Registering and handling a nonconformity: steps and an NCR example

What is a nonconformity?

A nonconformity, in Dutch also called an afwijking, is a failure to meet a requirement. That requirement can come from many sources: the customer's specification, your own work instruction, a standard such as ISO 9001, a law or an agreement in the contract. It is a gap between what should be and what is, whether or not the product is actually bad as a result.

ISO 9001 asks you to identify, record and handle nonconformities (clause 10.2), and to control products or services that do not meet the requirements so that they do not reach the customer by accident (clause 8.7). For the full CAPA route, see our guide on corrective and preventive actions. This guide focuses on registering and handling the nonconformity itself.

Nonconformity, complaint, incident or audit finding: what is the difference?

In practice these terms get mixed up, and they do genuinely overlap. The same event can be a complaint from the customer and a nonconformity in your process. It helps to know the starting point of each term, so that you sort reports in the same way and do not record anything twice or not at all.

• Nonconformity: a requirement has not been met, regardless of who notices it
• Complaint: a customer expresses dissatisfaction and expects a response. A complaint often leads to a nonconformity, but not always, because the customer may expect something that was never agreed
• Incident: an event with consequences for safety, health, damage or the environment. It is also a nonconformity if a requirement was breached
• Audit finding: the outcome of an audit. A nonconformity is one kind of finding, alongside strengths and improvement points
• Improvement point or observation: the requirement is still being met, but there is a risk that this will not remain the case

The eight steps of a nonconformity, from detection to closure

A fixed order prevents you from jumping to a solution too quickly or letting a report sit. Not every nonconformity goes through all steps in equal depth. A small one-off error you close after step four, while a serious or recurring deviation you work through completely.

• Detect: someone sees that a requirement is not being met, for example at goods inspection, production, handover, customer contact or an audit
• Record: number, date, location, requirement and facts in an NCR, with photos or measurements
• Contain and correct: prevent the product or service from reaching the customer and repair what can be repaired
• Assess the severity: determine consequence, extent and risk, and who must be informed
• Investigate the cause: find the root cause and check whether the same thing could happen elsewhere
• Choose a corrective action: assign an owner and a deadline
• Check effectiveness: after a predetermined period, check that the deviation no longer occurs
• Close: with an explanation and evidence, and use the data for your trend analysis

Containing, correcting and assessing the severity

The first question is what should happen to the product or service now. ISO 9001 mentions a number of routes: repairing, segregating and blocking, returning, suspending delivery, informing the customer or asking the customer for permission to accept it anyway, a concession. Which route fits depends on the risk and on what you have agreed with the customer. Decide beforehand who makes that call.

Then assess the severity. A commonly used scale is small, large and critical, for example based on the consequence for the customer, safety, legal requirements and the size of the batch. Certification bodies often use minor and major in audits, with criteria that differ per scheme. So use the classification that your certification body applies.

What does a good NCR form contain?

An NCR form (nonconformity report) is the file for one deviation, from detection to closure. It does not have to be long, but someone who does not know the deviation must be able to see what was going on and what was done. These are the fields you need at a minimum.

• NCR number, date and who detected the deviation
• Product, process, order, project or location concerned
• The requirement that was not met, with its source, such as a drawing, standard or contract
• What was found: facts, quantities, measurements and photos
• Severity according to your own scale
• Immediate correction and containment, with who did it and when
• Customer or supplier involved, and whether they have been informed
• Cause analysis and root cause
• Corrective action with owner and deadline
• Decision on whether a full CAPA is needed, with the reason
• Effectiveness check: when, how and by whom
• Closure with date, explanation and evidence

Worked example: an NCR from production

A fictional example, with quantities that only illustrate. A company powder-coats steel frames for a customer who requires a minimum coating thickness. At final inspection the inspector measures a sample and finds values below the minimum. This is what the NCR looks like, step by step.

• Finding: in a sample of 20 frames, 4 are below the customer's minimum coating thickness, so the whole batch of 300 is suspect
• Containment: the batch is blocked and all frames are re-measured
• Correction: the rejected frames are re-coated and the customer is told the delivery will be a day late
• Severity: large, because the customer specification is affected and it has happened before
• Cause with 5 whys: after a colour change the spray gun was set differently, no measurement is taken after a colour change and the work instruction only asks for a final inspection
• Corrective action: the work instruction requires a measurement of the first three frames after every colour change. The owner is the production manager, deadline in two weeks
• Effectiveness check: after three months, verify that there are no NCRs on coating thickness and that the measurements after colour changes have been recorded
• Closure: after the check the NCR is closed, and the data feeds into the trend analysis

Cause, corrective action and effectiveness

The correction solves today's problem, the corrective action makes sure it does not come back. Stopping at the first explanation, such as a human error, rarely produces a measure that works. Keep asking until you reach something you can change in the way of working, the instruction, the machine or the planning, and check whether the same cause could play a role elsewhere.

Decide beforehand in which cases you open a full CAPA: for a serious deviation, a repeat or a pattern. For the full CAPA route with cause analysis, measures and effectiveness check, see our guide on corrective and preventive actions. Plan the effectiveness check together with the measure, using a measurable indicator, for example the number of repeated NCRs after three months.

The same logic applies in services. A fictional example: after three maintenance visits in one month, the inspection report was not sent to the customer within the agreed five working days. The requirement is the period in the service contract, and the correction is sending the reports after all. The cause is that nobody owns sending them after the visit, so the measure is a fixed task in the planning.

Common mistakes when registering nonconformities

Most NCR processes fail not at detection but at everything that comes afterwards. This rarely happens out of unwillingness and almost always because nobody sees the deviation as their own job. If you recognise any of these points, it pays to tighten your way of working.

• Fixing only the symptom and leaving the cause in place
• No owner: an NCR that belongs to everyone belongs to no one
• Never closing NCRs, or closing them without checking that the measure works
• Turning every small deviation into a full CAPA, so that the real problems get lost
• Pointing at a person as the cause instead of the way of working
• Not informing the customer or supplier when you should have
• Not recording deviations that are repaired on the shop floor straight away, so you cannot count them either
• Keeping NCRs scattered across email, Excel and minutes

Trend analysis: learn from all your NCRs together

One NCR is an incident, a hundred NCRs are a source of information. Group them by process, product, supplier, location and type of cause, and look every quarter at what stands out. A process with many small deviations often calls for a structural approach that no single NCR forces.

Also look at the lead time from report to closure, at the number of NCRs that stay open longer than agreed and at repeats of the same deviation after closure. That last one says something about the quality of your cause analysis. Take the results to the management review, because ISO 9001 expects you to analyse data and use it to improve.

How BrydgeOne supports this

With Quality reports you record internal nonconformities, supplier deviations, complaints and audit findings in one register, with a fixed route from Reported through Investigation and Measures to Closed. You link the customer or supplier to the report and AI suggests the title and severity, marked with an icon so that you can check them. For a structural problem you create a CAPA with 5 Whys, root cause and effectiveness check, and the Verification tab shows what is still missing before you close.

Measures appear as an action with an owner and a deadline in Actions. In Audits you record findings with a severity ladder: a minor requires a corrective action and a major a CAPA. BrydgeOne helps you collect evidence for ISO 9001, but it does not certify and does not guarantee that you comply.