Contain
- Nonconforming product foundInspector
For manufacturing and lab teams: handle a nonconformance from containment to disposition, then decide if it needs corrective action (CAPA).
A nonconformity is the non-fulfilment of a requirement. In ISO 9001:2015 this sits in clause 8.7 (nonconforming outputs) and clause 10.2 (corrective action). A new edition, ISO 9001:2026, came out in September 2026, so check clause numbers against the edition you use.
- Stop and tag the affected itemsInspector
Mark them clearly, for example with a red tag or hold label, so nobody uses or ships them by mistake.
- Move them to a quarantine or hold areaInspector
Check for more of the same: other lots made with the same material, machine, operator or method, and any stock already shipped.
- Has any affected product left your control?Inspector
- Yes: go to step 5, Alert Quality about a possible customer notice
- No: go to step 6, Contained on site
- Alert Quality about a possible customer noticeInspector
Your customer contract or regulator may require notice. Medical device makers in the US must check FDA reporting duties, such as corrections and removals.
Then go to step 7, Raise a nonconformance report (NCR)
- Contained on siteInspector
- Raise a nonconformance report (NCR)Inspector
Record the part and lot numbers, quantity, the requirement not met, how it was found, photos and measurements.
Disposition
- Review the NCR and decide the dispositionQuality
Your procedure should say who can approve each option. Typically Quality and Engineering sign together. Customer approval may be needed.
- What disposition fits?Quality
- Use as is: go to step 10, Request a concession
- Rework: go to step 13, Rework to meet the original requirement
- Repair: go to step 16, Repair to an acceptable but different state
- Return to supplier: go to step 17, Return to the supplier with the NCR
- Scrap: go to step 18, Scrap and record the destruction
- Request a concessionEngineering
A concession is written permission to use or release product that does not meet a requirement. Record the technical justification.
- Concession approved?Engineering
- Yes: go to step 12, Release with the concession on file
- No: go to step 9, What disposition fits?
- Release with the concession on fileEngineering
Then go to step 19, Close the containment actions on the NCR
- Rework to meet the original requirementQuality
Rework brings the item fully back to specification. Re-inspect it afterwards.
- Passes re-inspection?Quality
- Yes: go to step 15, Release the reworked items
- No: go to step 9, What disposition fits?
- Release the reworked itemsQuality
Then go to step 19, Close the containment actions on the NCR
- Repair to an acceptable but different stateEngineering
Repair makes the item usable but not to the original specification, so it typically needs a concession as well.
Then go to step 10, Request a concession
- Return to the supplier with the NCRQuality
Ask the supplier for their own root cause and corrective action if the fault is theirs.
Then go to step 19, Close the containment actions on the NCR
- Scrap and record the destructionQuality
Make sure scrapped items cannot re-enter stock, for example by marking or destroying them.
- Close the containment actions on the NCRQuality
Corrective action
- Is corrective action needed?Quality
Not every NCR needs a full CAPA. Consider the risk to safety and the customer, whether it has happened before, and whether the cause looks systemic.
ISO's auditing guidance notes that a one-off accidental nonconformity with low chance of recurrence may need correction only.
- No, isolated and low risk: go to step 21, Record why no CAPA is needed and close the NCR
- Yes, risk or repeat: go to step 22, Open a CAPA and assign an owner
- Not sure: go to step 22, Open a CAPA and assign an owner
- Record why no CAPA is needed and close the NCRQuality
- Open a CAPA and assign an ownerQuality
Scale the investigation to the significance and risk of the problem.
- Find the root causeEngineering
Use 5 whys or a fishbone (Ishikawa) diagram. Look across people, machine, material, method, measurement and environment.
List the possible causes and mark each as confirmed, possible or not able to confirm. Do not stop at the first cause you find.
- Is the root cause confirmed?Engineering
- Gather more data and test the likely causesEngineering
Then go to step 23, Find the root cause
- Write the corrective action planEngineering
For each action: what will change, the owner, and the due date. Check if the same cause could affect other products or lines.
- Implement the actionsEngineering
Check that the change does not create new problems with product quality or the quality system.
Verify and close
- Verify effectivenessQuality
Collect objective evidence that the actions were done as described and that the problem has not come back, for example over several lots or a set period.
- Did the actions work?Quality
- No: go to step 30, Reopen the investigation
- Yes: go to step 31, Close the CAPA and the NCR
- Reopen the investigationQuality
Then go to step 23, Find the root cause
- Close the CAPA and the NCRQuality
Record the evidence, dates and approvals. Feed the results into management review.
- Is this a regulated product?Quality
- US medical device: go to step 33, Check QMSR requirements with your regulatory lead
- Other regulated sector: go to step 34, Check your sector's rules with your regulatory lead
- No: go to step 35, Nonconformance closed and corrective action verified
- Check QMSR requirements with your regulatory leadQuality
Since 2 February 2026, FDA's Quality Management System Regulation (21 CFR 820) incorporates ISO 13485:2016 by reference.
ISO 13485 has its own requirements for nonconforming product and corrective action. Check your procedures against it.
- Check your sector's rules with your regulatory leadQuality
- Nonconformance closed and corrective action verifiedQuality