The gaps that fail a first UN R155 CSMS assessment

The pattern behind failed first assessments

Most first UN R155 CSMS assessments do not stall because the manufacturer misunderstood the regulation. They stall because the manufacturer described a management system without demonstrating that it operates. The evidence gap — process written, records missing — is the single most common reason a first assessment does not pass, and it recurs across organisations of very different sizes and maturities.

This is worth internalising before any assessment planning. UN R155 grants a Certificate of Compliance for the CSMS, valid three years, plus per-vehicle-type approval. Both are assessed on evidence that a process ran, not on the elegance of the process description. A team that spends its preparation time polishing policy documents and none of it producing records is preparing for the wrong assessment.

The five recurring gaps

The gaps that stall first assessments cluster into five patterns. Each is a failure of demonstration rather than of intent, and each is closable if it is found early.

Gap	What it looks like	Why it fails
Evidence gap	Complete policies, no records of the process running	UN R155 is assessed on proof the process ran, not on the description
Weak supplier flow-down	Cybersecurity requirements not passed to Tier-1/Tier-2, no evidence returning	The OEM carries the approval but cannot show the supply chain is covered
Stale TARA	A TARA produced once, not maintained as the design changed	Goals and requirements no longer trace to current risk
Broken traceability	Verification results that do not link back to requirements	The assessor cannot confirm mitigations were actually tested
No monitoring	No functioning post-production detection capability	R155 requires monitoring across post-production, and it is absent

The evidence gap

The commonest failure is also the simplest to state. A procedure says a review happens at a defined gate; the assessor asks to see the review record; there is none. The fix is not more documentation — it is producing records as a by-product of doing the work, so that dates and owners exist without a reconstruction exercise the week before the audit. What the assessor actually opens, artefact by artefact, is set out in what evidence the assessor actually opens.

Weak supplier flow-down

The OEM holds the type approval but depends on the supply chain for much of the substance behind it. A CSMS with strong internal records and no supplier trail is only half-assessed. ISO/SAE 21434, the cybersecurity engineering standard UN R155 leans on, frames the OEM–supplier relationship through cybersecurity interface agreements — the mechanism by which requirements flow down and evidence flows back. When these are absent or signed too late to have produced anything, the gap is visible immediately.

The stale TARA

A threat analysis and risk assessment (ISO/SAE 21434 clause 15) is the origin of the cybersecurity goals and, through them, the requirements. When the TARA is written once and never revisited, it stops matching the design it is meant to describe. The assessor checks not only that a TARA exists but that it was maintained as the design changed and that its outputs still flow into requirements and verification. A frozen TARA breaks that chain.

Broken traceability

Verification and validation results only carry weight if they trace to the requirements they satisfy. Penetration-test reports and requirement-based test results that float free of the requirements — or requirements that no test addresses — leave the assessor unable to confirm that claimed mitigations were tested. Traceability is what turns a pile of test reports into a cybersecurity case.

No monitoring

UN R155 requires the CSMS to detect and respond to attacks and to monitor across post-production. First-time programmes frequently arrive with development-phase discipline and no operational monitoring capability at all. Because the certificate is valid three years against a management system that must keep operating, an absent monitoring function is a structural gap, not a minor one — the reasoning is developed in the vehicle SOC and post-approval monitoring.

Closing the gaps before the assessor arrives

The most effective single practice is a dry-run assessment: read your own dossier in the exact order an assessor will — process, then the records demonstrating it, then the type-specific evidence. Apply one test to every claim in a process description: can you point to a dated record with a named owner that shows it being met? Where the honest answer is "we would do that" rather than "here is where we did that," the item is not yet assessable, and that list is your remediation plan.

Sequence matters too. Supplier flow-down and monitoring take the longest to stand up because they depend on other parties and on time-in-operation, so they should start first, not last. A structured, sequenced route to an assessable state — for Indian programmes in particular — is laid out in an AIS-189/190 readiness checklist.

The AutoSifu view

Failed first assessments are almost always predictable, which means they are almost always preventable. AutoSifu works with CIRT as one route — compliance, solutioning and CoC/VTA support with the approval body in the room — so the dry-run happens before the real assessment and the gaps are closed while there is still runway. The goal is an assessment with no surprises, because the evidence was built to be opened.