Skip to main content
    QHSEtech
    Updated
    All glossary terms
    Content date: · No individual check logged· AI use

    Non-conformance

    Also known as: Nonconformity, Nonconformance

    Definition

    A failure to meet a stated requirement of a product, process, document or legal obligation. ISO management system standards call it nonconformity.

    Editorial definition: The QHSE Standard, updated 3 October 2026 · https://qhsetech.com/glossary/non-conformance

    Scope: Not every non-conformance needs corrective action: correction and action on the cause are separate decisions. Record the requirement that was not met.

    Example for your evaluation: Raise one record from an audit finding and follow containment, cause, action and the effectiveness check.

    Sources checked: . Examples are editorial illustrations.

    How ISO standards treat nonconformity and corrective action

    In everyday use the term is non-conformance, and NCR names the record of one. ISO management system standards use the spelling nonconformity. In practice both mean a failure to meet a specified requirement, and the requirement can be a product specification, a documented procedure, a customer or legal requirement or a requirement of the standard itself. A nonconformity is not the same thing as a complaint, an incident or an opportunity for improvement, although one event can be recorded as more than one of these.

    The standards give nonconformity its own place in the management system. The published contents of ISO 9001:2026 (Edition 6, published September 2026; ISO lists ISO 9001:2015 and its 2024 amendment as withdrawn) include a section on control of nonconforming outputs, which deals with products and services that do not meet their requirements, and a section on nonconformity and corrective action under improvement. ISO 14001:2026 (Edition 4) has a section on nonconformity and corrective action, and ISO 45001:2018 has one headed incident, nonconformity and corrective action. The licensed text is not reproduced here; read the edition your certification body audits against.

    A common sequence, based on those headings and on ordinary practice and not on any single clause, is to react to the nonconformity and contain it, correct the instance, decide whether its causes need action so it does not recur, carry out that corrective action, and review whether it worked. ISO publishes the vocabulary of quality management in ISO 9000, now in its 2026 edition (Edition 5, published May 2026), which ISO lists as replacing the withdrawn 2015 edition, so use the current edition for formal definitions. Regulated sectors such as medical devices can add their own rules on nonconforming product, so check the regulator or standard that governs the product. This page is general information.

    Sources opened :

    What a non-conformance record holds in software

    • The requirement that was not met, with its source and revision, and a plain description of what was found.
    • Where, when and how it was found, and by whom: an audit, an inspection, a test, a customer complaint, an incident or a supplier delivery.
    • The product, batch, process, site or supplier affected and the quantity, with anything quarantined.
    • A classification from the organisation's own defined scheme, not a free choice made differently on each record.
    • Containment and correction taken, with owner, date and evidence.
    • The cause analysis and the decision on whether corrective action is needed, with the reason.
    • Corrective action with owner, due date and completion evidence, followed by an effectiveness check with reviewer and date.
    • The disposition of nonconforming product, such as rework, scrap, use as is under an authorised concession, or return to the supplier.

    Non-conformance, NCR, CAPA and deviation

    A non-conformance is the event or condition, an NCR is the record of it, and CAPA is the process that follows where action is needed. Not every non-conformance needs corrective action: a one-off error with an understood cause may need only correction, and the decision should be recorded. Words such as deviation, defect, finding and observation are used differently across industries and standards, so a field called type or severity should be defined by the organisation's own procedure.

    A hypothetical example: a torque setting out of tolerance

    This case is invented to illustrate the record and describes no real company. During a routine in-process check an inspector finds that a batch of brackets was assembled with a fastener torque below the specification. A non-conformance record is raised that day naming the requirement (the assembly specification and its revision), the batch, the quantity and the station. The batch is quarantined, and tracing through the lot record shows that one pallet has already moved to dispatch, so it is recalled. The disposition is rework, meaning re-torque and re-inspection, approved by the quality manager.

    The investigation finds that the torque tool's calibration label was out of date and that the tool had drifted. The rework was the correction. The corrective action is a calibration check in the start-of-shift routine and a system block on tools past their due date, with a named owner and a date. At the agreed review date the effectiveness check finds no similar findings, so the record is closed. A second finding, two other tools overdue for calibration, is raised as a separate record so that it does not disappear inside the first.

    Common misunderstandings about non-conformance

    • Fixing the item is not the same as fixing the cause. Correction deals with the instance and corrective action deals with the cause, so a record that stops at rework leaves the cause in place.
    • A closed action is not proof that it worked. Where the applicable process requires it, record an effectiveness check with a reviewer and a date, not only the completion of the task.
    • A high count of records is not a sign of poor quality and a low count is not a sign of control. Counts depend on how willing people are to report, on how requirements are defined and on the volume of work.
    • Using a product as is under a concession does not close the issue. The nonconformity and its cause still need to be on record.
    • A finding is always measured against a requirement. If the requirement is unclear or out of date, the problem may lie in the document and not in the work.

    How non-conformance relates to other glossary terms

    The same record pattern appears in the management system standards and in incident handling.

    • ISO 9001: the quality standard whose contents include control of nonconforming outputs and nonconformity and corrective action.
    • ISO 14001: carries nonconformity and corrective action for environmental requirements and obligations.
    • ISO 45001: treats incidents together with nonconformity and corrective action.
    • Incident investigation: uses similar cause analysis and action steps for events that are not product-quality issues.

    Records and evidence that usually exist for a non-conformance

    • The record itself, with the requirement, revision, date and finder.
    • Quarantine, traceability and disposition records for affected product.
    • Photographs, measurements or test results that show the nonconformity.
    • The cause analysis and the decision on corrective action.
    • Corrective action records, with completion evidence.
    • The effectiveness check and the closure approval.
    • Links to related audit findings, change records or supplier correspondence.

    What a software tool needs to capture for non-conformance

    • Ways to raise a record from an audit finding, inspection, complaint or incident, keeping the link to the source.
    • A link to the requirement and its revision, so a changed document can be traced to open records.
    • Containment tracking for quarantined product, with disposition approvals by an authorised role.
    • Cause and action fields that allow the decision that no corrective action is needed, with the reason.
    • Scheduled effectiveness checks, separate from the completion of the action.
    • Supplier-facing responses with access limited to that supplier's own records.
    • Escalation of overdue records and a history that cannot be overwritten when a record is reclassified.

    Catalog profiles documenting nonconformance management

    Each profile documents a nonconformance workflow in its record. The list does not show that a product meets any particular standard or sector rule.

    Same rule for every product: tagged “Quality Management”, “CAPA Management”, “Nonconformance” or “Nonconformance Management”, with a sourced nonconformance capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 33 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.

    Related software

    Frequently asked questions

    Is a non-conformance the same as a nonconformity?

    In everyday use, yes. ISO management system standards use the spelling nonconformity, while non-conformance and NCR are common industry terms. Check how your procedure and certification body use them.

    Does every non-conformance need corrective action?

    Not necessarily. Correction deals with the instance. Whether to act on the cause depends on the issue, the risk and the applicable process. Record the decision and the reason.

    How long should a non-conformance stay open?

    Set target times in your own procedure according to risk and the applicable requirements, and avoid assuming a universal number of days. Make overdue items visible and escalate them.

    More quality terms

    Related guides