Non-Conformance Report (NCR) Explained

The concept behind the record, what counts as a failure to meet a requirement and how such failures are graded, is covered separately in what is a non-conformance. This page is about the object that concept produces, and about an argument most published guidance skips: an NCR is a custody record, not an investigation, and almost everything of value on it has to be captured while the material is still in front of somebody.

What is a non-conformance report?

An NCR is the document that takes a non-conformance out of somebody’s head and turns it into evidence. It exists to do one job that no other quality record does: account for a specific quantity of specific material from the moment it was found to be wrong until the moment somebody with authority decided what happens to it.

Before you go looking for it in the standard: “non-conformance report” is not a term ISO 9001 uses. ISO 9001:2015 speaks of nonconforming outputs at clause 8.7 and nonconformity at clause 10.2, and prescribes no form at all. As one auditor training provider puts it, organizations keep a “Nonconformance Register or Improvement Register, you can call it whatever you want”, provided it captures the minimum information. Discrepancy report, quality notification, reject note and NCR are the same object under different industry names.

How does an NCR differ from the non-conformance itself?

A non-conformance is something you discover. A non-conformance report is something you create, and the difference decides who is accountable for it.

The non-conformance happened once, at a moment, to a definite quantity of material. The report is a live object with a state, and it stays open until the material has been disposed of and the decision has been signed off. The two do not map one to one. A single root problem found at goods-in, at assembly and in the field generates three reports with three different quantities and three different dispositions. Conversely, one report routinely covers an entire lot sharing one defect, which is why quantity and number of occurrences are separate fields on the record in MIL-STD-1520C paragraph 5.7. That standard is the last revision, issued 27 June 1986 and superseding MIL-STD-1520B of 3 July 1980, of a US defense standard first issued in 1974 and cancelled in 1995; its lineage is set out on the 8D report page.

The record is fixed at the moment of quarantine

Here is the argument, stated plainly, because it decides what the rest of this page is for. Every field on a non-conformance report that is not captured while the material is in front of somebody becomes, later, a matter of opinion.

The quantity is countable at the tag and estimated afterwards. The condition is photographable at the tag and described from memory afterwards. The detection point is observable at the tag and inferred afterwards. The heat lot or serial range is legible on the parts at the tag and reconstructed from paperwork afterwards. None of this is a failure of diligence. It is what happens when evidence and record are separated in time, and it is why a report raised at a desk two days later is a weaker object than the same report raised at the bench.

This is also why the argument about NCR software is not really about workflow. Approval routing, escalation rules and dashboards all operate on data that was either captured correctly at the quarantine tag or was not. Everything after that point is reconstruction, and reconstruction is exactly what the record exists to make unnecessary.

Read the clause requirements and the field list below with that in mind. They are not an inventory of boxes on a form. They are a list of things that stop being knowable once the material moves.

What does ISO 9001 actually require you to keep?

Two clauses, and treating them as one clause is the most common structural mistake in quality records.

Clause 8.7, control of nonconforming outputs, deals with the material. Clause 8.7.1 requires the organization to identify and control nonconforming outputs so they are not used or delivered unintentionally, and sets out the actions available: correction; segregation, containment, return or suspension of provision; informing the customer; and obtaining authorization for acceptance under concession. Clause 8.7.2 then requires retained documented information that describes the nonconformity, describes the actions taken, describes any concessions obtained, and identifies the authority deciding the action. Those four items are set out in ISO 9001:2015 itself at that clause; the standard is sold rather than published, so it is cited here by clause and not reproduced.

Clause 10.2, nonconformity and corrective action, deals with the cause. Clause 10.2.1 requires the organization to react to the nonconformity, evaluate whether action is needed to eliminate its cause, determine whether similar nonconformities exist or could occur, implement action, review effectiveness, and update risks and the management system where necessary. Clause 10.2.2 requires records of the nature of the nonconformities and any subsequent actions, and of the results of any corrective action.

Clause 8.7 is the record of the thing. Clause 10.2 is the record of the fix. A system that merges the two ends up with neither, because the material record closes when the investigation closes, which can be weeks after the parts shipped.

Clause numbering above follows ISO 9001:2015, the edition most organizations are certified against today and will be audited against until they transition to ISO 9001:2026. ISO/TC 176/SC 2 confirmed the sixth edition, and ISO 9001:2026 was published on 16 September 2026. Certificates against the 2015 edition remain valid through a transition period administered by your certification body. No end date for that period has been published for ISO 9001, so treat any specific date you are quoted as an expectation rather than a requirement. The changes signaled so far concern quality culture, climate context and the separation of risks and opportunities, not nonconforming outputs, and clause numbers in this area should be checked against the new edition once it is in hand.

What fields does a usable NCR carry?

The list below is drawn from two places and adds a third. Most of it is what MIL-STD-1520C paragraph 5.7 required in 1986 and what ISO 9001:2015 clause 8.7.2 requires. Three rows appear in neither source and are marked as added here. One requirement from 5.7 is deliberately left out: the contract number at 5.7(a), which belongs to defense contracting rather than to the record itself.

The convergence between the two published sources is the interesting part. Two specifications written twenty-nine years apart, one for defense contracts and one for any organization on earth, ask for very nearly the same things.

If a record cannot say which requirement was breached and against which controlled document, it is a complaint, not a non-conformance report.

What are the dispositions, and who can authorize each?

Six outcomes cover almost all practice, and the definitions of rework and repair that remain in general use come from the military standard.

Rework is, in the words of MIL-STD-1520C paragraph 3.13, a procedure that “will completely eliminate” the nonconformance and result in a characteristic that conforms completely. Repair reduces but does not eliminate it, and paragraph 3.12 is explicit that after repair “the characteristic still does not completely conform.” Use-as-is applies to material with minor nonconformances judged usable for its intended purpose in its existing condition. Scrap is material not usable and not economically recoverable. Return to supplier moves both the material and the problem back up the chain. Concession accepts nonconforming product as it stands, and that one is defined not by the military standard but by ISO, as below.

Rework restores conformity. Repair does not, which is why a repaired part stays nonconforming for the rest of its life and the record has to say so.

Authority follows that logic. The military standard split it deliberately: quality personnel acting under Preliminary Review could scrap, rework, return to supplier or apply a pre-approved standard repair procedure on their own, while everything else went to a Material Review Board chaired by quality and including, as a minimum, the engineering function responsible for the product design. Use-as-is and repair required the customer’s approval on top. Strip out the defense contracting and the surviving principle is simple: the two dispositions that leave a nonconforming characteristic in the delivered product, use as is and repair, require sign-off from whoever holds design authority, and that is frequently not the organization holding the parts.

Two words are routinely used interchangeably and mean different things. Under ISO 9000:2015, a concession is permission to use or release product that does not conform, granted after the product exists, while a deviation permit is permission to depart from the specified requirements before it is made. If you have the parts, you need a concession. If you know the next batch cannot meet the spec, you need a deviation permit.

Correction, containment and corrective action: what is the difference?

Correction acts on the item in front of you. Containment acts on everything else that might share the defect: the rest of the lot, the parts downstream, the stock in transit, the units already at a customer. Corrective action acts on the cause, so the condition does not arise again.

Correction fixes the part, containment protects everything else that shares the defect, and corrective action stops you doing it again. Recording the first and calling it the third is the single most common defect in quality records, and it is trivially visible to an auditor: the record says “part scrapped and replaced” in the corrective action field and nothing has changed anywhere in the process.

Containment is the one with a clock on it. Published aerospace supplier requirements give containment results 24 hours against 30 days for a corrective action plan, and why that gap exists is set out on the 8D report page.

When should an NCR escalate to a CAPA?

Not by default. Most non-conformance reports should close on disposition alone, and a system in which every NCR spawns a corrective action is not rigorous, it is just slow.

The escalation triggers that hold up across industries are recurrence, escape, severity and cost. MIL-STD-1520C formalized the first of these by defining an occurrence as the first detection of a nonconformance on a characteristic, and a recurrence as a repeat after a commitment to corrective action had already been made. The distinction is still the cleanest test available: a first occurrence needs a disposition, a recurrence needs an explanation. Escape is the second trigger, because material that reached a customer has already proved that detection failed as well as production. Severity and regulatory exposure are the third, and ISO 9001 clause 10.2.1 adds a fourth by requiring organizations to determine whether similar nonconformities exist or could potentially occur elsewhere.

Where a report does escalate, it hands off to a structured investigation. CAPA is the general form of that; the 8D report is the form most customers in automotive and aerospace will ask for by name.

Why open NCRs matter more than closed ones

Closed-NCR counts are the metric most quality dashboards lead with, and they are close to meaningless. A closed report tells you what happened once. The age profile of your open reports tells you whether the disposition process works at all.

This is not a modern observation. The 1986 standard already required nonconformance data to be summarized at least quarterly and to include, as a named line item, “delinquent corrective actions” alongside disposition types and nonconformance costs, in paragraph 5.8. What ageing actually measures is rarely investigative difficulty. An NCR sitting open for six weeks usually means nobody with disposition authority has looked at it, and the material occupies floor space and working capital in the meantime. Ageing by disposition state, rather than a single average, separates the reports waiting on a decision from the reports waiting on a physical action, and those are different management problems. Internal quality audits are where the gap between the two usually surfaces.

What is a supplier NCR, and how does it become a SCAR?

A supplier NCR is raised against received material and is still a record about parts in your building. A supplier corrective action request, universally abbreviated SCAR, is a demand on the supplier’s management system. Closing one does not close the other.

The mechanism is visible in published supplier requirements. The Barnes Aerospace document states that its quality function “will generate a supplier corrective action (SCAR) and associated reference number for tracking purposes,” that the supplier “may choose any corrective action format that complies with the 8D Methodology as outlined in AS13000,” and that the SCAR closes only “once implementation of effective corrective actions has been verified.” The same document also notes that suppliers hold no disposition authority for the product at all, because design authority sits with the customer.

That last point catches people out. The party that finds the defect is often not the party allowed to decide what happens to it, and a supplier NCR process that assumes otherwise will generate dispositions nobody downstream will accept. It is also the clearest illustration of why the quarantine tag matters: the organization with the parts in front of it can capture everything except the one decision that closes the record.

Frequently asked questions

Sources

• ISO 9001:2015, Quality management systems, Requirements
• ISO 9000:2015, Quality management systems, Fundamentals and vocabulary
• ISO/TC 176/SC 2, ISO 9001 revision update, sixth edition scheduled for publication 16 September 2026
• MIL-STD-1520C, Corrective Action and Disposition System for Nonconforming Material, 27 June 1986 (full text)
• MIL-STD-1520C listing, EverySpec
• MIL-STD-1520C Notice 2, cancellation, 27 February 1995
• Auditor Training Online, ISO 9001 clause 10.2, nonconformity and corrective action
• Barnes Aerospace, Supplier Quality Requirements SQR-001, Revision K, 26 June 2023
• SAE AS13000, Problem Solving Requirements for Suppliers

ISO standards are copyrighted and sold, so clause requirements above are described rather than reproduced, and are cited by standard and clause number. MIL-STD-1520C is a cancelled US government standard in the public domain and is quoted directly.

Related terms

• What is a non-conformance?
• 8D report
• CAPA explained
• Internal quality audits
• FMEA

Last reviewed: 16 September 2026

About Logincident. Logincident is a data and software company whose configurable platform captures structured evidence at the point of work and presents it in dashboards and reports, including quality records such as non-conformances, dispositions and corrective actions. We are not a law firm or a claims handler, and nothing on this page is legal advice.