Common Assessment Findings & Solutions

An assessment finding is a documented observation made by the assessment team when evidence does not fully satisfy one or more Base Practice (BP) or Process Attribute (PA) indicators. Findings are not binary pass/fail - they are ratings (N/P/L/F) applied to specific indicators, with the finding statement explaining the gap.

There are two categories of finding output from an ASPICE assessment:

• Strength - something the assessed organization does particularly well. Documented but does not change ratings.
• Weakness - a gap between evidence and indicator requirement that prevents a BP or PA from being rated Largely or Fully achieved. Weaknesses are the primary driver of CL ratings.

This lesson presents the findings most frequently observed in automotive ECU supplier assessments worldwide - based on published PISA data, intacs community reports, and typical patterns from actual supplier audits. Understanding these patterns before an assessment is the most efficient preparation possible.

SWE.1 - Software Requirements Analysis

SWE.2 - Software Architectural Design

SWE.4 - Software Unit Verification

SWE.5 - Software Integration and Integration Testing

SUP.1 - Quality Assurance

SUP.8 - Configuration Management

MAN.3 - Project Management

Across thousands of ASPICE assessments, certain finding patterns recur regardless of organization size, country, or technology domain. These are structural failures rooted in process design, not execution failures rooted in individual mistakes.

Pattern 1: The Documentation Lag

Work is done correctly - design decisions made, tests written, architecture evolved - but the documentation lags the actual work by weeks or months. At assessment time, the documents either don't exist for the assessed phase, or they describe a different state of the system than what was actually built. This creates findings at every SWE process simultaneously. Root cause: documentation is not integrated into the workflow, it is an afterthought. Resolution: treat work products as Definition-of-Done criteria for each process phase - you cannot close a SWE.1 sprint without an updated, reviewed SRS.

Pattern 2: The Tool Silo

Requirements are in DOORS. Architecture is in Visio. Tests are in LDRA. Defects are in Jira. Project plans are in MS Project. Each tool is used well in isolation, but there are no links between them - traceability exists within tools but not across them. An assessor asking "show me the test cases that verify requirement R-123" cannot be answered by any single tool view. Resolution: invest in cross-tool traceability. Modern ALM platforms (PTC Integrity, Polarion ALM, IBM ELM) support cross-artifact linking. Alternatively, maintain an explicit traceability matrix in a controlled document that bridges tool boundaries.

Pattern 3: The Generic Practices Gap

Organizations achieve CL1 (processes are performed, BPs have evidence) but fail CL2 because the Generic Practices (PA 2.1 - Performance Management; PA 2.2 - Work Product Management) are not in place. CL1 evidence shows the work was done. CL2 evidence shows the work was planned, tracked, and the work products were managed (versioned, reviewed, baselined). The most common CL2 failure: no evidence that SWE processes were monitored against a plan. Assessors ask: "Where in your status reports does it show whether SWE.1 was on schedule?" If the answer is "it is tracked in Jira stories," show the Jira burndown tied to the SWE.1 milestone. If that link does not exist, CL2 PA 2.1 will be rated P (Partially).

Not all findings have equal impact. A weakness in a minor BP may leave the process at CL1 with a "Largely achieved" rating. A weakness in a core BP or a PA 2.x attribute can prevent CL1 or CL2 achievement entirely.

Prioritizing Findings for Action

After an assessment, the organization receives a findings list that may contain 20–60 individual observations across all processes. Not all can be addressed simultaneously. Prioritize by:

1. CL impact - fix the findings that prevent CL1 achievement first (N-rated BPs), then findings blocking CL2 (PA 2.1/2.2 gaps), then findings that improve quality but don't change ratings
2. Cross-cutting impact - a traceability process gap affects SWE.1, SWE.2, SWE.5, SWE.6, SYS.2, SYS.5 simultaneously. One structural fix resolves multiple findings.
3. OEM re-assessment timeline - if a re-assessment is scheduled in 6 months, focus on findings that can realistically be resolved with evidence by then. A new process introduced 2 weeks before the re-assessment will have no credible evidence.

The Improvement Action Plan (IAP)

Most OEMs require a formal Improvement Action Plan (IAP) within 4–6 weeks of the assessment closing. The IAP must address every weakness finding with: a description of the planned corrective action, the owner, the target date, and measurable completion criteria. Assessors at the re-assessment will check IAP execution - if an action was planned but not completed, or completed without evidence, it will be re-rated.

Structure your IAP with the same process-level grouping as the assessment findings. One root cause may address multiple findings - call that out explicitly to demonstrate systemic thinking rather than point solutions.