Nonconformance Is Not an Error Report — the Right Way to Handle It in ISO 9001

2026-10-04

Executive Summary

• A nonconformance is a failure to fulfil a requirement. Reporting it (the NCR) isn’t about finding who’s at fault; it’s about knowing what isn’t meeting requirements and handling it under control.
• ISO 9001:2015 has two relevant clauses: 8.7 (control of nonconforming outputs: dealing with the product or service) and 10.2 (nonconformity and corrective action: dealing with the cause).
• NCRs become a formality when they’re filled in to satisfy audits, written late, vaguely described, and nobody reviews trends. The bigger risk is not reporting: a quarter with “no NCRs” isn’t necessarily good news.
• The greatest value of NCRs lies in aggregated data: repeat failures by type, process, supplier, shift.
• Not every NCR needs CAPA. You need criteria for when to stop at correction and when to go further.

Two quarters with no NCRs

A plant reports at quarter-end: no nonconformances recorded. Leadership is pleased. An external auditor, hearing that, often asks the same thing back: “Really?”

They ask because experience shows a real manufacturing operation, with real people, equipment and materials, rarely runs flawlessly for three months. If there are no NCRs, there are two possibilities. Either everything truly was perfect. Or what went wrong is being dealt with somewhere, but not entering the system.

The second is more common than people think, and it shows why nonconformance is so often misunderstood. It isn’t an error report to be filed. It’s the quality system’s most important data input.

What nonconformance means under ISO 9001

In ISO 9000 terminology, a nonconformity is the non-fulfilment of a requirement. “Requirement” is broad: it can come from a customer, a regulation, a standard, or the company’s own internal process.

That has practical consequences: a nonconformity isn’t only a “defective product.” It can appear in four places:

• Product or service: a batch that fails inspection.
• Process: a step not carried out as the released procedure says.
• System: a requirement of the standard not met, typically found through an internal or external audit.
• Customer feedback: a complaint about quality or delivery.

The statements about the standard below are based on ISO 9001:2015, summarized in practical terms.

Clause 8.7 (control of nonconforming outputs) focuses on product and service. The organization must identify and control nonconforming outputs to prevent unintended use or delivery. Handling depends on the nature and effect, and may include correction, segregation, containment, return or suspension of supply, informing the customer, and obtaining authorization for acceptance under concession. After correction, conformity must be verified. The organization must retain information describing the nonconformity, the actions taken, any concessions obtained, and the authority that decided the action.

Clause 10.2 focuses on cause: evaluating the need for action to eliminate the cause, implementing it, and reviewing its effectiveness. That part is covered in more depth in Effective CAPA: Why Corrective Actions Often Don’t Correct Anything.

The two clauses complement each other. 8.7 answers “how do we handle what went wrong.” 10.2 answers “how do we stop it going wrong again.”

Why NCRs become a formality

From what’s seen across many manufacturing operations, these problems show up most often. (A general observation, not measured figures.)

1. NCRs are filled in for the audit, not for operations. When the goal is having records to show, NCRs get written after the fact, sometimes batched at month-end, with generic descriptions just good enough to “have a record.”

2. A blame culture. If reporting an NCR leads to reprimand or affects someone’s review, people handle problems quietly on the spot and don’t report. The result: a low NCR count and worthless data.

3. Vague description. “Defective product” or “failed” isn’t enough for anyone else to understand or analyze. Missing: quantity, batch, location, time, which requirement wasn’t met.

4. Disposition decisions go unrecorded. Who decided the product could be used or accepted under concession? On what basis? This is what the standard asks to be retained, and it’s what’s most often missing when an auditor asks.

5. No differentiation. If every NCR is “minor,” or every NCR demands the same cause analysis, the system can’t tell which ones deserve attention.

6. Nobody looks at the whole. Each record is closed, but nobody asks: which failure type was most frequent this month, which supplier keeps repeating, which shift runs into problems.

Worth stressing the second point. To an experienced auditor, a very low NCR count is a signal to ask more, not a good sign. The biggest risk in a system for recording nonconformities isn’t too many records; it’s things that went wrong but never entered the system.

Illustrative example (a composite scenario, not a real customer case): a plant inspects incoming material and raises an NCR for each failed lot. Each record is handled separately: return the goods, close the record. At year-end someone pools every record into a spreadsheet and sees that one supplier accounts for most of the records, all for the same dimensional defect, repeated across many lots. No single record showed that. Only the whole picture did.

Nonconformance as an improvement tool

From that example, the greatest value of an NCR isn’t in any one record but in aggregated data over time.

A few practical ways to use it, none needing complex tools:

Look at trends, not just counts. The useful question isn’t “how many NCRs this month” but “what type, where, from what source, rising or falling.” The standard also asks the organization to analyze and evaluate data from monitoring and measurement, including conformity of products and the performance of external providers (clause 9.1.3).

Classify with purpose. A simple classification by level of impact (customer, safety, regulatory) and by source (material, process, equipment, people, documents) is enough for records to start meaning something when pooled.

Make reporting safe. If the goal is learning, reporting has to be treated as good behavior, not as evidence of personal failure. This is more a culture issue than a tool issue, and it determines the quality of all the data behind it.

Record at the point of detection. The closer to the time and place, the more accurate the information. Batching at month-end loses detail.

A useful practice, though not a mandatory requirement of the standard: record near misses or small abnormalities fixed on the spot, if the company wants earlier data.

From NCR to CAPA

Not every NCR needs a full CAPA loop. The standard asks you to evaluate the need for action to eliminate the cause, and for action to be appropriate to the effects. So a decision has to be made, and it’s best made against clear criteria.

Questions commonly used to decide:

• Has it recurred, or is there a sign of a trend?
• Is the impact serious (customer, safety, regulatory)?
• Does the cause look systemic (document, equipment, process) or like a one-off?
• Could a similar event be happening elsewhere?

If it’s a one-off, minor, with a clear cause and already corrected, stopping at correction and recording it may be enough. If it’s recurring, serious or has a systemic cause, corrective action should be opened.

Two points to hold on to. First, link the two records so that from an NCR you can see the related corrective action and vice versa, avoiding two parallel paper trails. Second, record the reason for not opening CAPA when that’s a deliberate choice, because an auditor may ask.

Nonconformance in eQMS

To be clear first: an eQMS doesn’t create a reporting culture, and it doesn’t classify correctly for you. If users fear reporting, the system just records the silence neatly.

What an eQMS changes is how much the data depends on manual consolidation discipline:

Capture at the point of detection. If floor users have a quick way to enter, information is recorded while the event is fresh, instead of being rewritten at end of shift or month.

Required fields. Description, quantity, batch, location and unmet requirement are defined up front, reducing vague descriptions.

Disposition workflow with authority. Decisions to use as-is or accept under concession go through the person with authority and are recorded, supporting the retention requirement in clause 8.7.

Contextual links. The NCR connects to the batch, supplier, equipment and documents involved, and to a CAPA if there is one.

Trends on hand. Because records sit in one system, grouping by type, source and time is no longer a manual year-end project.

Trigger rules. The system can suggest or require opening a corrective action when events repeat or exceed a set threshold.

One practical caution: if floor users find entering data in the system more tiresome than paper, they’ll write on paper first and enter later, and the benefit of capture at the point of detection disappears. Designing the data-entry flow for floor users matters more than the number of features.

A practical checklist

Use these questions to review how you currently handle nonconformities.

1. Do users understand what a nonconformity is (failure to meet a requirement) and where it can appear, not just “defective product”?
2. Are NCRs recorded at or near the point of detection, or batched at end of day or month?
3. Does the description include quantity, batch, location, time and which requirement wasn’t met, enough for someone else to understand?
4. Are disposition decisions (use as-is, accept under concession, reject) recorded with who decided and on what basis?
5. If the NCR count in a quarter is very low, do you ask why rather than treating it as good news?
6. Is reporting a nonconformity seen as positive behavior, or do reporters worry about being blamed?
7. Is there classification by impact and source, enough to see trends when pooled?
8. Does anyone review the whole NCR picture regularly (failure type, supplier, shift, equipment)?
9. Are there clear criteria for when an NCR needs corrective action, with the reason recorded?
10. Are NCRs and corrective actions linked, or are they two separate sets of records?

If three or more answers are “no” or “not sure,” the issue likely lies in how NCRs are used, not in missing forms.

A note on ISO 9001 editions

This article refers to ISO 9001:2015. According to certification bodies, a revised ISO 9001:2026 was scheduled for publication in September 2026, with a transition period expected to run about three years and 2015 certificates remaining valid during it. Clause structure and wording may change; check against the edition your organization is certified to.

Is your nonconformance system producing data, or just records?

→ Take the Knowledge Management Maturity Assessment to identify your maturity level and the first improvement to make.

Further reading:

• Effective CAPA: Why Corrective Actions Often Don’t Correct Anything (previous)
• Internal Audit in ISO 9001: Not an Exam — a Tool for Real Improvement (next)
• Evidence-Based AI: When Answers Need to Be Verifiable (related)
• eQMS for Manufacturing SMEs: A Practical Guide (pillar)

Sources:

• ISO 9001:2015, clauses 8.7 (control of nonconforming outputs), 9.1.3 (analysis and evaluation) and 10.2 (nonconformity and corrective action); definition of “nonconformity” per ISO 9000:2015: iso.org/standard/62085.html
• LRQA, ISO 9001 revision update: Publication date confirmed (certification body source; verify with ISO): lrqa.com

ISO 9001:2015 clauses are summarized in practical language and do not replace the text of the standard; compliance decisions should be checked against the official edition. The example is a composite illustrative scenario based on common patterns in manufacturing SMEs, not a specific customer case. The problems described are general observations, not measured figures.