What information is mandatory in an NCR record for AS9100 compliance?

AS9100 does not define one mandatory NCR form or a fixed list of fields for every organization. For AS9100 compliance, the record must provide documented information that describes the nonconformity, the actions taken, any concessions obtained, and the authority deciding the action. The exact NCR fields are usually driven by the organization’s procedure, customer flowdowns, regulatory requirements, product risk, and how traceability is maintained across MES, ERP, PLM, QMS, and inspection systems.

What AS9100 commonly expects to be documented

For control of nonconforming outputs, an NCR record typically needs enough information to prove that the nonconforming item was identified, controlled, evaluated, dispositioned, and verified before further processing, delivery, or use. In practical terms, that usually includes:

• A unique NCR number or record identifier.
• Part number, part name, revision, work order, purchase order, lot, batch, serial number, or other traceability identifiers as applicable.
• The operation, inspection point, supplier, work center, or process step where the issue was found.
• A clear description of the nonconformance, including the actual condition found.
• The requirement not met, such as drawing, specification, process plan, customer requirement, standard, or acceptance criterion, including revision where relevant.
• Objective evidence, such as measured values, inspection results, photos, test results, defect codes, or attached inspection records.
• Containment or segregation status, including whether affected material was tagged, blocked, quarantined, or otherwise prevented from unintended use.
• Disposition decision, such as rework, repair, use-as-is, return to supplier, scrap, or other approved disposition allowed by procedure.
• The person or function authorized to make the disposition, with approval date and electronic or handwritten signature according to the site’s record controls.
• Any required customer, regulatory, engineering, or MRB approval, especially for repair or use-as-is dispositions where customer authorization is required.
• Instructions for rework, repair, retest, or additional inspection when the disposition requires them.
• Verification that the disposition was completed and that the product was accepted, scrapped, returned, or otherwise closed under controlled conditions.
• Links to related records, such as inspection results, FAI impacts, deviation permits, concessions, CAPA, SCAR, maintenance records, or shipment holds.

Root cause and corrective action are not always the same as the NCR

An NCR records a nonconforming output and its control. Root cause analysis and corrective action may be required, but not every NCR automatically requires a full 8D or formal CAPA under AS9100. That decision normally depends on recurrence, severity, customer requirements, escape risk, systemic impact, and the organization’s documented procedure.

If corrective action is opened, the NCR should link to the corrective action record so the audit trail shows why the issue was escalated, what cause was determined, what action was taken, and how effectiveness was verified. Keeping these as separate but linked records is common and acceptable when the linkage is controlled.

Customer and regulatory requirements can add fields

Customer contracts, aerospace prime flowdowns, defense requirements, special process approvals, and regulatory obligations can require more detail than AS9100 alone. Examples include customer concession numbers, MRB authority limits, delegated source inspection status, supplier notification requirements, serialization, export-controlled technical data handling, or specific defect coding.

This is why an NCR template that works for one plant, program, or customer may be insufficient for another. The organization’s documented procedure should define which fields are required for which product families, programs, risk levels, and disposition types.

System location matters less than traceability

The NCR record may live in a QMS, MES, ERP quality module, supplier portal, or a controlled document system. In brownfield environments, the complete evidence is often distributed across multiple systems. That is not automatically a problem, but the links must be reliable, access-controlled, retained, and understandable during an audit or customer review.

A common failure mode is treating the NCR number as the record while critical evidence remains in spreadsheets, emails, scanned forms, or disconnected inspection systems. Another failure mode is allowing rework or shipment before disposition approval and verification are complete. Digital systems reduce some risk only if workflows, permissions, master data, validation, and change control are properly managed.

What is not safe to assume

It is not safe to assume that an NCR record is AS9100-compliant because it has a defect description and a disposition. The record must be complete enough to show control of the affected product and decision authority. It is also not safe to assume that buying a new QMS or MES will solve the problem. Full replacement is often unrealistic in aerospace-grade brownfield operations because of validation cost, qualification burden, downtime risk, integration complexity, traceability obligations, and long equipment lifecycles.

The practical target is a controlled NCR process with defined required fields, clear disposition authority, reliable system links, protected records, and evidence that the process is followed. Whether that satisfies a specific audit or customer review depends on the site’s procedure, the records sampled, contract requirements, and the auditor’s assessment of objective evidence.