How long should aerospace organizations retain NCR and CAPA records?

There is no single universal answer. Aerospace organizations should retain NCR and CAPA records for at least as long as the longest applicable requirement from their customer contracts, regulatory obligations, quality management procedures, and product support lifecycle.

In practice, that usually means you should not set one generic retention period without checking all of the following:

• customer and program-specific flowdown requirements
• applicable aviation, defense, or export-controlled recordkeeping obligations
• AS9100-based internal procedures and document-control rules
• warranty, service-life, and maintenance support horizons
• statute of limitation and insurance-driven business requirements, as defined by counsel and policy owners
• whether the NCR or CAPA links to serialized product, critical characteristics, escapes, supplier issues, or field events

For many aerospace manufacturers and MRO organizations, the practical answer is to retain these records for many years, and often for the life of the product program plus an additional period if they support traceability or continuing airworthiness-related investigations. A short retention period that looks efficient on paper can create serious problems later if you need to reconstruct disposition history, root cause, containment actions, or effectiveness checks.

If you want a simple rule, use this one carefully: retain NCR and CAPA records no less than the longest required quality record period, and extend that period where the records support product genealogy, airworthiness evidence, contractual obligations, or long-tail failure analysis.

What drives the retention period

NCR and CAPA records are not just administrative files. They often become supporting evidence for:

• part and lot traceability
• MRB decisions and concession history
• supplier performance and recurring defect analysis
• audit sampling and internal investigation support
• field failure, service difficulty, or escape investigations
• design, process, tooling, or training changes made in response to nonconformance trends

That is why retention should be based on risk and use, not only on storage cost or a generic document schedule.

Common failure modes

• Using one blanket retention period for all quality records, even when some NCRs are tied to serialized or safety-significant items.
• Keeping the NCR form but losing linked evidence such as dispositions, approvals, attachments, inspection results, and effectiveness checks.
• Storing records across disconnected QMS, MES, ERP, and shared drives with inconsistent identifiers.
• Migrating systems and dropping historical linkage, timestamps, or approval history.
• Purging old records without confirming customer flowdowns or program-specific obligations.

Those failures matter because in a regulated, long-lifecycle environment, the issue is usually not whether a record exists somewhere. It is whether you can retrieve the complete evidence trail quickly, prove its integrity, and connect it to the affected product, process, and decision history.

Brownfield reality

Most aerospace organizations do not manage NCR and CAPA records in one clean system. They typically coexist across QMS platforms, legacy MES, ERP quality modules, PLM, supplier portals, and scanned legacy archives. That is manageable, but only if record identifiers, revision rules, and retention ownership are clearly defined.

Full replacement is often not the safest answer. In regulated environments with long equipment and program lifecycles, replacing core quality systems can fail because of validation cost, migration risk, integration complexity, downtime constraints, and the burden of preserving historical traceability. Many organizations are better served by enforcing a governed retention policy across existing systems, then improving searchability, linkage, and archive controls over time.

Practical policy approach

A workable retention policy usually does four things:

1. Defines the minimum retention period by record type and program context.
2. States when longer retention is required for serialized, critical, escaped, or contract-governed records.
3. Specifies where the system of record is, including linked evidence and attachments.
4. Controls archival, migration, and destruction through approved change control.

If your organization cannot show all linked NCR and CAPA evidence together after a system change, merger, or archive move, your retention policy is incomplete even if the nominal retention period looks acceptable.

So the direct answer is: retain NCR and CAPA records for the longest applicable contractual, regulatory, and quality-system requirement, and in aerospace often longer where traceability, service life, or investigation needs justify it. If you need a specific number of years, that number must come from your governing requirements and documented procedures, not from a generic industry rule.