There is no single universal list of nonconformance (NC) types. In regulated manufacturing, the “types” are usually defined in your QMS so that people classify issues consistently, set the right level of response, and maintain traceability for audits. That said, most organizations converge on a similar set of distinctions.
1. By severity or impact
Severity levels are typically used to prioritize response and determine whether full CAPA is required. Common patterns are:
- Critical nonconformance: Has a reasonable potential to affect safety, regulatory compliance, airworthiness/fit-for-purpose, or cause field failure. Often triggers product hold, regulatory/authority notification (where applicable), and formal CAPA. Examples: wrong material on a flight-critical part, unapproved process deviation on a special process, missing mandatory inspection.
- Major nonconformance: Does not pose an immediate safety risk, but violates a requirement that can affect performance, reliability, or compliance if not corrected. Typically triggers containment and at least a documented root cause analysis. Examples: out-of-tolerance dimensions, incomplete inspection records, failed in-process test.
- Minor nonconformance: Low impact, often cosmetic or easily reworked without affecting function or compliance. Usually handled via local correction with documented justification. Examples: minor cosmetic defect within customer-acceptable criteria, small paperwork error with clear evidence that work was done correctly.
The detailed thresholds between critical, major, and minor must be defined in your QMS, trained, and applied consistently. Inconsistent severity assignment is a common audit finding.
2. By what is nonconforming
Separating NCs by object helps you understand where the system is failing:
- Product nonconformance: The manufactured item does not meet specification or drawing requirements. Examples: dimensional out-of-tolerance, wrong revision, incorrect material or special process, missing feature, test failure. These usually link directly to material review and disposition (scrap, rework, use-as-is with justification).
- Process nonconformance: The process was not followed as defined, regardless of whether the final product passed inspection. Examples: skipped or out-of-sequence operation, use of uncalibrated equipment, unapproved process change, missing in-process check. Even if product looks acceptable, this is still a nonconformance in regulated environments.
- Documentation / data nonconformance: Required records, approvals, or traceability data are missing, incorrect, or incomplete. Examples: missing signatures, wrong drawing revision used on traveler, incomplete inspection records, mislabeling, incomplete device history record or build history.
- Systemic / QMS nonconformance: A failure of the quality management system itself, often identified during internal or external audits. Examples: procedure not aligned with a regulatory requirement, lack of required training program, missing process validation, ineffective CAPA system.
In a mature system, a single event may generate multiple linked NCs (for product, process, and documentation) so that each aspect is treated and traceable.
3. By source or origin
Understanding where nonconformances originate is important for supplier management and internal improvement:
- Internal nonconformance: Detected within your own operations (in-process inspection, final inspection, internal audit, operator self-report). These are usually the majority in a well-controlled system, because issues are caught before shipping.
- Supplier nonconformance: Nonconforming material or services from external partners, including special process providers. Typically managed through an incoming inspection or receiving process, a supplier NC process, and possibly supplier corrective action requests (SCARs).
- Customer / field nonconformance: Issues detected by the customer or in service/use. Includes customer complaints, returns, escapes, and regulatory reports where applicable. These often carry higher risk and scrutiny, and frequently trigger formal CAPA and cross-functional review.
Many plants track these separately (e.g., internal NC, supplier NC, customer NC) for reporting and for different escalation rules.
4. By frequency and pattern
NCs can also be categorized based on how they behave over time:
- Isolated / sporadic nonconformance: A rare or one-off event with no clear trend. Often handled with local correction or contained corrective actions, provided risk is low and recurrence is unlikely.
- Recurring nonconformance: Same or similar NC appears multiple times, indicating that previous fixes were not effective. Typically requires deeper root cause analysis and systemic corrective action.
- Systemic nonconformance: Indicates a broad weakness in the QMS or process design, not just execution. Often discovered via trend analysis, internal audits, or repeated customer findings. These usually feed into your CAPA program.
Trend detection depends heavily on how consistently NCs are logged and coded. In brownfield environments with multiple systems (MES, QMS, spreadsheets), incomplete or fragmented data can hide systemic issues unless integration and data governance are addressed.
5. By timing in the value chain
Some organizations distinguish NCs by where in the lifecycle they are detected:
- Incoming / receiving nonconformance: Detected when materials, components, or documentation arrive from suppliers.
- In-process nonconformance: Detected during manufacturing or assembly operations.
- Final inspection / test nonconformance: Detected at the end of the manufacturing process, before shipment or release.
- Post-delivery / field nonconformance: Detected after shipment, in service, or at the customer site.
This classification helps target containment and improve early detection. It also feeds cost-of-poor-quality (COPQ) analysis, since later discovery usually has a higher cost and risk impact.
6. Special regulatory or customer-specific types
In highly regulated or customer-driven environments, additional categories may be required:
- Regulatory nonconformance: Direct violation of a regulatory or standard requirement (e.g., missing required validation, failure to follow mandated procedures). These often have specific reporting and corrective-action expectations.
- Customer-specific nonconformance categories: Many aerospace and medical customers specify their own NC categories and codes. Your internal types then need to map to customer-required categories for reporting and concessions/deviation requests.
- Configuration/traceability nonconformance: Incorrect serialization, genealogy, or configuration state, especially where as-built must match as-designed and as-certified. Even if physical product is correct, misaligned configuration or genealogy is often treated as a nonconformance in its own right.
These categories are highly dependent on your product type, regulatory regime, and key customer contracts.
7. Practical considerations in brownfield environments
In mixed-system, long-lifecycle plants, nonconformance types often drift over time because of:
- Multiple QMS/MES/ERP instances with different NC codes and workflows
- Legacy paper processes coexisting with digital systems
- Customer-specific portals and coding schemes for supplier NCs
Before rationalizing NC types, it is important to:
- Define a clear, controlled list of NC types and severities in your governing procedures.
- Map old codes and system fields to the new controlled list instead of attempting a disruptive, big-bang replacement of existing systems.
- Validate any changes to NC workflows and coding logic in your QMS/MES, with appropriate change control and training.
Full replacement of legacy NC systems purely for standardization often fails in regulated contexts because of qualification burden, downtime risk, integration complexity, and the cost of revalidating processes and retraining personnel. A staged approach (harmonized definitions, code mapping, incremental system changes) is usually more realistic.
Key point
The “different types of nonconformance” in your plant should be:
- Explicitly defined and documented in your QMS.
- Aligned with severity, object (product/process/document/system), and source.
- Consistently applied across all systems and sites, with traceability to customer and regulatory expectations.
Without that discipline, NC data becomes hard to trust, which weakens trend analysis, CAPA effectiveness, and audit readiness.
