ISO 9001 Clause 8.7: Control of Nonconforming Outputs

ISO 9001:2015 Clause 8.7 has one core demand: any output that fails to meet its requirements must be identified and controlled before it reaches the customer or the next production step. No exceptions, no informal workarounds.

Three things must happen the moment a nonconformity is detected:

• Identify and segregate the output so it cannot be used or shipped accidentally.
• Decide a disposition — rework, scrap, concession, or return — with documented authorization.
• Retain records that describe the nonconformity, the action taken, and who approved it.

Everything else in the clause builds from those three steps.

Key Takeaways

Clause 8.7 compliance depends on four things done consistently: identifying nonconforming outputs at detection, controlling them before any further use, documenting every disposition with named authorization, and closing the loop to corrective action for recurring issues.

Table of Contents

• What does ISO 9001 clause 8.7 actually require?
• Acceptable dispositions and how to choose between them
• Who signs off on dispositions and how to document it
• Procedure checklist and sample NCR fields
• How clause 8.7 connects to clause 10.2 and continual improvement
• Common audit findings and how to prepare
• How quality inspection software supports clause 8.7 controls
• What practitioners get wrong about clause 8.7
• QA-Report makes clause 8.7 audit-ready from day one
• Sources

What does ISO 9001 clause 8.7 actually require?

The clause splits into two numbered sub-requirements. Understanding the distinction between them is what separates a compliant procedure from a paper exercise.

Clause 8.7.1 — Actions to take

1. Identify outputs that do not conform to requirements.
2. Control them to prevent unintended use or delivery (segregation, labeling, hold tags).
3. Take appropriate action based on the nature of the nonconformity: correction/rework, segregation, concession, informing the customer, or suspension of the service.
4. Apply the same controls to nonconforming outputs discovered after delivery — a product that fails in the field is still in scope.
5. Re-verify conformity after any correction before the output is released.

Clause 8.7.2 — Documented information to retain

The standard requires documented evidence covering:

• A description of the nonconformity.
• The actions taken (disposition decision and steps).
• Any concessions granted.
• The identity of the authority who decided the disposition.

That last point is where many organizations fall short. Auditors want a name or a role, not just a checkbox.

Who holds disposition authority?

The clause does not prescribe a specific role, but it requires that whoever decides the disposition is identified in the record. In practice, this means your procedure must define which roles can authorize which types of disposition — and that authorization must be traceable in every NCR record. A disposition approved verbally and never documented is, from an audit perspective, a disposition that never happened.

Acceptable dispositions and how to choose between them

Clause 8.7 lists the accepted categories of action without ranking them. Your procedure should define each one and set the conditions under which it applies.

• Correction/rework: The output is brought into conformance through additional processing, machining, or repair. Requires re-verification before release.
• Segregation/containment: The output is physically or digitally isolated to prevent use while a disposition decision is pending. This is always the first step, regardless of what comes next.
• Concession (use-as-is): An authorized party — often the customer or a designated internal authority — accepts the output despite the nonconformity. Must be documented with the concession scope and the authorizing signature.
• Scrap: The output is destroyed or rendered permanently unusable. Requires a record confirming disposal.
• Return to supplier: For incoming nonconforming materials, the item is returned with a formal rejection notice. Links directly to supplier control processes and incoming inspection practices.
• Suspension of service: For service organizations, delivery is paused until the nonconformity is resolved.

Manufacturing example: A machined shaft arrives at final inspection 0.04 mm over the upper tolerance limit on a critical diameter. The inspector places a red hold tag on the part and logs an NCR. The quality engineer reviews the drawing and the fit tolerance, determines rework is feasible, and authorizes a grinding operation. After rework, the part is re-measured against the original acceptance criteria and the re-inspection result is attached to the NCR before the part is released.

Service example: A software deliverable is missing a required configuration item specified in the contract. The project quality lead logs the nonconformity, suspends delivery of that module, and notifies the customer per the contract's notification clause. The team corrects the configuration, and the customer signs a re-acceptance record before the module goes live.

Choosing the right disposition comes down to five factors: safety and regulatory impact (a concession on a flight-critical part is rarely acceptable), cost of rework versus scrap, customer contract terms, technical feasibility, and residual risk after the action. When safety or regulatory requirements are involved, the decision must be escalated regardless of cost.

Who signs off on dispositions and how to document it

Clear role assignments prevent the most common audit finding in this clause: a disposition that happened but has no traceable authorization.

An authorization matrix in your procedure should define the delegation levels explicitly. For example: an inspector can authorize rework on non-critical dimensions within a defined tolerance band; the quality manager can grant a use-as-is concession up to a defined impact level; anything affecting safety, regulatory compliance, or customer contract terms requires customer sign-off.

Competency and training expectations

Staff who identify, segregate, or disposition nonconforming outputs need documented training. Auditors regularly ask for training records tied to the specific procedure — not just a general quality awareness course. The training should cover:

• How to recognize a nonconformity against acceptance criteria.
• The labeling and segregation procedure (where to put items, which tags to use).
• Which dispositions they are authorized to make independently.
• When and how to escalate.

Competency verification — a practical sign-off or a witnessed task — carries more weight with auditors than a training attendance sheet alone.

Procedure checklist and sample NCR fields

A well-structured NCR form is the backbone of Clause 8.7 compliance. Every field below maps to a specific clause requirement or a common auditor question.

Procedure checklist for Clause 8.7 compliance

1. Detect the nonconformity against defined acceptance criteria (drawing, specification, work instruction).
2. Apply a hold label or status tag immediately — before any other action.
3. Physically or digitally segregate the item from conforming stock.
4. Open an NCR and record the description, affected batch, and detecting party.
5. Notify the quality function per the escalation workflow in your procedure.
6. Evaluate the nonconformity and select a disposition with the appropriate authorization level.
7. Execute the disposition action (rework, scrap, return, concession).
8. Re-verify conformity if the item was corrected — re-inspection must reference the original acceptance criteria.
9. Attach re-verification evidence to the NCR record.
10. Close the NCR and transfer to trend analysis; escalate to CAPA if the nonconformity is recurring or systemic.

Typical workflow: Detection → Containment (label + segregate) → NCR opened → Disposition decision (authorized) → Action executed → Re-verification → Record closed → Trend review → CAPA trigger if warranted.

Good inspection documentation practices make this workflow auditable at every step, not just at the final record.

How clause 8.7 connects to clause 10.2 and continual improvement

Clause 8.7 controls the immediate problem. Clause 10.2 fixes the system that allowed it to occur. The two clauses are designed to work in sequence, and auditors expect to see the handoff documented.

Presencis notes that when a corrected output is re-verified and the NCR is closed, that is not the end of the process for recurring or significant nonconformities. Those events should trigger a formal corrective action under Clause 10.2.

The linkage in practice:

• When to escalate to CAPA: A nonconformity that recurs more than once in a defined period, any nonconformity with safety or regulatory impact, and systemic failures (same root cause across multiple batches or processes) all warrant a Clause 10.2 corrective action.
• How to document the link: The NCR record should carry a CAPA reference number once one is opened. The CAPA record should reference the originating NCR IDs. Auditors trace this path in both directions.
• The improvement loop: NCR → root-cause analysis → corrective action plan → implementation → verification of effectiveness → management review input. Each step needs a record.

Corrective action software can automate the escalation trigger and keep the NCR-to-CAPA linkage intact without manual cross-referencing. The role of compliance in manufacturing operations extends beyond individual clause requirements — the improvement loop is what makes a QMS self-correcting rather than reactive.

Common audit findings and how to prepare

Auditors examining Clause 8.7 follow a predictable path. They ask for the procedure, pull a sample of NCRs, and then verify that each record is complete and traceable. Here is what they expect to find — and what they most often do not.

Audit evidence checklist

• Documented Clause 8.7 procedure (current revision, approved).
• NCR log with sequential IDs and no gaps.
• Evidence of physical or digital segregation (photos, status fields, hold tags).
• Disposition authorization on every closed NCR (name, role, date).
• Re-verification records for all reworked items, referencing original acceptance criteria.
• CAPA references for recurring or significant nonconformities.
• Training records for staff authorized to handle nonconforming outputs.
• Customer notification records where required by contract or the clause.

Common findings and how to address them

• Undocumented dispositions: The item was reworked but no NCR was opened. Fix: make NCR creation mandatory at the point of detection, not after disposition.
• Reworked items not re-verified: The part was fixed and released without a re-inspection record. Fix: add a mandatory re-verification step and evidence field to the NCR form before the record can be closed.
• Missing authority records: The NCR shows a disposition but no authorizing name or role. Fix: make the authorization field a required entry in the NCR system.
• No trend analysis: NCRs exist but are never reviewed for patterns. Fix: schedule a monthly NCR review and document it as a management review input.
• After-delivery nonconformities not captured: Customer complaints or field failures are handled by customer service but never enter the NCR system. Fix: add a trigger in the customer complaint process to open an NCR for any confirmed nonconformity.

Pro Tip: Before your next audit, pull ten closed NCRs at random and check each one for a disposition authorization name, a re-verification record, and a CAPA reference where the nonconformity recurred. If any of those three fields is blank, you have found your audit gap before the auditor does.

Documentary evidence that works well in an audit: an NCR log extract showing sequential IDs and closure dates, a disposition authorization form with signatures, re-test measurement records or CMM reports attached to the NCR, and email or written customer concession approvals for use-as-is decisions.

How quality inspection software supports clause 8.7 controls

Software does not replace the procedure, but it removes the manual steps that create audit gaps. Here is how the clause requirements map to platform features.

• Identification and logging: Mobile NCR capture lets inspectors open a record on the shop floor the moment a nonconformity is detected — no paper form to lose, no delay between detection and documentation.
• Segregation and labeling: Status fields and QR-coded hold tags link the physical item to its digital NCR record. Anyone scanning the tag sees the current disposition status instantly.
• Disposition workflows and authorization: Role-based approval workflows enforce the authorization matrix. A disposition that requires a quality manager sign-off cannot be closed by an inspector — the system holds it until the right role approves.
• Re-verification and evidence capture: Photo attachments, CMM data import, and re-inspection records attach directly to the NCR. The re-verification evidence is part of the record, not a separate file that might get lost.
• Trend analysis: NCR dashboards show nonconformity frequency by part, process, supplier, and time period. Recurring patterns surface automatically rather than requiring manual spreadsheet analysis.

QA-Report maps directly to these requirements. The platform captures NCRs with role-based disposition approvals, links re-verification evidence (including CMM imports and inspection report PDFs) to each record, and generates NCR trend reports that feed directly into management review. The manufacturing QA guide covers how these features fit into a broader QMS structure.

On integration: connecting the NCR system to ERP, production planning, and supplier return workflows closes the loop between the nonconformity record and the operational response. A rejection that triggers a supplier return should automatically update the purchase order status; a rework order should appear in the production schedule. That level of integration is what BSI's research associates with the measurable quality improvements — roughly 66% of organizations reporting improved products and services and 65% reporting increased customer trust — that mature QMS implementations deliver.

What practitioners get wrong about clause 8.7

A practitioner's perspective

The clause text is short. Most quality managers read it in under two minutes. That brevity is exactly what makes it dangerous — it looks simpler than it is.

The most persistent implementation mistake is treating Clause 8.7 as a paperwork requirement rather than a process control. Teams open NCRs after the fact, fill in the disposition field retroactively, and consider the record closed. The physical item may have been handled correctly, but the documented trail does not prove it. An auditor cannot verify what was not recorded at the time it happened.

Three practical tips that experienced practitioners use:

Label first, investigate later. The hold tag goes on the item before anyone decides what to do with it. This single discipline prevents the most common failure mode: a nonconforming item that gets used because the disposition decision took longer than expected and someone assumed it had been cleared.

Standardize your disposition categories. Organizations that define four or five named disposition types in their procedure — and train staff on exactly what each one means — produce far cleaner NCR records than those that leave the field open-ended. "Rework per ECN-2024-047" is auditable. "Fixed" is not.

Verify rework to the original acceptance criteria, not the rework instruction. A common pitfall: the rework instruction specifies a grinding operation, the inspector verifies that the grinding was performed, and the NCR is closed. But the original dimensional requirement was never re-checked. Re-verification means measuring against the drawing or specification that defined the nonconformity — not confirming that the corrective step was executed.

One pattern worth watching: organizations that separate their Clause 8.7 procedure from their Clause 10.2 CAPA procedure so completely that the two processes never talk to each other. The NCR system closes records; the CAPA system opens investigations; and nobody checks whether a CAPA was ever triggered for a nonconformity that recurred six times in a quarter. The ASQ quality resources on ISO 9001 frame Clause 8 as an integrated operational control — and that integration is what auditors are really testing when they ask for your NCR-to-CAPA linkage.

Align your local procedure language to the clause text. Where your process deviates from the standard approach — a temporary workaround, a customer-specific exception — document it as a controlled exception with a defined review date. Undocumented deviations are findings; documented, authorized exceptions are evidence of a mature QMS.

QA-Report makes clause 8.7 audit-ready from day one

Preparing for a Clause 8.7 audit means having complete NCR records, traceable disposition authorizations, and re-verification evidence ready to present — not assembled the week before the audit. QA-Report gives quality managers and auditors exactly that, built into the daily inspection workflow.

The platform captures nonconforming outputs at the point of detection with mobile NCR forms, enforces role-based disposition approvals so every authorization is timestamped and attributed, and attaches re-verification evidence (CMM imports, inspection PDFs, photos) directly to each record. NCR trend dashboards surface recurring issues before they become audit findings, and the CAPA linkage keeps the Clause 8.7-to-Clause 10.2 trail intact without manual cross-referencing.

Quality managers preparing for an ISO 9001 audit can start a free trial at QA-Report and run a live NCR through the full workflow — detection, disposition, re-verification, and record closure — before the auditor arrives.

Sources

The following sources provide the primary clause text and authoritative implementation guidance for Clause 8.7.

• ISO 9001:2015 - Quality management systems — Requirements
• ISO 9001 - Clause 8.7 Control of nonconforming outputs
• 8.7 Control of nonconforming outputs
• ISO 9001 Article 8.7: Control of Nonconforming… | Presencis
• ISO 9001 Certification: A Path to Improved Quality | BSI

When quoting the clause text in audit evidence or internal procedures, always reference the specific subclause number (8.7.1 or 8.7.2) and the standard edition (ISO 9001:2015) so auditors can verify the source without ambiguity.

Recommended

• Incoming Inspection: Best Practices for QA Engineers
• Top 3 Manufacturing Quality Control Software Options 2026
• CNC & CMM Quality Control Reports: How to Automate Inspection Documentation
• Inspection Documentation Best Practices for Manufacturers