What is a non-conformance report?

A record documenting that product, material, or a process output failed to meet a specified requirement. A complete NCR identifies the part and lot, cites the requirement, describes the nonconformance measurably, records containment of the suspect product, and captures the disposition decision and its justification.

What is the difference between an NCR and a CAPA?

An NCR handles one instance of nonconforming product: contain it, disposition it, close it. A CAPA investigates and eliminates the underlying cause so the problem stops recurring. Every nonconformance gets an NCR; only recurring, customer-reaching, safety-related, or costly problems should trigger the full CAPA process.

What are the disposition options for nonconforming product?

Use-as-is (the nonconformance doesn't affect form, fit, function, or a customer requirement, accepted under signed concession), rework (restore to the original spec and re-inspect), repair (make functional without fully meeting the original spec, usually needing customer or design-authority approval), return to supplier, and scrap.

What is the difference between rework and repair?

Rework brings the product into full conformance with the original requirement, verified by re-inspection to that requirement. Repair makes the product usable but leaves it short of the original spec, like a weld repair or an oversize fastener, so it typically requires customer or design-authority approval. Filing repairs as rework is a classic audit finding.

Who can disposition nonconforming product?

Someone with defined authority, named in your procedure. Obvious cases (clear scrap, straightforward rework) are often delegated; judgment calls like use-as-is or repair typically go to a material review board with engineering and quality represented, and customer-specified characteristics require the customer's concession.

What makes a good NCR description?

Measurability. State what was found so a stranger could verify it: the measured value against the required value, the quantity affected out of the quantity inspected, how it was detected. 'OD measures 25.48-25.52 mm vs 25.40 ±0.05 required, 14 of 60 pcs' is actionable; 'diameter oversize' is not.

Do all nonconformances need root cause analysis?

No, and trying to root-cause everything floods the system. Write down a triage rule: root cause and CAPA for recurrences (for example, the same defect code three times in 90 days), anything that reached or could reach a customer, safety or compliance issues, and losses above a cost threshold. Handle the rest as dispositioned corrections whose coded data feeds trend reviews.

Non-Conformance Reports: Write NCRs People Can Act On

The anatomy of an NCR a stranger could execute, and the disposition logic behind it.

A non-conformance report (NCR) documents product, material, or process output that fails to meet a specified requirement. It records what was found, how much is affected, where the suspect product is, and what disposition was decided: use-as-is, rework, repair, scrap, or return to supplier. A good NCR is actionable by someone who wasn't there.

NCRs are the most-written and worst-written documents in quality. "Part bad, see attached" technically opens a record; it also guarantees a week of phone calls. The fix is not more writing, it is structured writing: an NCR has a fixed anatomy, and each field exists because someone downstream needs it to act. This guide covers the anatomy, the lifecycle, the disposition framework, and the triage line between an NCR and a CAPA.

What goes in an NCR?

The anatomy, field by field. If your form has these, any reader can act; if it doesn't, no amount of prose saves it.

Identification: part number, revision, lot/serial numbers, quantity affected and quantity inspected, purchase or work order, supplier if incoming.
Requirement: the spec, drawing dimension, standard, or procedure the product fails, cited by document and revision. "Doesn't look right" is not a requirement.
The nonconformance, described measurably: what was found, stated so a stranger could verify it: "OD measures 25.48-25.52 mm against drawing requirement 25.40 ±0.05" beats "diameter oversize." Include how it was detected and by whom.
Immediate containment: where the suspect product physically is (hold cage, tagged, quarantine location), and what was done about product already downstream: other lots, WIP, the warehouse, shipments in transit.
Disposition and justification: the decision, who made it, and the engineering rationale, especially for use-as-is.
Closure evidence: rework verification results, scrap ticket, return authorization, and the link to a CAPA if one was opened.

The NCR lifecycle in 7 steps

Detect and tag. The finder physically identifies the product (tag, label, red bin) the moment the nonconformance is spotted. Identification comes before paperwork; untagged suspect product has a way of shipping itself.
Segregate and bound the problem. Move suspect product to a controlled hold area and establish the blast radius: how many lots, how much WIP, what already shipped. The quantity field on the NCR is a claim; this step is its proof.
Write the NCR. Complete the anatomy above while the evidence is fresh. Photos are cheap; attach them.
Disposition. The authorized decision-maker (often a material review board for anything non-obvious) chooses use-as-is, rework, repair, scrap, or return, and signs the justification.
Execute and verify. Do the rework and re-inspect to the original requirement; process the scrap with its cost recorded; ship the return with a supplier corrective action request if warranted.
Decide: does this need a CAPA? One cosmetic ding on one part: probably not. Recurring, customer-reaching, or costly: yes. The NCR fixes this instance; only a root cause analysis stops the next one.
Close with evidence and feed the trend data. An NCR closes when disposition is executed and verified, not when the form is filled in. Closed NCRs, coded by defect type, line, shift, and supplier, become the dataset behind Pareto reviews and your defect tracking.

The NCR lifecycle. Steps 1-2 protect the customer; steps 6-7 protect next quarter.

How do you choose a disposition?

Disposition is a risk decision, and it goes best in a fixed order of questions. The standards leave the options open; ISO 9001:2015 clause 8.7 requires only that nonconforming outputs be identified, controlled, and dispositioned by correction, segregation/return/suspension, informing the customer, or acceptance under concession, with records of the decision and the authority who made it.

Use-as-is (concession): the nonconformance does not affect form, fit, function, safety, or an explicit customer requirement, and someone with design authority signs that rationale. Where the characteristic is customer-specified, use-as-is requires the customer's concession, not just your engineer's.
Rework: the product can be brought into full conformance with the original requirement, then re-inspected to that requirement. Rework must have its own instructions; improvised rework breeds new defects.
Repair: the product can be made functional but will not fully meet the original requirement (a weld repair, an oversized fastener). Repair usually needs customer approval in regulated and aerospace work; do not file it under rework.
Return to supplier: incoming material goes back, ideally with a supplier corrective action request so the fix happens at the source. Track these; they are the backbone of your supplier quality scorecard.
Scrap: the product cannot economically be made acceptable. Record the full cost; scrap that isn't costed disappears from management attention and quietly inflates your cost of quality.

The disposition flow. Ask the questions in order; each answer is a signed, recorded decision.

NCR vs CAPA: where is the line?

An NCR handles the instance; a CAPA handles the cause. Every nonconformance gets an NCR; only a minority earn a CAPA, and the triage rule should be written down so the decision is consistent: open a CAPA when the problem is recurring (same defect code, say, three times in 90 days), when it reached or could have reached a customer, when safety or compliance is involved, or when the cost crosses a threshold you set. This keeps the CAPA system reserved for problems worth a root-cause investigation, and it only works if NCR data is coded and countable, which is the strongest argument against free-text paper forms.

Why NCRs go unread

Three habits kill NCR systems, and all three are process choices rather than people problems:

Blame in the text. The moment NCRs start naming culprits ("operator failed to check"), the floor stops reporting, and quality finds out about defects from customers instead. Describe the product and the process; leave people out of the finding and in the fix.
Free-text everything. Without defect codes, line, shift, and supplier fields, the reports cannot be counted, so no trend ever surfaces and the triage rule for opening a CAPA can never fire. Structure the fields; keep prose for the description.
Slow forms. If writing an NCR takes twenty minutes of hunting for the drawing revision and the lot number, small nonconformances go unreported and the record understates reality. The fix is making capture fast at the station, with part and order context pre-filled, which is precisely what digitized station-level forms do well.

The volume of NCRs is not the health metric; plants that report more usually just see more. What matters is cycle time to disposition, the recurrence rate, and whether the data changes anything. During an internal audit a sampled NCR trail, detection to verified closure, is one of the fastest reads on whether a quality system is real.

What the record has to show

ISO 9001:2015 clause 8.7.2 requires retained documented information describing the nonconformity, the actions taken, any concessions obtained, and the authority who decided the disposition (ISO 9001:2015).
For medical devices, FDA's Quality Management System Regulation (in effect since February 2, 2026) applies ISO 13485:2016's nonconforming-product controls, including documented justification and authorization for use under concession (FDA QMSR).
ASQ reports quality costs commonly run 15-20% of sales; the internal-failure share of that number is largely the sum of what your NCRs record, which is why costing each NCR matters (ASQ, Cost of Quality).

One last practical point: NCRs only become preventive data if they are searchable. A filing cabinet of handwritten forms cannot tell you that mislabeling has hit three times this quarter, all on second shift. Capturing quality exceptions digitally at the station, the way CLS did when it replaced paper production logging with real-time capture, turns the same five minutes of writing into a record that can be trended, quoted in audits, and connected to the downtime and production context around it. Write the NCR once; let the system remember it.