ISO 9001 Nonconforming Product: Control and Resolution
Every organisation that produces products or services will encounter nonconforming output at some point. The question is not whether nonconformities will occur, but how you control and resolve them when they do. ISO 9001 clause 8.7 provides the framework for managing nonconforming products, services, and outputs throughout the production and delivery process. This is not a punitive measure – it is an essential control that protects your customers and drives continual improvement.
Nonconforming product control is one of the most frequently audited areas of a quality management system (QMS). Auditors look for clear identification, segregation, documentation, and disposition of nonconforming outputs. A weak nonconformity process can lead to customer complaints, product recalls, and certification nonconformities. This guide covers everything you need to build a robust nonconforming product control system under ISO 9001:2015.
What Does ISO 9001 Clause 8.7 Require?
Clause 8.7, titled ‘Control of nonconforming outputs,’ requires your organisation to ensure that outputs that do not conform to requirements are identified and controlled to prevent unintended use or delivery. The clause applies to all outputs throughout the product or service lifecycle, including those detected after delivery.
The standard requires you to take appropriate action based on the nature of the nonconformity and its impact on customers. Clause 8.7 also mandates that you document the nonconformity, the action taken, any concessions obtained, and the person who authorised the action.
| Clause 8.7 Requirement | What It Means | Implementation Example |
|---|---|---|
| Identify and control nonconforming outputs | Prevent unintended use or delivery | Use hold areas, quarantine tags, or system flags |
| Take appropriate action based on the nonconformity | Match the response to the severity of the issue | Rework minor defects; scrap items with critical failures |
| Document the nonconformity and subsequent action | Maintain records as evidence of control | Log in nonconformity register with root cause and disposition |
| Obtain authorisation for concession or deviation | Ensure customer or internal approval for use-as-is | Customer signs concession form for out-of-spec part |
| Address nonconformities detected after delivery | Handle warranty returns and field failures | Initiate corrective action and recall process if needed |
Identification and Segregation of Nonconforming Product
The first line of defence is proper identification and segregation. When a nonconformity is discovered, the affected product must be clearly marked and physically or electronically separated from conforming product to prevent accidental use or shipment.
Identification methods include:
- Physical quarantine areas with clear signage and restricted access
- Colour-coded tags or labels (e.g. red for reject, yellow for rework)
- Electronic status flags in inventory or production systems
- Dedicated nonconforming material bins at workstations
The segregation method you choose depends on the nature of your product and processes. For physical products, a locked quarantine cage is ideal. For service outputs, an electronic workflow that prevents progression to the next stage is appropriate. For software, automated build checks that block deployment are effective.
| Product Type | Identification Method | Segregation Method |
|---|---|---|
| Physical goods | Red reject tags, barcode scans | Locked quarantine area |
| Services | Service report flagged as nonconforming | Workflow halted until resolution |
| Software | Test failure report, bug tracker ticket | Blocked from release pipeline |
| Documentation | Document marked as ‘superseded’ or ‘invalid’ | Removed from active repository |
Nonconformity Documentation
Every nonconformity must be documented. ISO 9001 requires retained documented information as evidence of the nature of the nonconformities, the actions taken, and any concessions granted. Your nonconformity record should capture:
- Date and time the nonconformity was identified
- Product or service identifier and batch or lot number
- Description of the nonconformity (what is wrong, against what requirement)
- Immediate action taken (segregation, rework, scrap)
- Root cause analysis (if required)
- Disposition decision and authorising person
- Customer notification details (if applicable)
- Link to corrective action (clause 10.2)
Many organisations use a nonconformity register (paper or electronic) to track all occurrences. An electronic system with workflow capabilities is strongly recommended because it simplifies trend analysis, reporting, and audit trails.
Disposition Options for Nonconforming Product
Once you have identified and documented a nonconformity, you must determine its disposition. ISO 9001 recognises four primary disposition options, and your choice depends on the nature of the nonconformity, contractual requirements, and customer expectations.
1. Rework
Rework involves taking action to make the nonconforming product conform to the original requirements. This is the most common disposition. Reworked product must be re-inspected to verify that it now conforms. Document the rework method, inspection results, and re-inspection records.
2. Scrap
When rework is not technically or economically feasible, the product is scrapped. Scrap disposal must prevent unintended reuse or recycling back into production. Maintain records of scrapped quantities and disposal method.
3. Concession (Use-as-Is)
A concession allows the nonconforming product to be used as-is. For customer-specific products, you must obtain customer approval before shipping. For internal use, an authorised person within your organisation grants the concession. Concessions must be time-bound or quantity-limited where applicable.
4. Regrade
Regrading is the process of reclassifying the product for an alternative use where the nonconformity does not affect fitness for purpose. For example, a component intended for a high-tolerance application that fails that requirement may still be suitable for a lower-tolerance application.
| Disposition | When to Use | Documentation Required |
|---|---|---|
| Rework | Nonconformity can be corrected within specification | Rework instructions, re-inspection records |
| Scrap | Rework is impossible or uneconomical | Scrap ticket, disposal record |
| Concession | Nonconformity does not affect fitness for use; customer agrees | Concession form, customer approval (if applicable) |
| Regrade | Product can be used for alternative application | Regrade authorisation, revised specification |
Customer Notification of Nonconforming Product
When nonconforming product has been delivered to a customer, you must notify the customer and take appropriate action. ISO 9001 clause 8.7.1(e) specifically requires action when nonconformity is detected after delivery. The extent of the notification depends on the severity and potential impact.
- Issue a formal notification to the customer describing the nonconformity
- Agree on corrective action with the customer (return, replacement, repair, or compensation)
- Recall affected product if safety or regulatory requirements are involved
- Document all communications and agreements
- Initiate corrective action (clause 10.2) to prevent recurrence
Customer notification is not just a compliance requirement – it is a relationship management opportunity. Transparent communication about nonconformities builds trust, especially when you propose concrete corrective actions.
Corrective Actions and Nonconforming Product
Controlling the immediate nonconformity is only half the job. ISO 9001 clause 10.2 requires you to investigate the cause of the nonconformity and take corrective action to prevent recurrence. Not every nonconforming product triggers a full corrective action – the standard requires action ‘appropriate to the effects of the nonconformity encountered.’
- Low-severity, one-off nonconformities may require only containment and correction
- Recurring nonconformities must trigger root cause analysis and corrective action
- High-severity nonconformities always require corrective action regardless of frequency
- Review effectiveness of corrective actions after implementation
- Update risk assessments and process controls based on lessons learned
Records Required for Clause 8.7 Compliance
Auditors will request evidence that your nonconforming product control process is functioning. The following records must be maintained as documented information:
- Nonconformity register or log
- Individual nonconformity reports
- Rework and re-inspection records
- Concession forms with authorisation signatures
- Scrap disposal records
- Customer notification correspondence
- Corrective action records linked to nonconformities
- Training records for staff involved in identification and disposition
Common Nonconformities in Nonconforming Product Control
During ISO 9001 audits, certification bodies frequently identify findings related to nonconforming product control. The most common issues include:
- Lack of segregation between conforming and nonconforming product
- Incomplete nonconformity records (missing disposition, authorisation, or dates)
- No re-inspection after rework
- Concessions granted without proper authorisation
- Failure to notify customers about delivered nonconforming product
- No link between nonconformities and corrective actions
Frequently Asked Questions
What is the difference between a nonconformity and a corrective action?
A nonconformity is the detected failure to meet a requirement. A corrective action is the activity undertaken to eliminate the cause and prevent recurrence. Clause 8.7 addresses the immediate control of the nonconforming output; clause 10.2 addresses the corrective action.
Can we use a nonconforming product if the customer agrees?
Yes, this is called a concession (or waiver). You must obtain documented customer approval before shipping or using the product under concession. The concession must be authorised by an appropriate person within your organisation as well.
Do we need a separate procedure for nonconforming product?
ISO 9001 does not explicitly require a separate documented procedure, but you must maintain documented information to demonstrate that the process is functioning effectively. Most organisations choose to document their nonconforming product control process as a procedure or work instruction.
How long should we retain nonconformity records?
Retention periods should be defined in your documented information procedure. Common practice is to retain records for the product lifecycle plus a defined period (e.g. three to five years). Regulatory and contractual requirements may mandate longer retention periods.
Must we re-inspect reworked product?
Yes. Any reworked product must be re-inspected to verify conformance to the original requirements. Re-inspection records must be maintained as evidence. This is a common audit finding when organisations miss this step.
What if a nonconformity is discovered after the product has been delivered?
You must notify the affected customer and take appropriate action. The action may include replacement, repair, refund, or recall depending on the severity. You must also initiate corrective action under clause 10.2 to prevent recurrence and document all steps taken.
Build a Compliant Nonconforming Product System
Implementing an effective nonconforming product control system under ISO 9001 clause 8.7 is essential for protecting your customers, maintaining certification, and driving quality improvement. The key is to move beyond treating nonconformities as paperwork exercises and instead use them as data points for process improvement.
If you need help designing or improving your nonconforming product control process, contact Bitrixme today. Our ISO consultants have helped hundreds of organisations achieve and maintain ISO 9001 certification across the GCC region.
