In addition to the responses so far I would suggest that when responding to the auditor/certification body you must keep it simple and directly address what they ask for:
1) Your auditor wrote they were missing 'evidence of a plan per supplier' - So create a SIMPLE realistic plan
2) You were not 'utilizing a risk assessment' - So implement a risk assessment in a way that helps YOU determine the suppliers to focus on. As this is IATF auditors tend to love
FMEA, bu that is not mandatory
3) I do not have the same customers as you, but as is finding is 'MAQMSR document as required by FORD and Stellantis' - State to the auditor how you address the specific points in the finding.
As earlier mentioned you can't make a supplier become IATF 16949 & there will be a certain amount of 'lip service' so try to focus on the few suppliers where you know/think there are issues & use this to drive improvement to help YOUR company; this may not end up with them being IATF, but you may get something that actually helps you.