Improvement Action Planning

An Improvement Action Plan (IAP) is the formal output of an ASPICE assessment that didn't meet its target Capability Levels - which is most first assessments. It is the structured, time-bound plan that maps each assessment finding to a specific corrective action, an owner, a deadline, and a verification method. Without a credible IAP, OEM customers have no basis to trust that identified gaps will be closed.

The IAP is not optional after a finding is raised. Most OEM Supplier Quality Agreements (SQAs) specify a mandatory IAP submission deadline - typically 30 to 90 days after the assessment report is issued. Failure to submit an IAP on time can trigger escalation to the supplier scorecard or procurement review.

IAP vs. Corrective Action Plan (CAP)

These terms are sometimes used interchangeably, but in the ASPICE context they have distinct scopes. A CAP addresses a specific isolated defect - a single requirement without a trace link, a missing review record for one document. A IAP addresses the systemic process-level gaps that produced those defects. The goal of ASPICE improvement is not to fix individual document issues but to change the process so that those issues do not recur. An IAP that lists "add missing traceability links" as its only action for SWE.1 will satisfy neither assessors nor OEMs - it needs to address the root cause of why traceability was missing in the first place.

An ASPICE assessment report from a Competent Assessor typically contains: an executive summary (overall CL profile), a process profile table (CL per process), a detailed finding list, and appendices with evidence references. Understanding how to read this report is the prerequisite to building a valid IAP.

The Process Profile Table

The process profile is the most important page in the report. It shows, for each assessed process, the PA ratings and the resulting CL. A typical first-assessment profile for a Tier-1 ECU supplier looks like this:

In this example profile: 6 processes met CL2 target; 4 processes (SWE.1, SWE.3, SUP.8, and the PA-level gap in SWE.2, SYS.2, MAN.3) have gaps. The IAP must address all gaps.

Understanding the Finding List

The finding list provides the detail behind each PA rating. Each finding typically includes: a finding ID, the process and PA it affects, the finding description, the evidence reviewed, the assessor's rationale for the rating, and a recommended corrective action (not mandatory - the supplier defines the actual corrective action in the IAP). When reading findings, distinguish between:

• PA 1.1 Findings - these affect the CL1 base. Until these are addressed, CL2 is unreachable for that process regardless of how strong your management practices are.
• PA 2.1 / PA 2.2 Findings - these affect the CL2 layer. The BP-level work is done, but the management discipline around it is insufficient.
• Weaknesses - these are noted improvement areas but do not prevent the current CL from being achieved. They are still important: in a follow-up assessment, a weakness that hasn't been addressed can be upgraded to a Finding if the assessor determines the situation hasn't improved.

Not all findings are equally important to fix first. The prioritization framework below uses two dimensions: CL-blocking impact (does this finding prevent CL target from being achieved?) and remediation effort (how hard is it to fix?). High-impact, low-effort items must be addressed immediately. High-impact, high-effort items need early project planning to have any chance of being closed in time.

The CL-Impact Triage: Which Processes to Fix First

Using the example profile from above, the triage order is:

1. SWE.1 (PA 1.1 = L) - traceability gaps are the likely driver. This blocks all 6 qualification test cases that link back to the affected requirements. Must be P1.
2. SWE.3 (PA 1.1 = L) - detailed design documentation incomplete. Since SWE.4 (unit tests) depends on SWE.3 detailed design, this gap may invalidate some unit test evidence too. Must be P1.
3. SUP.8 (PA 1.1 = L) - configuration management is the foundation for all GP 2.2 evidence. If CM is weak, all work product management evidence is suspect. Must be P1.
4. MAN.3 (PA 2.1 = P) - project monitoring not documented. This is a P1 because it affects not just MAN.3 but the GP 2.1.3 evidence for every process. Fix the monitoring discipline once and it helps all processes.
5. SYS.2 (PA 2.1 = P) - same pattern as MAN.3 but scoped to SYS.2 process activities.
6. SWE.2 (PA 2.2 = P) - SAD review records incomplete. Targeted fix: complete review records for the SAD.

An IAP submitted to an OEM should be structured, traceable to the assessment report, and contain enough detail to verify progress at a follow-up review. Below is the standard IAP table structure with a worked example for the SWE.1 traceability finding.

Complete IAP for the Example Profile

OEM quality engineers reviewing an IAP will evaluate the quality of the root cause analysis. A root cause that simply restates the finding ("the traceability was missing because we didn't add it") is not a root cause - it is a symptom description. A credible RCA identifies why the existing process allowed the gap to occur, which then enables an effective corrective action that prevents recurrence.

5-Why Analysis: SWE.1 Traceability Gap

Common Root Cause Patterns in ASPICE Gaps

A realistic IAP timeline needs to account for the actual effort required to fix each gap, the project team's availability (they still have development work to do), and the OEM's follow-up review schedule. Most OEMs schedule a follow-up assessment 3–6 months after the initial assessment. This gives 12–24 weeks to close all P1 findings.

IAP Timeline Template

Realistic Effort Estimates for Common Fixes

IAP Submission and Progress Reporting

After submitting the IAP to the OEM, the supplier is typically required to provide progress reports at defined intervals (e.g., monthly). The progress report is a simple update of the IAP table: for each action, update the Status field and add evidence reference. OEM quality engineers do not want to re-read the whole IAP each month - they want to see which items changed status and what evidence proves it.

Use clear status codes: Open (not started), In Progress (started, not complete), Completed Pending Verification (supplier considers it done, awaiting assessor confirmation), Closed (confirmed complete in follow-up review).

What OEMs Check in a Follow-Up Assessment

A follow-up assessment is not a full re-assessment. It is a targeted review of the specific processes and PAs where gaps were found. The assessor will:

1. Review the IAP and confirm that every P1 finding has a corresponding completed action with evidence
2. For each closed action, review the evidence - the same way as in the original assessment (not just reading the IAP claim)
3. Re-rate the affected BPs and PAs based on the new evidence
4. Check that process improvements have actually been applied (not just documented) - interviewees will be asked if they are aware of and following the new process
5. Upgrade closed findings to resolved; note any that are incomplete

Escalation Paths When IAP Cannot Be Closed on Time

If it becomes clear that a P1 finding cannot be closed within the OEM's deadline (due to project schedule, resource constraints, or technical complexity), proactive communication is essential. The worst outcome is for the OEM to discover during the follow-up assessment that an action is not complete - without any prior warning. The right approach: inform the OEM quality contact as early as possible, provide a revised timeline with justification, propose a partial closure plan (remediation complete but process improvement pending), and request a timeline extension in writing through the SQA escalation process. Most OEMs will accept a credible extension request if it is raised proactively with evidence of progress - they will not accept a surprise at the follow-up meeting.