Non-Conformance

Non-conformance or nonconformity refers to a failure to meet one or more of the ISO standards. It is a problem or mistake unresolved that may disrupt an organization's daily business operation.

ISO 9000:2015 3.6.9 defines the non-fulfillment of a requirement as a “nonconformity”. The fulfilling of a requirement is regarded as "conformity" in 3.6.11.

The auditing guideline standard ISO 19011:2018 defines "audit findings" in 3.10 as the results of an evaluation of audit evidence to audit criteria. It states that findings can indicate conformity or nonconformity, or be opportunities for improvement.

Referenced from
ISO 9000:2015 | Whittington & Associates | ISO 9001 Checklist

How Non-Conformance Happens?

A non-conformance happens when a product, a process, a machine, an employee, a supplier or an infrastructure has not performed according to your planned quality management system and fails to abide by the standard requirements.

Before the issue reaches the audit stage, coworkers or supervisors should identify non-conformance.

If an auditor finds a nonconformity to the standards, it is the audited organization's responsibility to correct the problem as soon as possible before it impairs the company's overall business objective.

Non-Conformance Report (NCR)

These finding will be recorded during an audit, an on-site inspection to the audited organization. The conclusion will later be written in a non-conformity report (NCR).

Minor Non-Conformance

Refers to events or activities that are not included in the ISO 9001 requirements but do not have a negative impact on the overall operation or quality control of the company.

Example: Fail to update training record, missing document traceability or missed equipment calibration date.

Major Non-Conformance

Refers to failure to comply or absence of procedures and actions to business objectives and ISO standard. Business operation is disrupted. These errors can lead to a loss of productivity and client satisfaction.

Example: Unauthorized documents, lack of management review and leadership involvement or no internal audit conducted.

Address Non-Conformance

With reference to ISO 9001, the international standard for quality, Clause 10.2. It requires the organization to take these several actions, as applicable, to address the nonconformities encountered.

React to the nonconformity by taking action or dealing with the consequences
Evaluate if there is any need to eliminate the cause of nonconformity
Implement action needed as per manual, policy or other documented information
Review effectiveness of any corrective action taken
Conduct risk assessment, update risk and opportunities determined from planning
Make changes to quality management system

Documented Information As Evidence

ISO 9001 also requires documented information to be retained as evidence. The documented information which includes:

the nature of nonconformities and any subsequent actions taken
the results of any corrective action

Corrective Action Process

This infographic can help you understand how to resolve or close a Non-Conformance when you are raised with one by the auditor.

Step 1:
Auditor/Internal Auditor will raise Non-Conformance (NC) when the organization fails to comply or provide supporting documented information as proof of the practice. The NCs will be prepared in a Non-Conformance Report.

Step 2:
The audited organization should hold a management review to identify the root cause. Corrective actions are to be provided to auditor to address the consequences and NC. The corrective action has to include the target, person or department responsible with KPI to measure the outcome.

Step 3:
Organization implements the corrective action based on the approved corrective action by Auditor.

Step 4:
Organization conducts internal audit to compare the outcome of the implemented corrective action. Effectiveness is evaluated. If desired outcome is not achieved, corrective action will be redone with changes.If desired outcome is achieved, continual improvement has been made.

Step 5:
Auditor verifies the effectiveness of the implementation and approves for ISO certification.