1What an NCR is.
ISO 9000:2015 defines a nonconformity as the “non-fulfilment of a requirement”.¹ A nonconformance report is the record that controls one: it identifies the nonconforming item, contains it, evaluates it and records what is done with it. For a raw material or component, the same record may be called a nonconforming material report, or NCMR. FDA’s CDRH training lists nonconforming material reports among the internal data sources that feed a CAPA system.²
For medical devices, 21 CFR Part 820 has incorporated ISO 13485:2016 since 2 February 2026, including its requirements on nonconforming product in Clause 8.3.³⁴ In the final rule, FDA says nonconforming product found before or after distribution should be investigated “to the degree commensurate with the significance and risk of the nonconformity”. It adds: “At times an in-depth investigation will be necessary, while at other times a simple investigation, followed by trend analysis or other appropriate tools will be acceptable.”⁵
For medicines, the quality control unit approves or rejects components, containers, closures, in-process materials, packaging, labelling and drug products, and any failure of a batch or component to meet its specifications must be investigated.⁶⁷ FDA’s 2006 quality systems guidance says that when a product or process does not meet requirements, “it is essential to identify and/or segregate the product so that it is not distributed to the customer”.⁸
2What an NCR records.
| Part | What it records |
|---|---|
| Identification | The item, part or material, its lot or serial number, quantity, location and supplier |
| Requirement | The specification, drawing or acceptance criterion and its version |
| Finding | The observed result and its evidence, who found it, when, and at which stage: receipt, in process, final release or after distribution |
| Containment | The hold, segregation or labelling, and whether other lots or stock could be affected |
| Evaluation | The risk, whether an investigation is needed, and whether an external party such as a supplier must be told |
| Disposition | The decision, its justification and who authorised it |
| Execution | Evidence the disposition was carried out and, after rework, that the item was examined again |
| Link | The CAPA, supplier corrective action request or deviation it leads to, or the reason none is needed |
The evaluation and execution rows follow FDA’s descriptions. For devices, FDA says ISO 13485 Clauses 8.2.2, 8.3.1 and 8.5.2 cover determining the need to investigate nonconformities and “any need to notify an external party responsible for a nonconformity”.⁵ For drugs, FDA’s 2006 guidance says corrected product “should also be re-examined for conformance and assessed for the significance of the non-conformity”.⁸
3The disposition options.
ISO 9000:2015 defines the usual dispositions.¹
| Disposition | ISO 9000:2015 definition |
|---|---|
| Rework | Action on a nonconforming product “to make it conform to the requirements” |
| Repair | Action on a nonconforming product “to make it acceptable for the intended use”; it may not make it conform, so a concession can also be needed |
| Regrade | Changing the grade of a nonconforming product so it conforms to requirements different from the initial ones |
| Concession | Permission “to use or release” a product that does not conform to specified requirements, generally for a limited quantity or period and a specific use |
| Scrap | Action “to preclude its originally intended use”, for example recycling or destruction |
For devices, Part 820 defines rework as action so that nonconforming product “will fulfill the specified requirements in the medical device file (MDF) before it is released for distribution”.³ FDA says a concession under ISO 13485 Clause 8.3.2 is allowed only if “justification is provided, approval is obtained and applicable regulatory requirements are met”. It expects the justification to rest on scientific evidence, and says concessions “should be closely monitored and not become accepted practice”.⁵
For drugs, FDA’s 2006 guidance lists the remedial options: correct the non-conformity; with proper authorisation, let the product proceed with a justified conclusion on its impact; use it for another application where the deficiency does not affect quality; or reject it.⁸
4When an NCR becomes a CAPA.
An NCR deals with the item. A CAPA deals with the cause. FDA does not expect every nonconformity to become a CAPA: its CDRH course says “not every nonconformity” goes into the CAPA system, and asks manufacturers to decide in advance which data they watch and the threshold for opening a CAPA.² For devices, FDA says the degree of corrective or preventive action should be “appropriate to the magnitude of the problem and commensurate with the risks encountered”.⁵
These are the usual signs that an NCR needs a CAPA:
| Trigger | What the sources say |
|---|---|
| Significance | If the non-conformity is significant, based on its consequences for process control, process efficiency, product quality, safety, efficacy and availability, “it is important to evaluate how to prevent recurrence”.⁸ |
| Recurrence or trend | FDA’s example: when a moulding process with a normal 5 percent rejection rate rises to 10 percent, an investigation into the process must be performed.⁵ |
| Repeated concessions | Concessions should be closely monitored and not become accepted practice.⁵ |
| Supplier cause | Suppliers can be given supplier corrective action reports so recurring problems stop at the source; “As the manufacturer, you have the final responsibility over top of your suppliers.”² ICH Q10 asks companies to monitor the quality of purchased material and implement the improvements needed.⁹ |
| Released product | Released product that does not meet requirements can be recalled.⁸ For devices, advisory notices are handled under 21 CFR Part 806.³ |
On the drug side, ICH Q10 lists product rejections and non-conformances among the investigations whose outcomes the CAPA system acts on.⁹ Whatever the trigger, record the decision on the NCR. If no CAPA is opened, say why, so the reason can be checked when the next NCR for the same failure arrives.
5How it runs in Seal.
In Seal’s nonconformance blueprint, an NCMR shares records with inventory, batches, laboratory results and supplier history. An inventory hold can be configured to block issue of the material until disposition, and reviewers see the prior NCMRs for the same supplier, material and specification, with the concession rate over the period, before they decide. Each disposition is recorded as a plan with instructions, quantities and owners, and a use-as-is concession names the failed requirement, the population, the intended use and the technical rationale. Recurrence thresholds can require escalation, supplier action, specification review or a CAPA.
For devices, the medical device blueprint records concessions or nonconformances against the material and the manufacturing work they affect.
References
- 1ISO 9000:2015, Quality management systems: Fundamentals and vocabulary, Clause 3, entries 3.6.9 and 3.12.4 to 3.12.10, ISO Online Browsing Platform, edition marked withdrawn. https:/
/ www. iso. org/ obp/ ui/ en/ #iso:std:iso:9000:ed- 4:v1:en (read 6 November 2026) - 2Corrective and Preventive Actions, transcript, CDRH Learn, FDA, content current as of 4 January 2018. https:/
/ www. fda. gov/ training- and- continuing- education/ cdrh- learn/ corrective- and- preventive- actions- transcript (read 6 November 2026) - 321 CFR Part 820, Quality Management System Regulation, sections 820.3, 820.7 and 820.10, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- H/ part- 820 (read 6 November 2026) - 4Quality Management System Regulation (QMSR), FDA, update of 2 February 2026. https:/
/ www. fda. gov/ medical- devices/ postmarket- requirements- devices/ quality- management- system- regulation- qmsr (read 6 November 2026) - 5Medical Devices; Quality System Regulation Amendments, final rule, FDA, 89 FR 7496, 2 February 2024, responses to comments 12 and 20. https:/
/ www. govinfo. gov/ content/ pkg/ FR- 2024- 02- 02/ html/ 2024- 01709. htm (read 6 November 2026) - 621 CFR 211.22, Responsibilities of quality control unit, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 211. 22 (read 6 November 2026) - 721 CFR 211.192, Production record review, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 211. 192 (read 6 November 2026) - 8Guidance for Industry: Quality Systems Approach to Pharmaceutical CGMP Regulations, FDA, September 2006, section IV.C.4. https:/
/ www. fda. gov/ media/ 71023/ download (read 6 November 2026) - 9ICH Q10, Pharmaceutical Quality System, ICH, Step 4 version of 4 June 2008, sections 2.7 and 3.2.2. https:/
/ database. ich. org/ sites/ default/ files/ Q10%20Guideline. pdf (read 6 November 2026)
AQuestions and answers
What is the difference between an NCR and a CAPA?
An NCR controls a nonconforming item: it identifies, contains, evaluates and dispositions it. A CAPA investigates and removes the cause, so the problem does not recur or does not occur elsewhere. One CAPA can cover several NCRs that share a cause.
Who can approve a use-as-is decision?
Whoever your procedure authorises, within the rules. For devices, ISO 13485 allows a concession only with justification, approval and the applicable regulatory requirements met, and FDA expects the justification to rest on scientific evidence. For drugs, the quality control unit has the authority to approve or reject materials and products.
Does every NCR need a root cause investigation?
No. Decide whether to investigate from the significance and risk of the nonconformity. Some need an in-depth investigation; for others, a simple investigation followed by trend analysis is enough.
Do pharmaceutical manufacturers use NCRs?
Drug CGMP rules speak of rejected materials, failed specifications and discrepancies rather than NCRs, but the record does the same work: identify and segregate the material, investigate the failure, and let the quality unit approve or reject it. EU GMP’s product quality review covers significant deviations and non-conformances.
Where can I read ISO 13485 for free?
FDA says ISO 13485:2016 and Clause 3 of ISO 9000:2015 can be read free, read-only, through the ANSI Incorporated by Reference portal. ISO 9000’s terms and definitions can also be read on ISO’s Online Browsing Platform.