A non-conformance report (NCR) is issued when an actual or suspected failure to meet a defined requirement needs formal control, traceability, and disposition. The exact thresholds should be defined in your quality system procedures, but there are common patterns across regulated manufacturing.
Typical triggers for issuing an NCR
In most regulated environments, an NCR should be opened when one or more of the following is true:
- Product does not meet requirements
Any unit, batch, or lot fails specification, drawing, bill of materials, test limits, labeling, or packaging requirements, and cannot be trivially reworked on the spot without risk to traceability or validation.
- Process is out of control or out of spec
A manufacturing, test, cleaning, sterilization, software, or inspection process is found to be operating outside validated parameters, control limits, or approved work instructions.
- Use of unapproved or superseded documents
Work was performed using obsolete drawings, work instructions, recipes, or software configurations, or using documents that are not under approved document control.
- Use of unapproved materials, components, or tools
Non-qualified suppliers, unapproved material lots, expired materials, or uncalibrated / out-of-tolerance equipment or gauges were used on product or in a critical process step.
- Identification, labeling, or traceability errors
Mislabeling, mixed lots, missing serial numbers, incorrect batch IDs, or incomplete genealogy that could compromise traceability or product identity.
- Deviations from approved process or work instructions
Any undocumented process change, operator workaround, skipped step, or unauthorized repair that could affect safety, performance, compliance, or data integrity.
- Failures found in inspection or test
Incoming, in-process, or final inspection/test detects failures that require formal segregation, rework, disposition, or supplier feedback.
- Field issues tied back to manufacturing
Returns, complaints, or field failures that indicate potential non-conforming product or process issues within the plant.
- Data integrity and record issues
Missing, altered, or inconsistent manufacturing records, test data, or electronic audit trails that undermine the ability to demonstrate conformity.
When an NCR is usually mandatory in regulated environments
Depending on your sector and internal procedures, an NCR is generally required when:
- The non-conformance could impact safety, regulatory compliance, or critical performance.
- Product has already moved beyond the immediate work area (e.g., into downstream processing, warehouse, or customer).
- There is a need for formal disposition (use-as-is, rework, repair, scrap, return to supplier) that must be reviewed and approved by defined functions.
- There is potential for a systemic or recurring issue that may require root cause analysis and corrective action.
- The issue must be formally documented for audits, customers, or regulators (e.g., contractually required, part of a customer-specific process, or linked to safety/quality events).
When you might not open a formal NCR
Your procedures may define conditions where a full NCR is not required. These should be clear, risk-based, and applied consistently:
- Trivial, clearly reversible errors corrected immediately at the point of work without risk to product, traceability, or records (e.g., minor clerical error fixed before record approval).
- Issues fully captured under another controlled mechanism (e.g., documented deviation/waiver process, temporary change control, or controlled experiment within a validated framework).
- Previously analyzed and bounded conditions where you have an approved justification that no NCR is needed (for example, a known measurement artifact inside a pre-defined, documented range).
If in doubt, especially in safety- or mission-critical environments, it is safer to open an NCR than to rely on informal handling.
Operational considerations in brownfield and mixed-system environments
In real plants with legacy MES, ERP, QMS, and paper systems, the decision to issue an NCR is not just technical; it is also operational:
- Where the NCR lives
The NCR might originate in a QMS, MES, or even on paper, depending on system maturity. Misalignment between systems (e.g., QMS vs MES vs ERP) can cause gaps in stock status, genealogy, and disposition if the process is not clearly defined.
- Traceability across systems
When multiple systems track material lots, routings, and test results, issuing an NCR must include clear instructions on how to update each affected system and keep them consistent. Integration quality heavily influences how reliable this is.
- Downtime and production impact
In high-utilization assets, teams may hesitate to open NCRs because they fear stoppages. Your procedures should define which issues must trigger an NCR regardless of impact, and which can be handled via local controls.
- Long equipment lifecycles
Older equipment may not natively support full electronic traceability. In those cases, NCRs often carry extra responsibility for documenting conditions, setpoints, and manual readings to compensate.
Attempting to replace all existing systems just to “fix” NCR handling often fails in aerospace- and safety-critical contexts due to qualification and validation burden, downtime risk, and migration complexity. It is usually more practical to harden NCR triggers and workflows within current systems and interfaces, then improve gradually.
Defining clear NCR criteria in your procedures
To avoid inconsistent decisions between shifts, plants, or suppliers, your organization should maintain controlled procedures that:
- Define what “non-conformance” means for your products, processes, software, and data.
- Set risk-based thresholds for when an NCR is mandatory vs when another mechanism is appropriate.
- Describe who can initiate, review, and approve NCRs, including cross-functional roles (operations, quality, engineering, supply chain).
- Specify requirements for segregation, labeling, and status control of non-conforming product in physical and digital systems.
- Clarify how NCRs connect to root cause analysis, corrective and preventive actions (CAPA), and change control.
- Address how NCRs are handled when systems are offline, running in degraded mode, or undergoing upgrades/validation.
Link to root cause analysis and CAPA
Not every NCR requires a full CAPA, but NCRs are often the primary input to your root cause analysis and improvement pipeline:
- Define which types or frequencies of non-conformances must escalate to formal CAPA.
- Use NCR data to identify patterns across plants, suppliers, and product lines.
- Ensure any corrective actions that modify validated processes, equipment, or software follow change control and revalidation as required.
Ultimately, issue an NCR whenever failing to document and control the non-conformance would create unacceptable risk to safety, compliance, traceability, or customer requirements. The specifics must be codified in your own quality system and applied consistently across your mixed-system environment.
