliers. 
• The VDA Automotive SPICE Guidelines recommend that ACQ.4 be applied to COTS products as well. 
• Check with your OEM(s) to understand their requirements. 
• Some organizations use supplier employees that are fully integrated in projects. In these cases, ACQ.4 does not apply. In an assessment, this situation should be assessed as part of project management (MAN.3). Whether ACQ.4 or MAN.3 is used to assess the cooperation is based on the actual nature of the cooperation and not on formal, legal aspects. 
• Supplier management can be very labor intensive and is often underestimated, especially for offshore suppliers. Often there needs to be a dedicated role, a Supplier Manager. 
• Even if you impose Automotive SPICE compliance on your supplier, the project still needs to execute the ACQ.4 process where appropriate. 

Want to know more about Automotive SPICE^®? 

Participate in one of our Automotive SPICE® Courses.  

About the author

Thomas Liedtke is a computer scientist by background. After completing his PhD at the University of Stuttgart, he entered the telecommunications industry. Over the course of 14 years at Alcatel-Lucent, he successfully spearheaded a variety of projects and managed several departments. He entered the field of consulting over a decade ago and has been sharing his experience with clients in a variety of industries ever since, primarily in the areas of safety, security, privacy and project management.

He has been involved with several committees, particularly the working group for Automotive Cybersecurity at German Electrical and the VDA Cybersecurity Work Group organized by the (DIN standard NA052-00-32-11AK and ISO standard TC22/SC32/WG11). 

Read our related content

Automotive SPICE® Supplier Monitoring (ACQ.4) resource guide

Services for Automotive SPICE and Extensions