A nonconformance report that describes symptoms without identifying root cause is just a paperwork exercise. Here is how to write an NCR that actually prevents the next failure.
A nonconformance report (NCR) is the formal mechanism by which your quality management system documents a product, process, or system failure against a specified requirement, drives root cause analysis, and triggers corrective action to prevent recurrence. Under ISO 9001 Clause 8.7.2, documented information about the nature of the nonconformance and any actions taken is explicitly required. Organizations that skip NCRs for "minor" nonconformances accumulate uncorrected problems — and generate major audit findings when the pattern becomes visible.
A nonconformance report is a documented record that a product, process, or system does not conform to a specified requirement. It is not a blame document. It is the formal mechanism by which your quality management system identifies a problem, contains the impact, determines root cause, and prevents recurrence.
Write a nonconformance report when a product, material, component, or process fails to conform to a specified requirement. The requirements that trigger NCRs include:
Write the NCR at the point of discovery — not after disposition is decided, not after the parts ship. The earlier an NCR is written in the process, the lower the cost of the nonconformance.
Every NCR must have a unique number for retrieval, reference, and trending. Most organizations use a year-sequence format: NCR-2026-0147. Consistency and uniqueness matter more than the specific format.
When and where was the nonconformance found, and by whom? This establishes the timeline for response and enables correlation with production records.
This is the most critical element and the one most commonly written incorrectly.
An objective NCR description states what was measured, what the specification requires, and what was found — with specific numbers.
Wrong: "Bolt torque was incorrect."
Correct: "Bolt torque measured at 38 N-m. Work instruction WI-3201 Rev 2, Step 14 requires 45 plus or minus 2 N-m. Measured value is 5 N-m below the lower specification limit of 43 N-m."
The description must be objective — based on measurement, observation, or documented evidence. It must not assign cause or blame. "Operator forgot to torque properly" is a root cause hypothesis, not a nonconformance description.
How many parts, assemblies, or lots are affected? What production dates or lot numbers are included? What is the potential customer impact?
Establishing scope drives the containment decision. A nonconformance affecting one part has different containment requirements than one affecting 200 parts spanning three weeks of production.
Containment is what you do immediately to prevent nonconforming product from reaching the customer or advancing further in the production process.
Containment actions include: physical segregation and identification of suspect material, notification of downstream processes or the customer if applicable, hold of in-process work that may be similarly affected, and screening of the affected population if sorting is possible.
Document containment actions with the date initiated, the person responsible, and the disposition of each identified unit. Containment is not complete until every suspect unit is accounted for.
What happens to the nonconforming material? Disposition options include:
Disposition authority must be defined in your QMS. A quality engineer typically has authority for rework dispositions. Use-as-is on safety-critical characteristics requires engineering and typically customer authorization.
Root cause is not what happened — it is why it happened, with enough depth to allow prevention.
"Operator did not follow procedure" is not a root cause. It is a symptom. The root cause might be: the procedure did not include the specification, the calibration record for the torque wrench was expired, the operator was trained on an outdated procedure revision, or the work instruction was not at the workstation.
Use 5-Why analysis to get to the systemic cause. The test: if you address only this root cause, would this specific failure be impossible to recur? If yes, you have found the root cause. If no, you are still at a symptom.
The corrective action addresses the root cause. If the root cause is "work instruction did not include torque specification," the corrective action is "update WI-3201 Rev 3 to include torque specification in Step 14 and verify all workstations have Rev 3 by [date]."
Effectiveness verification is evidence, collected after the corrective action is implemented, that the action worked. Reviewing three months of torque inspection records for the affected process and finding zero out-of-tolerance instances is effectiveness evidence. A statement that "the procedure was updated" is not.
Describing the cause instead of the nonconformance. "Operator did not read the procedure" describes a cause. "Assembly dimension measured at 0.312 in, drawing requires 0.325 plus or minus 0.005 in" describes the nonconformance.
Vague containment. "Parts were quarantined" — which parts? What quantity? What identification? Vague containment fails audit scrutiny.
Closing NCRs before effectiveness verification. The most common CAPA-related audit finding globally. "Action completed" is not "action effective."
Not trending NCRs. Individual NCRs tell you what went wrong once. Trended NCRs tell you where your system is breaking down. Review NCR data monthly for: top nonconformance categories by frequency, repeat occurrences by part number or process, and average days to containment and closure.
A quality system with effective NCR management shows declining repeat rates over time. Flat or increasing repeat rates indicate corrective actions are not addressing true root causes.
Coplain Auditor Review analyzes your documentation patterns and identifies systemic gaps before your auditor does. Try free at coplain.com.
Q: What is a nonconformance report (NCR) in manufacturing?
A: An NCR (Nonconformance Report) is the formal documentation that a product, process, or system does not conform to a specified requirement. ISO 9001 Clause 8.7 requires documented information about the nature of the nonconformance and any actions taken. NCRs serve as the trigger for containment, root cause analysis, and corrective action — and as the data source for quality trend analysis.
Q: What must an NCR include?
A: A complete NCR includes: description of the nonconformance with specific values and requirements, reference to the drawing, specification, or work instruction being violated, quantity affected, date and location of discovery, disposition of the affected material, root cause analysis, corrective action taken, and evidence of effectiveness verification. ISO 9001 and AS9100 auditors review NCR records for completeness.
Q: What is the difference between an NCR and a CAPA?
A: An NCR documents that a specific nonconformance occurred and drives immediate containment and disposition. A CAPA (Corrective and Preventive Action) investigates root cause and implements systemic change to prevent recurrence. A single NCR may or may not trigger a CAPA — a one-time occurrence in a low-risk process may not require a full CAPA, but a repeat occurrence or a customer-impacting escape typically does.
Q: How long should NCRs be kept?
A: Retention periods for NCR records depend on your QMS requirements and customer contracts. ISO 9001 requires defined retention periods without specifying a minimum. AS9100 and IATF 16949 customer-specific requirements often specify 3–10 years. FDA Part 820 requires records be retained for the expected life of the device or at least 2 years from device release, whichever is longer.
Coplain turns any work instruction into a print-ready, audit-proof job aid in minutes.
Try Coplain free →AS9100 Rev D Documentation Checklist: 12 Items Auditors Check First
Most audit failures aren't about process gaps. They're about documentation that doesn't reflect reality. Here's the checklist we wish existed before our first Rev D audit.
6 min readCOMPLIANCEFDA 21 CFR Part 820 Documentation Requirements: What Trips Up Manufacturers
Warning letters. 483 observations. Consent decrees. Most FDA enforcement actions have one thing in common: inadequate documentation. Here's what the agency actually looks for.
10 min readCOMPLIANCEISO 9001:2015 Documentation Guide: What You Actually Need vs What You Think
The 2015 revision eliminated the quality manual requirement and six mandatory procedures. What it added is more demanding. Here's what actually changed — and what your registrar looks for during surveillance.
7 min readRelated Tools & Templates
COPLAIN PLATFORM
See every tool that turns complex work instructions into floor-ready documents.