Nonconformance Report: Complete NCR Guide and Template

A nonconformance report (NCR) is a formal quality record that documents a product, process, or material that fails to meet a specified requirement — and the first thing you do when you spot one is contain the affected item before it moves further down the line.

When a nonconformance surfaces, the sequence matters:

• Contain immediately. Quarantine the affected part, lot, or batch before it reaches the next operation or ships to a customer.
• Raise the NCR. Open a formal record while the evidence is fresh — photos, measurements, and witness details degrade fast.
• Tag and segregate. Apply a physical hold tag or red-bin the item; update your inventory system to prevent inadvertent use or release.
• Notify responsible roles. Alert the inspector, QA lead, and production manager so triage can begin within 24 hours.

Two standards frame audit expectations in the U.S.: ISO 9001 for general quality management systems and FDA 21 CFR 820.90 for medical device manufacturers. Both require documented evidence of the nonconformance, the disposition decision, and any corrective action taken. Getting that chain of evidence right from the first line of the NCR is what separates a defensible record from an audit finding.

Key Takeaways

A nonconformance report is only as strong as the evidence chain it contains — from observed condition to verified closure, every link must be documented, dated, and signed.

Table of Contents

• What is a nonconformance report and why does it matter?
• How do you classify a nonconformance?
• What fields belong in an effective NCR?
• How to write a clear, audit-ready NCR step by step
• What does the NCR workflow look like across roles?
• When should an NCR escalate to a CAPA?
• What are the disposition options and how do you contain the issue?
• NCR template: blank form and a filled example
• How do NCRs satisfy U.S. regulatory and audit requirements?
• Best practices and common mistakes in NCR management
• When does a digital NCR system outperform paper forms?
• QA-Report gives your NCR workflow an audit-ready foundation
• Sources

What is a nonconformance report and why does it matter?

An NCR is more than a complaint form. It is the entry point for your quality assurance process: the record that triggers containment, drives disposition decisions, and, when needed, seeds a corrective action plan. Without it, a defect is just a verbal note that disappears at shift change.

Nonconformances fall into four broad categories:

• Product nonconformances — a machined dimension outside drawing tolerance, a weld that fails visual inspection, a surface finish that misses the Ra specification.
• Process nonconformances — a heat-treat cycle run at the wrong temperature, an operator skipping a required inspection step, a torque value applied out of sequence.
• Supplier nonconformances — incoming material with a missing or incorrect certificate of conformance, a casting with porosity beyond the acceptance criteria, a delivery that substitutes an unapproved material.
• Documentation nonconformances — a traveler missing a required signature, a revision-level mismatch between the drawing on the floor and the current release, an expired calibration record on an instrument used for a critical measurement.

How an NCR differs from a CAR or CAPA

The NCR vs CAR distinction trips up even experienced teams. An NCR records what happened and drives immediate disposition. A corrective action report (CAR) or CAPA (corrective and preventive action) addresses why it happened and prevents recurrence. Not every NCR needs a CAR. A single scratched part that gets scrapped and replaced closes as an NCR with no further escalation. A third scratch defect on the same part number in 60 days almost certainly warrants a CAR and possibly a CAPA.

The practical rule: classify by the effort required to resolve the issue, not by which acronym sounds most serious. Misusing these terms creates unnecessary paperwork and buries the NCRs that actually need root cause analysis under a pile of over-escalated records.

When to open an NCR versus when not to

Open an NCR any time a product, process, or document fails a stated requirement — a drawing note, a specification, a procedure step, a customer purchase order clause. Do not open one for a judgment call that falls within tolerance, a cosmetic preference that has no acceptance criterion, or a process improvement idea. Those belong in a continuous improvement log, not the nonconformance system. Keeping that boundary clear protects the signal-to-noise ratio of your NCR data.

How do you classify a nonconformance?

Classification determines the speed and depth of response. Getting it wrong in either direction costs you: under-classify a critical issue and a nonconforming part ships; over-classify a minor scratch and your team drowns in CAPA paperwork.

Minor nonconformances involve deviations with no functional or safety consequence: a label slightly off-center within a defined tolerance zone, a surface mark inside the cosmetic acceptance window, a missing secondary signature on a non-critical traveler step.

Major nonconformances affect function, fit, or customer requirements. A bore diameter 0.003 inches outside the bilateral tolerance on a mating assembly is major. So is a supplier certificate that references the wrong material specification. These require engineering disposition and documented containment.

Critical nonconformances carry safety, regulatory, or contractual exposure. Any out-of-tolerance condition on a flight-safety part under AS9100, a sterility breach in a medical device lot, or a dimensional failure on a structural weld joint escalates automatically. The moment a safety risk or regulatory exposure is confirmed, stop-shipment is the default action — not a discussion point.

Practical escalation triggers that should be written into your procedure: repeat occurrence of the same defect code within a defined window (commonly 30 or 60 days), any customer complaint tied to a shipped nonconformance, any condition that could affect a safety-critical characteristic, and any finding that surfaces during an external audit.

What fields belong in an effective NCR?

A well-designed NCR form captures enough information to reconstruct exactly what happened, who made each decision, and what evidence supports the disposition. The following table maps each field to its purpose and the role typically responsible for completing it.

The fields that most often fail audit scrutiny are the spec reference (left blank or vague), the evidence record (photos without timestamps or instrument IDs), and the verification step (marked "complete" with no supporting data). Auditors following ISO standards and FDA guidance look for a continuous chain from observed condition to verified closure — a gap anywhere in that chain is a finding.

Pro Tip: Attach photos with embedded timestamps and reference the calibration certificate number of the instrument used. A measurement traceable to a specific instrument ID and calibration date is far more defensible than a number written in a field with no supporting evidence. See QA-Report's guidance on inspection documentation best practices for a practical framework.

How to write a clear, audit-ready NCR step by step

The NCR workflow follows a consistent sequence whether you are working in aerospace, automotive, or medical devices. Each step has a specific output that feeds the next.

1. Detect. Identify the nonconformance during incoming inspection, in-process inspection, final inspection, or audit. Note the exact location, operation, and time.

2. Contain. Physically segregate the affected item. Apply a hold tag, move it to a quarantine area, and flag the lot in your inventory system. Do this before writing a single word on the NCR form.

3. Document the observed condition. Use evidence-first language: what was found, where it was found, how it was measured, and who observed it. Example: "Outer diameter measured at 1.2534 in. using Mitutoyo micrometer SN-4421 (cal. due 2026-09-01); drawing Rev. C specifies 1.2500 ± 0.0010 in. Deviation: +0.0034 in. Observed by J. Torres, 2026-03-14, Station 4."

4. Reference the requirement. Cite the exact drawing number and revision, specification clause, or procedure step that the condition violates. "Per drawing 10045 Rev. C, Note 3" is audit-ready. "Does not meet spec" is not.

5. Classify. Apply the minor/major/critical decision rules. Record the classification and the rationale — especially if a borderline case was discussed.

6. Disposition. Select and document the authorized disposition: rework, scrap, use-as-is with concession, or return to supplier. Engineering sign-off is required for anything beyond operator-level rework.

7. Analyze root cause (if required). For major and critical NCRs, or any repeat occurrence, conduct a formal root cause analysis. Document the method used and the confirmed cause inside the NCR or link to the RCA record.

8. Assign corrective actions. For each confirmed root cause, assign a specific action, an owner, and a due date. Vague actions ("train operators") without a named owner and deadline rarely get done.

9. Verify and close. Confirm that corrective actions were completed and effective. Attach verification evidence — a re-inspection result, a process audit record, or a follow-up measurement. Only then mark the NCR closed.

Before closing any NCR, confirm the following minimum evidence is on file:

• Observed condition described with measurement data and instrument reference
• Spec or drawing reference cited
• Containment action documented with date and responsible party
• Disposition decision recorded with authorizing signature
• Root cause stated (or documented rationale for why RCA was not required)
• Corrective action assigned with owner and due date (if applicable)
• Verification evidence attached

What does the NCR workflow look like across roles?

A nonconformance report does not belong to one person. It moves through a defined sequence of owners, each responsible for a specific decision or action. Breakdowns in handoffs — not bad intentions — are the most common cause of NCR backlog.

A short triage window (generally within a few days) is recommended to avoid containment risks. An unclassified NCR sitting in a queue is a containment risk: the affected material may still be moving. Production reporting systems that flag open NCRs against active work orders help prevent that scenario.

For supplier nonconformances, the workflow extends to include a supplier corrective action request (SCAR). The SCAR mirrors the internal NCR structure but places the root cause and corrective action obligations on the supplier, with a defined response deadline. Under the Federal Acquisition Regulation, government contractors may face additional disposition and recordkeeping obligations that go beyond standard ISO requirements.

When should an NCR escalate to a CAPA?

Not every NCR needs a corrective action plan. A single out-of-tolerance dimension on a part that gets scrapped and replaced is a containment-and-disposition event. The NCR closes, the data feeds your trend chart, and you move on. Escalating that to a full CAPA wastes resources and dilutes the attention your real systemic problems deserve.

The decision to open a CAPA should be driven by evidence of a systemic or recurring problem, not by severity alone. Practical escalation criteria include repeat defect codes occurring multiple times on the same part number or process within a short, defined timeframe.

• A major or critical NCR reveals a process gap that could affect other part numbers or operations.
• A customer complaint is tied to a shipped nonconformance.
• An external auditor raises the finding as a major nonconformance against your quality management system.
• A regulatory body (FDA, FAA) requires documented corrective action.

Choosing the right root cause method

Root cause analysis in manufacturing relies on several well-established methods. Matching the method to the problem scale matters.

• 5 Whys works well for single-event, straightforward failures where the causal chain is short. Ask "why" five times, document each answer, and confirm the root cause is something you can actually fix. A machining tolerance failure caused by a worn insert is a 5 Whys problem.
• Fishbone (Ishikawa) diagram suits multi-factor problems where the cause is not obvious. Organize potential causes across the standard categories (Man, Machine, Method, Material, Measurement, Environment) and use data to eliminate branches. A fishbone analysis in manufacturing is particularly useful when the same defect appears across multiple operators or shifts.
• 8D (Eight Disciplines) is the structured choice when a customer requires a formal response. It combines containment, root cause, corrective action, and preventive action in a single documented report, and it maps directly to AS9100 and IATF 16949 expectations.
• Fault tree analysis applies to complex, safety-critical systems where multiple failure modes could combine. It is more common in aerospace and defense than in general manufacturing.

Linking RCA outcomes to the NCR and CAPA records

Document the root cause method used, the confirmed cause, and the evidence that supports it inside the NCR itself — even if a separate CAPA record carries the full analysis. The NCR should contain at minimum: "Root cause confirmed as [X] via [method] on [date]. CAPA #[number] opened." That cross-reference is what auditors look for when they pull an NCR and want to verify the corrective action chain.

What are the disposition options and how do you contain the issue?

Disposition is the authorized decision about what to do with nonconforming material. It is not a suggestion — it requires documented approval from the right authority level, and it must be recorded on the NCR before the material moves.

Common disposition options:

• Rework. Bring the item into conformance through additional processing. Requires a defined rework procedure, re-inspection after completion, and documentation that the reworked item now meets all requirements.
• Repair. Similar to rework but results in an item that meets functional requirements without fully conforming to the original specification. Requires customer or engineering concession in most regulated environments.
• Scrap. Permanently remove the item from the production stream. Document the scrap action, the quantity, and the cost. Physically mark or destroy the item to prevent inadvertent use.
• Use-as-is (concession). Accept the nonconforming item without modification. Requires documented engineering justification and, in many cases, customer approval. The justification must address why the deviation does not affect form, fit, function, or safety.
• Return to supplier. Send nonconforming incoming material back to the supplier with a documented SCAR. Record the return authorization number and the supplier's required response date.

Containment checklist:

• Physical quarantine: move item to a designated hold area or red bin
• Hold tag applied with NCR number, date, and "DO NOT USE" marking
• Lot segregation: verify no other items from the same lot are in production or have shipped
• Inventory system flag: lock the lot or serial number in your ERP or MES to prevent release
• System lock on work orders: prevent the next operation from starting on held material
• Customer notification: if any nonconforming material may have shipped, notify the customer per your contract or quality agreement

Cost attribution belongs on the NCR. Record the labor cost of rework or re-inspection, the material cost of scrapped items, and any supplier chargeback amounts. This data feeds your cost-of-poor-quality (COPQ) metrics and supports supplier performance reviews.

NCR template: blank form and a filled example

Blank NCR template

The following fields constitute a complete NCR form. This structure works as a PDF, an Excel workbook, or an online form in a quality management platform.

NCR Header

• NCR Number:
• Date Opened:
• Reported By (Name / Role):
• Part Number / Description:
• Drawing Number / Revision:
• Lot Number / Serial Number:
• Quantity Affected:
• Location Found (operation, station, incoming dock):

Nonconformance Description

• Requirement / Specification Reference:
• Observed Condition (what, where, how measured, who observed):
• Evidence Attached (photo IDs, measurement report, instrument ID, calibration due date):
• Severity Classification (Minor / Major / Critical):

Containment

• Containment Action Taken:
• Date Contained:
• Responsible Party:

Disposition

• Disposition Decision (Rework / Scrap / Use-as-is / Return to Supplier):
• Disposition Justification:
• Authorized By:
• Date:

Root Cause and Corrective Action

• Root Cause Method Used:
• Confirmed Root Cause:
• Corrective Action(s) Assigned:
• Owner(s) and Due Date(s):
• CAPA Reference (if applicable):

Verification and Closure

• Verification Evidence:
• Verified By:
• Date Closed:
• QA Manager Approval:

Retain completed NCR records for a minimum of three years for ISO 9001 compliance; FDA-regulated manufacturers should follow the 21 CFR 820 recordkeeping requirements, which typically require records to be retained for the expected life of the device or two years after distribution, whichever is longer. Defense contractors should confirm retention periods against their contract's applicable FAR clauses.

Filled example: wrong material certificate on incoming aluminum bar stock

NCR Number: NCR-2026-0047 Date Opened: 2026-03-18 Reported By: A. Reyes, Receiving Inspector Part Number / Description: 6061-T6 Aluminum Bar, 1.500 in. diameter Drawing Number / Revision: PO-8812, Rev. B Lot Number: LOT-2026-0312 Quantity Affected: 200 pieces Location Found: Incoming inspection dock

Requirement: PO-8812 Rev. B requires material certification per AMS 2770 with chemical and mechanical test results traceable to the heat number. Observed Condition: Certificate of conformance supplied by vendor references heat number HT-9921. Chemical analysis on certificate lists silicon content at 0.72% (AMS 2770 limit: 0.40–0.80%). Mechanical test results are absent from the certificate. Observed by A. Reyes, 2026-03-18, using document review only — no physical measurement required. Evidence: Certificate of conformance (scanned, attached as NCR-2026-0047-COC.pdf). PO-8812 Rev. B (attached). Severity: Major

Containment: All 200 pieces moved to quarantine cage Q-3. Hold tag NCR-2026-0047 applied. Lot locked in ERP (SAP, plant 1100). Purchasing notified.

Disposition: Return to supplier. Supplier to provide complete certificate with mechanical test results traceable to heat HT-9921 within 5 business days or replace the lot.

Root Cause: Supplier's certificate template does not include a mandatory mechanical properties section. Confirmed via supplier quality review call, 2026-03-20. SCAR-2026-0019 opened.

How do NCRs satisfy U.S. regulatory and audit requirements?

U.S. manufacturers operate under several overlapping frameworks, and NCR records are a primary audit artifact in all of them.

ISO 9001 and AS9100. ISO's quality management standards require documented procedures for controlling nonconforming outputs (clause 8.7 in ISO 9001:2015), including identification, segregation, disposition, and records of the authority making the disposition decision. AS9100 Rev D adds aerospace-specific requirements: first article inspection linkage, traceability to customer-approved sources, and documented risk assessment for use-as-is dispositions. Auditors will pull NCR records and trace them to disposition evidence and, where applicable, CAPA records.

FDA 21 CFR Part 820. Medical device manufacturers must comply with the Quality System Regulation, which requires documented procedures for nonconforming product control and complaint handling. FDA guidance on quality records describes what investigators expect to find: a clear description of the nonconformance, the disposition decision, the person authorizing it, and the date. Incomplete or unsigned NCRs are among the most common FDA Form 483 observations.

Federal Acquisition Regulation. Defense and government contractors working under FAR-based contracts face additional obligations. Certain FAR clauses require documented disposition of nonconforming supplies, notification to the contracting officer for critical nonconformances, and retention of quality records for the duration specified in the contract. The FAR does not prescribe a specific NCR format, but it does require that records be sufficient to demonstrate compliance with contract quality requirements.

Audit-prep checklist for NCR files:

• Observed condition described with measurement data and instrument reference
• Drawing or specification cited by number and revision
• Containment action documented with date and responsible party name
• Disposition decision recorded with authorizing signature and date
• Calibration records for instruments used in the investigation attached or referenced
• Root cause documented (or rationale for why RCA was not required)
• Corrective action with owner, due date, and CAPA cross-reference (if applicable)
• Verification evidence attached and signed
• NCR closed by authorized QA manager

For aerospace manufacturers, SAE standards such as AS9102 (First Article Inspection) and AS13100 (quality management for aerospace suppliers) provide additional specification anchors that NCRs may reference. Citing the correct SAE standard number and revision in the spec reference field strengthens the audit trail considerably.

Best practices and common mistakes in NCR management

The difference between a quality system that passes audits and one that generates repeat findings often comes down to a handful of operational habits.

Practices that consistently improve NCR quality:

• Anyone on the shop floor should be able to raise an NCR — not just QA staff. Restricting NCR creation to a single role delays containment and suppresses reporting.
• Write the observed condition before the disposition. Teams that jump to "scrap it" before documenting what they found produce NCRs that cannot support trend analysis or supplier chargebacks.
• Link every NCR to the relevant production record, work order, or purchase order number. That cross-reference is what makes your data searchable when an auditor asks for all NCRs on part number X in the last 12 months.
• Track NCR metrics monthly: open count by severity, average days to close, repeat defect codes, and cost of poor quality by department or supplier. Metrics turn individual NCRs into systemic intelligence.

Common mistakes and how to avoid them:

• Missing spec reference. "Does not meet drawing" is not a spec reference. Cite the drawing number, revision, and the specific note or dimension that was violated.
• Weak containment evidence. "Parts quarantined" with no date, no location, and no responsible party is unverifiable. Name the person, the location, and the time.
• Over-classifying to trigger CAPA. Classifying every NCR as major to ensure it gets attention creates a CAPA backlog that buries real systemic problems. Classify by actual impact, not by urgency of attention.
• Closing without verification. Marking an NCR closed because the corrective action was assigned — not completed and verified — is a common audit finding. Closure requires evidence that the action worked.
• Vague corrective actions. "Retrain operators" with no named trainer, no training record, and no re-inspection plan is not a corrective action. It is an intention. Assign a specific person, a completion date, and a verification method.

A practical dos and don'ts summary:

• Do attach photos with timestamps and instrument IDs.
• Do cross-reference the NCR in your production traveler or work order.
• Do set a calendar reminder for corrective action due dates.
• Don't use the NCR description field to assign blame — describe the condition, not the cause.
• Don't let NCRs sit unclassified for more than 72 hours.
• Don't close an NCR without a verification signature from QA.

When does a digital NCR system outperform paper forms?

Paper NCR forms work at low volume. A shop running 10 to 20 NCRs per month can manage with a shared drive and a spreadsheet tracker. The system breaks down predictably as volume grows, audit frequency increases, or the team needs to correlate NCR data with inspection results and production records.

Signals that indicate a digital system is worth the investment:

• Open NCRs regularly exceed 30 days without closure.
• Auditors ask for NCR trend data and the answer requires manual spreadsheet work.
• The same defect code appears repeatedly but no one connects the dots until an audit.
• Inspection photos are stored separately from NCR records, making evidence retrieval slow.
• Multiple sites or shifts are managing NCRs independently with no shared visibility.

Benefits of a digital NCR workflow:

• Automatic NCR numbering and status tracking eliminate duplicate records and lost paperwork.
• Photo and measurement data attach directly to the NCR at the point of capture, with timestamps and instrument IDs preserved.
• Cross-references to inspection reports, work orders, and CAPA records are clickable links, not handwritten notes.
• Trend dashboards surface repeat defect codes, high-cost suppliers, and overdue corrective actions without manual analysis.
• Audit exports produce a complete, formatted record set in minutes rather than hours of file retrieval.

A phased rollout approach:

1. Start by digitizing the NCR form itself — move from paper to an online form that enforces required fields and generates a unique ID automatically.
2. Add photo and measurement evidence attachment in the second phase, linking instrument IDs to calibration records.
3. Integrate with your inspection system and production records in the third phase so NCRs can be raised directly from an out-of-tolerance inspection result.
4. Activate trend reporting and CAPA linking once the data volume justifies it — typically after three to six months of consistent digital NCR creation.

Corrective action software that integrates with your NCR workflow reduces the manual effort of escalating from an NCR to a CAPA and keeps the cross-reference chain intact for auditors.

The NCR problem most teams don't talk about

The real failure mode in most NCR systems is not bad documentation — it is the cultural habit of treating NCRs as administrative burden rather than operational data. Teams that write the minimum required to close the record and move on are leaving the most valuable part of the system unused.

Every NCR is a data point. A single NCR on a scratched surface is a containment event. Twelve NCRs on scratched surfaces across three part numbers in one quarter is a process signal — possibly a fixturing problem, a handling procedure gap, or a supplier packaging issue. The teams that catch that signal early, before it becomes a customer complaint or an audit finding, are the ones who treat NCR creation as a discipline, not a chore.

Classification by effort rather than emotion is the most practical heuristic for keeping the system honest. If the fix takes 10 minutes and requires no process change, it is a correction. If it requires understanding why the process failed and changing something to prevent recurrence, it is a corrective action. That distinction, applied consistently, keeps your CAPA queue focused on problems that actually need systemic solutions.

QA-Report gives your NCR workflow an audit-ready foundation

Managing NCRs manually means chasing photos across email threads, hunting for calibration records at audit time, and rebuilding trend data from spreadsheets. QA-Report replaces that friction with a connected workflow built for regulated manufacturers.

With QA-Report, inspection evidence — CMM data, dimensional measurements, photos with timestamps, and instrument calibration references — attaches directly to the NCR at the point of capture. Drawing ballooning links specific dimensions to their NCR records automatically, so the audit trail from observed condition to verified closure is complete without manual cross-referencing. The platform's CMM inspection software imports measurement data and auto-flags out-of-tolerance results, which can trigger an NCR directly from the inspection record. CAPA linking, retention exports, and role-based approvals are built in, not bolted on.

For quality teams managing aerospace, automotive, or medical device production, QA-Report reduces the time from NCR creation to audit-ready closure. Start a free trial at Qa-report and see how your next NCR looks when the evidence chain builds itself.

Sources

• Fda
• Acquisition
• Iso

Recommended

• Inspection Documentation Best Practices for Manufacturers
• CNC & CMM Quality Control Reports: How to Automate Inspection Documentation
• First Article Inspection Report Template: Free AS9102 Guide
• How to Import CMM Data into Inspection Reports