What evidence do auditors typically request when sampling NCRs?

When auditors sample NCRs, they typically request objective evidence that the nonconformance was controlled from discovery through closure. They are usually not looking only for a closed status in the QMS. They want to see that the issue was identified, contained, evaluated, dispositioned by authorized personnel, verified after correction, and escalated to CAPA, customer approval, or engineering review when required.

The exact evidence depends on the applicable standard, customer flowdowns, product risk, internal procedures, and how your systems are configured. In regulated manufacturing, auditors commonly test whether the NCR record matches the physical or production record trail across MES, ERP, PLM, QMS, inspection, and sometimes maintenance systems.

Common evidence requested

• The NCR record itself: NCR number, part number, serial or lot number, work order, operation, quantity affected, defect description, detection point, dates, and responsible roles.
• Objective evidence of the condition: inspection results, measurements, photographs, test data, failed characteristics, operator notes, or machine data where applicable.
• Containment evidence: proof that affected material was identified, segregated, put on hold, blocked in ERP or MES if relevant, and prevented from unintended use or shipment.
• Disposition evidence: documented decision such as use-as-is, rework, repair, scrap, return to supplier, or engineering review, including required approvals.
• Authority and competence: evidence that disposition and verification were performed by authorized personnel with required qualifications, delegation, or role-based approval rights.
• Customer or regulatory approval when required: concession, deviation, waiver, MRB approval, or customer notification records where procedures or contracts require them.
• Rework or repair instructions: approved instructions, referenced drawing or specification revisions, special process requirements, and evidence that operators used the correct version.
• Verification after correction: reinspection records, test results, acceptance evidence, stamps or electronic signatures, and confirmation that the product met the approved disposition.
• Traceability links: connection to the traveler, route step, inspection plan, purchase order, supplier lot, FAI record, serial record, or device history record where applicable.
• CAPA or RCCA linkage: rationale for whether corrective action was opened, including root cause analysis, corrective action plan, implementation evidence, and effectiveness checks when required.
• Trend and recurrence review: evidence that repeat issues were evaluated rather than repeatedly closed as isolated events.
• Audit trail and change history: who changed the NCR, what changed, when it changed, and whether approvals were preserved after edits.

Where weak NCR samples usually fail

Common audit problems include vague defect descriptions, missing containment evidence, unsigned or unauthorized dispositions, rework performed without approved instructions, no verification after rework, poor linkage to serial or lot records, and CAPA decisions that are not justified.

Another frequent failure is system mismatch. For example, the QMS may show the NCR as closed, while the MES traveler, ERP inventory status, or inspection record does not clearly show the same disposition. In brownfield environments, this is common because NCR workflows often span legacy MES, ERP, PLM, QMS, spreadsheets, and email approvals. Auditors may accept a multi-system record set, but the trace must be clear, controlled, and retrievable.

What is site-specific

Not every NCR requires the same depth of evidence. A minor internal defect that is scrapped before use may require less evidence than a nonconformance involving serialized hardware, delivered product, special processes, safety-critical characteristics, or customer-delegated MRB authority.

Your own procedures matter. If the procedure says specific containment, escalation, review board, notification, or effectiveness steps are required, auditors can sample against those requirements. Overly ambitious procedures can create audit exposure if the actual workflow does not consistently meet them.

Digital systems help only if the controls are real

QMS or MES workflows can make NCR evidence easier to retrieve, but they do not make the process audit-ready by themselves. Role permissions, required fields, electronic signatures, revision control, audit trails, record retention, and validated integrations must be configured and maintained. If approvals still occur by email or spreadsheet, those records need to be controlled and connected to the NCR record.

Full system replacement is usually unrealistic in established regulated plants because of validation cost, qualification burden, downtime risk, integration complexity, and long equipment lifecycles. A more practical approach is often to strengthen traceability and record controls around the existing NCR workflow before attempting broad replacement.