How non-conformance is defined, reported on an NCR and closed out so the same problem does not return

A batch of parts leaves the line with a measurement slightly outside tolerance. A training record is missing a signature. A supplier ships a material with the wrong grade stamped on the label. None of these has caused harm yet, but each one shows that something agreed in advance did not happen. How an organization records, investigates and closes these gaps decides whether the same problem returns next month. It starts with what the term covers, which is wider than most teams assume.

What is non-conformance?

Non-conformance is the failure to meet a stated requirement. ISO 9000:2015, clause 3.6.9, defines nonconformity as "non-fulfilment of a requirement", and the same standard defines a requirement as a "need or expectation that is stated, generally implied or obligatory". That requirement can come from a customer, a regulator, a quality standard or the organization's own written procedure.

In practice, non-conformance covers far more than faulty products. A missed calibration date, an outdated procedure still in use and an unapproved change to a process are all non-conformances because each departs from a defined requirement. ISO publishes the term as "nonconformity" and many teams say "non-conformance" or "non-conformity". They mean the same thing.

Non-conformances surface through inspections, audits, complaints and staff reports

Non-conformances surface through several routes:

• Incoming inspection, when materials or components fail to match the purchase specification
• In-process checks, when a measurement drifts outside an approved limit
• Internal and external audits, when evidence shows a documented step was not followed
• Customer complaints, when delivered work does not meet what was ordered
• Employee reports, when someone notices a process being skipped or changed

Finding a non-conformance is a sign the system is working. The risk sits in the ones nobody records. Audit findings are a common source.

What is a non-conformance report (NCR)?

A non-conformance report (NCR) is the formal record of a non-conformance. It documents what was found, where and when it was found, which requirement it breaks and what will be done about it. The NCR becomes the single reference point that links detection, investigation, correction and closure.

A useful NCR is specific enough that someone who was not present could understand the problem. Common fields include:

• A unique reference number and the date of detection
• The person who raised it and the area, product, process or supplier involved
• The requirement that was not met, such as a specification, procedure or clause
• A description of the non-conformance with supporting evidence
• Immediate containment, such as quarantining affected items
• Root cause analysis and the corrective action assigned
• An owner, a due date and the result of the effectiveness check

ISO 9001 clause 10.2 requires organizations to react to non-conformities and keep documented information on their nature and the actions taken. The NCR is the usual way to meet that requirement.

An NCR moves through six stages from detection to closure

Most NCR processes follow the same sequence, even when the forms differ.

• Detect and record. The finder raises the NCR and attaches evidence.
• Contain. The team stops affected items or activity from moving on.
• Correct. ISO 9000 defines correction as action to eliminate a detected non-conformity, such as reworking a part or replacing a record.
• Investigate the cause. Tools such as five whys or fishbone diagrams help trace the problem back to its origin.
• Take corrective action. ISO 9000 defines corrective action as action to eliminate the cause of a non-conformity and to prevent recurrence.
• Verify and close. Someone checks that the action worked before the NCR is closed.

The difference between correcting and taking corrective action matters. A correction fixes this instance and a corrective action stops the next one. Teams that stop at correction tend to raise the same NCR repeatedly.

A torque value outside tolerance shows an NCR from start to finish

A fastening step specifies 40 Nm with a tolerance of plus or minus 2 Nm. During an in-process check, an operator measures 46 Nm on three consecutive units and raises an NCR.

• Containment: The team holds the batch and checks earlier units from the same tool.
• Correction: Affected fasteners are re-torqued and re-inspected.
• Root cause: The investigation finds that the torque tool missed its scheduled calibration.
• Corrective action: The calibration schedule is added to the maintenance system with automatic reminders.
• Verification: The next three audits of the tool show it in calibration, and the NCR is closed.

The same sequence applies to a service business. Replace the torque tool with a customer onboarding checklist step that was skipped and the NCR structure is identical.

Non-conformance, defect, correction and corrective action have different meanings

These terms overlap in everyday speech but carry different meanings in ISO 9000.

Term	What it means	Example
Non-conformance	Non-fulfilment of any requirement	A missing countersignature on a record
Defect	A non-conformity related to an intended or specified use	A part outside the tolerance that decides whether it fits
Correction	Action to eliminate a detected non-conformity	Reworking the part
Corrective action	Action to eliminate the cause and prevent recurrence	Fixing the calibration schedule

ISO 9000 notes that the distinction between a defect and a non-conformity has legal connotations, particularly for product and service liability. Every defect is a non-conformance, and the reverse is not always true.

Major non-conformances call for a faster and deeper response than minor ones

ISO standards do not define major and minor grades, but many auditors and certification bodies use them. A minor non-conformance is typically an isolated lapse with limited effect on the system. A major one is typically a systemic failure, a repeated lapse or an issue that puts the product, the customer or compliance at risk. The grade decides how fast the response must be and how much investigation is needed. An organization can set its own severity rules in its quality procedures so every NCR is triaged the same way.

NCR processes fail through under-reporting, surface fixes and stalled actions

An NCR only helps if the problem gets recorded, investigated and verified. Three weak points appear often:

• Under-reporting: People skip the form when it feels like blame.
• Surface fixes: The action addresses the symptom, so the NCR returns.
• Open items that never close: Actions stall without an owner or a due date.

Simple measures test the process: how many NCRs repeat the same root cause, how long NCRs stay open and how many closed NCRs fail their effectiveness check. Teams that track these across sites can see patterns that single reports hide. Software that links NCRs to corrective actions and trend reporting, such as the non-conformance management solution in Ideagen Quality Management, supports that kind of tracking.

Frequently asked questions about NCRs and non-conformance

Is a non-conformance the same as a non-compliance?

Not always. Non-conformance refers to failing any requirement, including internal procedures and customer specifications. Non-compliance usually refers to failing a legal or regulatory obligation. A single event can be both.

Who can raise an NCR?

Anyone who finds a gap against a requirement can raise one, including operators, inspectors, auditors and customers. Many organizations let all staff raise an NCR and assign a quality owner to review it.

How long should an NCR stay open?

There is no universal limit. ISO standards do not set a closure time, so organizations set their own targets based on severity. Higher-risk items normally need faster containment and a defined due date for corrective action.

A closed NCR should change a procedure, a training plan or a supplier agreement

An NCR that records a problem and ends with a fix has done half its job. The other half is the question of what the organization will do differently on Monday. When corrective actions reach the procedure, the training or the supplier agreement, each NCR becomes a small improvement to the system and a defined requirement gets easier to meet next time.