No. AS9100 does not mandate specific, universal timelines (for example, “respond to all NCRs within 24 hours” or “close within 30 days”). Instead, it requires that nonconformities are controlled, investigated, and corrected in a timely and effective manner, but leaves the exact time expectations to be defined by the organization and, in many cases, by customer-specific requirements.
What AS9100 actually requires for NCRs
AS9100 (aligned with ISO 9001) includes requirements related to nonconformity and corrective action such as:
- Identifying and controlling nonconforming outputs to prevent unintended use or delivery.
- Documenting nonconformities, actions taken, and concessions or deviations where applicable.
- Investigating significant or recurring nonconformities to determine causes.
- Implementing corrective actions and reviewing their effectiveness.
- Retaining records to demonstrate what was done and when.
The standard consistently uses language like “timely,” “without delay,” and “as appropriate,” but it does not assign numeric due dates. Auditors will look for whether your defined process times are being met and whether they are appropriate to the risks, not for a specific calendar threshold from the standard itself.
Where specific NCR timelines usually come from
Specific response and closure expectations typically come from:
- Customer requirements and contracts: Many primes and OEMs explicitly require supplier NCR or SCAR responses within fixed windows (for example, 24–72 hours for containment, 10–30 days for root cause and corrective action). These then become mandatory for you, even though they are not in AS9100.
- Internal procedures and QMS documentation: Your own QMS may define targets such as initial response, disposition, MRB decision, and closure timelines. Once documented, these become auditable commitments under AS9100.
- Regulatory or airworthiness expectations (indirectly): For safety-critical or airworthiness-related findings, authorities, DERs, or delegated organizations may expect very rapid control and investigation, even if not framed as a formal “NCR closure SLA.”
In practice, AS9100 auditors will challenge NCRs or corrective actions that remain open for very long periods without justified rationale, evidence of progress, or risk controls, even though there is no explicit maximum time in the standard.
How auditors typically judge “timeliness”
Because the standard does not give fixed timelines, auditors generally assess your NCR timeliness against:
- Your own procedures and targets: Are you consistently meeting the response and closure times you defined? If not, do you track and address misses?
- Risk to product quality and safety: High-risk or safety-critical nonconformities are expected to be contained and evaluated very quickly. Long delays here are a red flag, regardless of written targets.
- Customer expectations and flowdowns: If customer requirements specify response windows, auditors will check adherence and evidence that you manage those obligations.
- Evidence of active management: Is there visibility of aging NCRs, documented escalation, and prioritization, or do records show NCRs simply sitting open?
A common nonconformity in audits is not that an NCR exceeded a specific number of days, but that the organization cannot demonstrate effective control, prioritization, and follow-through aligned with its own defined expectations and customer requirements.
Implications for processes and systems
In realistic aerospace and defense environments, NCR and corrective action workflows are spread across QMS, MES, ERP, and sometimes separate supplier portals. To stay compliant without overcommitting:
- Define realistic targets: Set response and closure expectations that reflect your actual investigation capacity, MRB cadence, and engineering availability, then document them in your procedures.
- Differentiate by risk: Use different expectations for safety-critical, conformity-critical, and lower-risk NCRs, so that urgent issues are clearly prioritized.
- Align with customer SLAs: Where primes or OEMs stipulate NCR or SCAR response times, integrate those into your internal tracking and escalation, ideally with automated reminders and status visibility.
- Account for brownfield reality: If NCRs originate in MES but are analyzed and approved in a separate QMS or supplier portal, make sure aging metrics and due dates are visible across systems. Integration gaps are a common cause of missed customer timelines and audit findings.
- Monitor NCR aging: Track aging and backlog by risk level and ownership, and show that you review this routinely (for example, in MRB or quality review meetings). This is often more persuasive to auditors than a nominal “30-day closure” rule that is routinely missed.
Full replacement of legacy QMS/MES systems purely to enforce NCR timelines is rarely justified in aerospace contexts given qualification, validation, and downtime risks. Incremental improvements like better workflow configuration, alerts, dashboards, and limited integrations usually give more practical control over timeliness with less disruption.
Bottom line
AS9100 does not mandate specific NCR response or closure timelines in days or hours. It requires that nonconformities and corrective actions be controlled, investigated, and closed in a timely, risk-appropriate manner, with clear procedures and records. The concrete time expectations come from your own QMS, customer contracts, and effective operational controls, all of which must be demonstrably followed in your audited processes and systems.
