AS9100 does not mandate specific, numeric timelines for nonconformance reports (NCRs) such as “contain within 24 hours” or “close within 30 days.”
The standard requires that nonconformities are identified, controlled, investigated, and corrected in a timely and effective manner, but it intentionally leaves the exact timeframes to:
- Your organization’s documented QMS procedures
- Customer or contractual requirements (e.g., OEM-specific NCR/SCAR timing)
- Regulatory or airworthiness directives, where applicable
- Your own risk-based criteria (severity, safety impact, field exposure)
What AS9100 actually expects around NCR timing
Key clauses (e.g., on nonconforming outputs and corrective action) focus on:
- Prompt identification, segregation, and control of nonconforming product
- Timely correction and disposition to prevent unintended use or delivery
- Investigation of causes and implementation of corrective actions
- Verification of effectiveness of those actions
The word “timely” is interpreted during audits in the context of your own procedures and risk assessments. Auditors generally look for:
- Defined internal expectations for NCR steps and responsibilities
- Consistent adherence to those expectations
- Reasonable risk-based justification where timelines slip
- Evidence that product and safety risks are controlled while NCRs remain open
Where timelines really come from
In practice, NCR timelines in aerospace environments are typically driven by a combination of:
- Internal QMS procedures: Your SOPs may define targets such as containment in 24–48 hours, root cause in 10 days, corrective action in 30 days, etc. These are your rules, not AS9100’s.
- Customer requirements: Many primes have supplier quality manuals that specify due dates for 8D responses, containment, or final corrective action. These may be stricter than your internal rules.
- Regulatory/airworthiness context: For flight safety or significant field events, regulators or OEMs may set explicit response or reporting timelines.
- Risk level: High-severity or high-exposure nonconformities usually warrant shorter internal timelines and more frequent status review.
Brownfield and system coexistence considerations
In many plants, NCRs are spread across legacy QMS, MES, ERP, and supplier portals. AS9100 does not require you to replace these systems, but it does expect you to:
- Maintain controlled, traceable records of nonconformities and corrective actions regardless of system origin
- Ensure the various systems support your documented NCR process and timelines
- Align configurations and workflows enough that you can show clear status, ownership, and timing evidence during audits
Full replacement of NCR tools often fails in regulated environments because of validation effort, downtime risk, and integration complexity with long-lifecycle equipment. Many organizations instead standardize process expectations and metrics while allowing multiple systems to coexist, then gradually converge where validation and change control allow.
What auditors typically challenge on NCR timing
While there are no fixed AS9100 time limits, nonconformance can still be raised if:
- Open NCRs linger for long periods with no documented risk review or mitigation
- Your procedures define timelines you systematically miss without justification
- Evidence shows product was shipped or used before adequate containment or disposition
- Corrective actions are repeatedly ineffective, indicating timelines are unrealistic or the process is weak
Auditors are less concerned with a universal target number of days and more concerned with whether your process is:
- Risk-based and clearly defined
- Followed in practice across departments and sites
- Supported by traceable records and system data
Practical guidance for setting NCR timelines
When you define or refine your NCR timelines, consider:
- Risk tiers: Use different targets for critical safety-related issues vs minor cosmetic defects.
- System capabilities: Ensure your actual QMS/MES/ERP tooling can reliably support and report on those timelines before you commit them to procedures.
- Supplier and customer alignment: Where customer mandates are stricter, ensure your internal targets are at least as strong, or clearly mapped.
- Validation and change control: Any workflow or timing change in electronic systems should go through appropriate validation and documented change control.
In summary: AS9100 expects NCRs to be handled promptly and effectively, but it does not prescribe specific numeric timelines. Those come from your own QMS, your customers, and applicable regulations, and must be supported by traceable processes and evidence in your existing system landscape.
