GM's 'recall of the century' passed every quality gate. That's exactly the problem.

Three OEMs walked into a recall last week. GM issued what the press is already calling the recall of the century. Ford pushed through its 51st U.S. recall of the year – more than any other automaker – the same week it was celebrating a quality award. BMW recalled nearly 11,000 cars in South Africa. Three companies, three continents, one week. All IATF 16949 certified. All running full APQP, PFMEA, PPAP. All with quality manuals thicker than the engine blocks they bolt together.

The standards didn't fail. They never do. The gates did.

How a PFMEA becomes approval theatre

I've sat in enough PFMEA reviews to know what they look like in practice. A cross-functional team gathers in a conference room with coffee and a spreadsheet. Severity 8, occurrence 2, detection 3. RPN: 48. Green. Next line. Severity 9, occurrence 1, detection 2. RPN: 18. Green. Next line. The numbers always seem to land in the green because the people assigning them have been conditioned to land them there. The PFMEA stops being a risk assessment. It becomes a release document – something that exists to say "we considered this, moving on."

The physics eventually disagrees.

When a PFMEA says occurrence is 2 and the field failure rate says it's 6, nobody goes back and revises the document. They issue a recall. The gap between what the risk analysis predicted and what the customer experienced is never reconciled in real time. It gets reconciled in court, or in a NHTSA database, or in a press release that uses the phrase "abundance of caution."

I've seen PFMEA files where the occurrence ratings were copied from a previous platform, a previous plant, a previous decade. The process had changed. The tooling had changed. The supplier had changed. The RPN had not. That's what approval theatre looks like – documents that perform diligence without delivering it.

Stop authority is the only gate that matters

A quality gate without stop authority is a suggestion box with a sign-off sheet.

Every OEM has gates. Design reviews, design validation, process validation, pre-launch audits, safe launch. What nobody asks is who has the authority to hold one open. Not who signs it – who can refuse to sign it and survive the meeting that follows.

In most organisations, the quality manager raises a concern, the programme manager notes it, the plant manager overrides it, and production starts. The concern gets logged as an action item with a due date three months out. Three months later, that action item is still open and 80,000 vehicles are in customers' driveways with a defect that someone predicted, documented, and was overruled on.

The difference between catching a defect at PFMEA and catching it at NHTSA is about 18 months and several hundred million dollars. But the information was there. In the FMEA. In the capability study. In the safe-launch data that trended wrong for six weeks before someone decided the trend was "within tolerance."

I've been the person who had to de-escalate after gates like that failed. Getting to zero critical customer escalations within a quarter didn't come from better documentation. It came from giving the people who saw the trend the authority to stop the line – and backing them when they did.

What restructuring gate authority actually looks like

When I took over quality at a 900-employee greenfield plant, the gates were advisory checkpoints. Quality flagged issues, production noted them, and the schedule moved. We were bleeding defect costs. The fix wasn't more documents – we had enough paper to wallpaper the assembly hall. The fix was making every quality gate a mandatory stop point.

A gate couldn't close with open red items. Period. The quality function held the pen on closure – not the programme office, not the plant manager. And any override required a documented deviation signed by two levels above the person who raised the concern, with a hard expiry. No permanent exceptions.

70% defect-cost reduction in one cycle. Not from adding standards. From enforcing the ones we had with real stop authority.

Later, at Airbus, I applied the same principle to EASA compliance. We cut audit findings by 50% in a single cycle. We didn't write new procedures. We restructured who had authority at each gate, made the stop conditions explicit and non-negotiable, and – this is the part most organisations skip – made it psychologically safe for engineers to raise the flag. A gate is only as good as the person willing to stand in front of it and say "not yet."

A recall is what happens when a quality system was designed to approve rather than to protect.

The architecture is the defect

You can score well on internal quality metrics and still recall vehicles every week. Ford did – 51 times this year, the same week one of its quality scores was being celebrated publicly. The metrics measure the gate process. The recalls measure reality. When those two diverge this badly, the measurement system is the defect.

GM's recall of the century passed every gate. Design review – passed. PFMEA – completed. Process validation – signed off. Pre-launch audit – green. Safe launch – launched. Then the cars went to customers and the cars failed. Not because the standards were weak. IATF 16949 is not a weak standard. APQP is not a weak framework. The weakness is structural: the gates are built to approve, not to stop. Passage is the default and hold is the exception. Reverse that – make hold the default and passage require evidence – and the entire system changes character.

The recall of the century wasn't caused by a bad part. Bad parts are caught every day in plants that work. It was caused by a quality system designed to say yes – at every gate, every review, every sign-off – until the only entity left with stop authority was the customer.