In an audit, NCR usually means Nonconformity Report or Nonconformance Report. It is a formal record that some requirement was not met, based on objective evidence observed by the auditor.
What an NCR actually is
An NCR is a documented gap between what is required and what is happening in practice. Typical sources of requirements include:
- Regulations or standards (for example: ISO 9001, AS9100, IATF 16949, FDA regulations)
- Internal procedures, work instructions, or specifications
- Customer requirements or contracts
The auditor raises an NCR when they can point to:
- A clear requirement, and
- Objective evidence that the requirement was not fulfilled.
What goes into an NCR
Although formats differ by organization and audit body, most NCRs contain:
- Reference: the requirement clause or internal document that was not followed
- Description of the nonconformity: what was observed, in factual, evidence-based terms
- Objective evidence: records, observations, samples, screenshots
- Classification: often major, minor, or observation, depending on risk and impact
- Required response: containment, root cause analysis, corrective action, and verification
What an NCR means for your audit outcome
An NCR is not an automatic audit “failure.” Its impact depends on:
- Severity (major vs minor nonconformity)
- Volume and repeat issues (isolated vs systemic)
- Regulatory or product impact (potential effect on safety, quality, or compliance)
In most industrial and regulated environments:
- Minor NCRs typically require documented corrective actions and follow-up, but do not immediately jeopardize certification.
- Major or systemic NCRs may require rapid containment, re-audit, or additional scrutiny, and can affect certification or customer approvals if not addressed effectively.
How NCRs are handled in regulated manufacturing environments
In a mature quality system, each NCR usually triggers a structured response, often through the CAPA process:
- Containment and immediate risk assessment
- Root cause analysis (for example: 5 Whys, fishbone diagram)
- Definition and implementation of corrective and, where appropriate, preventive actions
- Verification of effectiveness, with evidence traceable to the original NCR
In brownfield plants with multiple legacy systems (MES, ERP, QMS, PLM), NCR data may be fragmented across tools. That can complicate traceability and evidence gathering during audits. Many organizations therefore:
- Standardize NCR workflows and fields across sites and systems where feasible
- Ensure configuration control of NCR forms and codes, so changes are traceable
- Integrate NCR records with production, maintenance, and supplier data instead of fully replacing legacy platforms, to reduce validation and downtime risks
The effectiveness of your NCR process, including system integration and data quality, often matters more to auditors than the specific software you use.
Key takeaways
- NCR in an audit context means a formal report of a nonconformity or nonconformance.
- It documents a specific, evidence-based gap against a defined requirement.
- It usually requires a structured, traceable corrective action response, not just a quick fix.
- The risk comes less from the existence of NCRs and more from repeated, unaddressed, or poorly controlled nonconformities.
