A professional with two team members, a fifteen-person metal fabrication shop and a hundred-employee company usually choose the second: they fix it, call the supplier, and no record is left.
\nA nonconformity is the failure to meet a requirement — a part, a document or a delivery time that does not match what was agreed [1][6].
\nIn Italy there were 101,426 active ISO 9001 certificates at the end of 2024 [3], while companies with at least 3 employees number more than a million [4]: the vast majority work without a certified system.
\n\n\nA nonconformity that is logged but never decided on is just an archive: the minimum procedure is not the form, it is the decision — with a name and a date — whether to correct the effect or remove the cause.
\n
This article describes the five-step procedure, walks through a completed report line by line and explains when a nonconformity deserves a corrective action.
\nRemaking the wrong part or writing down that it was remade: which of the two prevents it from happening again?
\nThe second, but only if the written line is followed by a decision: the quality vocabulary distinguishes correction — remaking the part — from corrective action, which acts on the cause that made the part come out that way [1].
\nWithout a procedure, a nonconformity lives through three gestures and ends there: you fix it, you tell the right person verbally, and you close it with \"we'll be more careful.\"
\nThe term is not quality-system jargon: in ordinary usage, a \"nonconformity\" is a lack of correspondence to a rule, that is, a deviation from what was established [6].
\nThis section sets the operational definition, separates a nonconformity from a defect, a complaint and an error, and distinguishes the two actions that \"we fixed it\" lumps together.
\nThe missing record has a recognizable shape: the reworked part does not appear anywhere and the delay is not counted.
\nA nonconformity is the non-fulfillment of a requirement [1], and the requirement is what was agreed — a dimension, a date, a document — not what is usually done.
\nA defect is a nonconformity related to an intended or specified use [1], while nonconformity also covers things you cannot touch: an incomplete document, a late delivery, a missing record.
\nA complaint is the external expression of dissatisfaction; a nonconformity is the internal finding of a deviation: most nonconformities never reach a dissatisfied customer.
\nAn error attributes the event to a person, a nonconformity to an unmet requirement: that is the difference that makes the log possible to fill in.
\nThe scope here is product, service and process nonconformities: workplace safety and hygiene are left out.
\nWriting down that the part was remade prevents nothing on its own: it opens the line on which, at the second remade part, someone can decide to act on the cause.
\nA company that records nonconformities and one that does not may have the same number of problems at the end of the year: what really changes between the two?
\nOne knows which problems recurred, and the other remembers them from memory — the memory of whoever was there that day.
\n\n\nThe value of the procedure is not in the completed line but in the decision that follows it: correct the effect or remove the cause, with an owner and a date.
\n
The five steps are not an editorial invention: they are a plain-language transcription of what the quality standard requires of certified organizations [2], and they apply in exactly the same way to those that are not.
\nThis section puts them in a table with the question each one asks, who carries it out, what it leaves in writing and how much time it really takes.
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n| Step | Question it asks | Who does it | What stays in writing | Time |
|---|---|---|---|---|
| 1. Detect | Does it match what was agreed? | Whoever notices it | An open line in the log | 2 minutes |
| 2. Record | What happened, where, when, how much? | Whoever detects it | Date, origin (internal, supplier, customer), expected and actual requirement, extent | 5 minutes |
| 3. Disposition | What do we do with the part, the document, the order? | Department or office manager | Scrap, rework, acceptance under concession, return | Immediately |
| 4. Decide | Correction or removal of the cause? | Whoever has the authority to commit time and money | Yes or no, justified in one line | 5 minutes |
| 5. Verify | After some time, has it come back? | Whoever opened the line | Indicator, verification date, outcome | 10 minutes, once |
scroll the table →
\nThe five steps cost little more than twenty minutes, and in most cases the line stops at the third: the real objection is about time, not method.
\nThe medium matters less than it seems: in 2025, 56.0% of Italian companies with at least 10 employees used at least one business management software; integrated ERP software stops at 48.8% among small and medium-sized companies, compared with 85.9% of large ones [5].
\nMore than half of Italian companies with fewer than 250 employees work without an integrated ERP, and the five steps hold up on a shared spreadsheet or a department notebook.
\nA survey of 112 already-certified Brazilian manufacturing companies points in the same direction: perceived effectiveness is significantly higher where traditional quality tools, indicators and information support are used more intensively [7].
\nThe active certificates cited at the beginning tell the rest: without a certified system, the procedure does not change.
\nWritten down, it is a standard operating procedure like any other, and step 1 lives inside the checks already in place.
\nThe document that holds them together, the \"Nonconformity and corrective action log,\" has only one form: one line per event, one column for each thing that stays in writing.
\nAt the end of the year, the difference between the two companies is not the number of problems, but the number of lines that can be compared with one another.
\nA ten-minute phone call to the supplier or ten lines filled in in ten minutes: which of the two will you find again in six months, when the batch arrives out of tolerance once more?
\nThe ten lines, and not because they are more precise: because the phone call does not leave a number to compare with the one from last time.
\nThe case that follows is hypothetical and reflects a common situation: a fifteen-employee contract machining shop, family-controlled like 81.2% of Italian manufacturing companies [4], that has been receiving semi-finished parts from the same supplier for years.
\nThe symptom is measurable — in a batch of two hundred parts, twenty-two out of tolerance, discovered during machining rather than at incoming inspection — and the report shows the ten fields one by one, with what to write in each.
\nThe interesting part comes at the end: the nonconformity belongs to the supplier, but the completed report brings out a second one, which belongs to the company.
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n| Field | What it contains | In the batch case |
|---|---|---|
| 1. Number and date | Sequential number for the year, day of detection | NC 2026-014, March 12 |
| 2. Detected by / where | Name and workstation, not the generic role | Shop supervisor, during machining on the lathe |
| 3. Origin | Internal, supplier, customer | Supplier |
| 4. Description | Expected and actual requirement, with measurements | Dimension 24.0 ±0.05 on the drawing, measured up to 24.18 |
| 5. Extent | How many parts, how much time, how much value | 22 parts out of 200, two machine hours already committed |
| 6. Immediate disposition | Scrap, rework, acceptance under concession, return | 22 parts returned, machining continued on the 178 conforming ones |
| 7. Is a corrective action needed? | A yes or a no, justified in one line | Yes: third time in twelve months |
| 8. Cause | One sentence, with a reference to who determined it | The supplier does not check dimensions before shipping; incoming inspection is required by the procedure but is not performed on long-standing suppliers |
| 9. Corrective action | What, who, by when | Dimensional report with every delivery (business owner, March 31); sample incoming inspection on long-standing suppliers too (shop supervisor, from the next delivery) |
| 10. Effectiveness check | Indicator, date, outcome | Out-of-tolerance parts in the next three deliveries, check on June 30 |
scroll the table →
\nThe report brings out two nonconformities, not one: the batch arrived out of tolerance, and that one belongs to the supplier; but it went into machining without being inspected, and that one belongs to the company's own process.
\nStopping at the return closes only half the case: field 9 contains two actions, and only one of them looks outside the company.
\nWhere that inspection was never put in writing, there is no second nonconformity, but a check to be introduced.
\nHow to work back from field 8 to the cause that actually holds is the subject of root cause analysis, which receives the case already documented.
\nThat is what the ten lines are for: by the fourth batch, the comparison is already written.
\nThe supplier who replaces the batch and the supplier who changes its own outgoing inspection: three months from now, which of the two is still sending out-of-spec parts?
\nThe question applies in exactly the same way internally, and it is the reason why many companies' logs have dozens of closed lines and no cause removed.
\nCorrection and corrective action have different objects: the first acts on the part, document or order that is wrong, the second on the cause that made it come out that way [1].
\nBetween the two there is a decision, and it is the only step in the procedure that cannot be delegated to a form.
\nThis section gives the three signals that make a nonconformity worth a corrective action, the three cases in which correction is enough and is the right choice, and the grid for deciding without calling a meeting.
\nThree signals say the line deserves a corrective action:
\nIn three cases correction is enough and is the right choice:
\n| If the log line says… | What you do | What stays in writing |
|---|---|---|
| First time, limited effect | Correction, line closed | The disposition |
| Second time on the same requirement | Correction and corrective action on an already visible cause | Owner and date |
| Serious effect even once: line stoppage, missed delivery, customer involved | Immediate containment, then cause analysis | Containment, cause, action |
scroll the table →
\nFor organizations with a certified system, this step is not optional: the quality standard requires reviewing the nonconformity, determining its causes and verifying the effectiveness of the action [2].
\nWhen the answer is \"the cause must be removed,\" the path starts elsewhere: in root cause analysis or, for half-hour cases, in the 5 whys technique.
\nCorrective action does not eliminate the problem: it acts on the cause identified, reduces the likelihood that it will recur and must be verified after some time.
\nThe supplier who replaces the batch will replace it next time too, and next time is already on the calendar.
\nWait for the next nonconformity or act now on a risk that has not yet materialized: which of the two choices is harder to justify in a company?
\nThe second, because there is no scrapped part to show — and that is exactly why the nonconformity log is the only place from which a preventive action can arise with an argument in hand.
\nThe three actions in the quality vocabulary differ in when they act, not in how strongly: correction deals with what is already out of requirement, corrective action with what took it out, and preventive action with a nonconformity that has not yet happened [1].
\nThe acronym CAPA covers the last two, and in practice it is used more often than people can spell it out.
\nThis section puts the three actions in a table, explains where to find material for a preventive action without making it up, and says why, in recent editions of the quality standard, preventive actions have been folded into risk assessment.
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n| Action | What it acts on | When it is opened | Example in the batch case |
|---|---|---|---|
| Correction | The nonconforming item | Immediately, at every finding | Return of the 22 parts |
| Corrective action | The cause of a nonconformity that has occurred | When it recurs or when it matters | Dimensional check required from the supplier |
| Preventive action | The cause of a possible nonconformity | When a risk is visible before the event | Incoming inspection extended to the other two long-standing suppliers |
scroll the table →
\nCAPA stands for Corrective and Preventive Action, that is, the pair of corrective action and preventive action.
\nThe material for a preventive action is in the log: three lines on different suppliers with the same disposition are not yet a nonconformity, but they are already an argument.
\nHere the procedure opens onto continuous improvement, where suggestions from the people doing the work are the cheapest form of prevention.
\nIn a recent manual, preventive actions no longer have a section of their own: in the edition in force at the date of publication, they have moved into risk assessment [2].
\nSeeing a problem before it shows up is called problem finding, and its source is the log.
\nJustifying the intervention remains difficult, but with three identical lines on the table, the request has numbers in it.
\nA log with forty lines and no closed actions, and one with eight lines all verified: which of the two describes a company that is learning something?
\nThe second, and the difference is not in the discipline of whoever fills it in: among 112 already-certified manufacturing companies, the barriers that weigh most on nonconformity management turn out to be cultural and leadership-related, not tool-related [7].
\nThe mistakes are not in the form but in the way the log is used, and they are the same in a hundred-employee company and in a three-person firm.
\nThis section lists six of them, from keeping the log for the auditor instead of the company to leaving the verification field empty, and for each one indicates the move that neutralizes it.
\nThe last one is the most costly, because it makes all the work done before it useless.
\nThe 112 companies behind that result are Brazilian and already certified: what transfers is the indication, not the measurement [7].
\nEight verified lines are worth more than forty open ones, because they are eight things the company has stopped redoing.
\nThe scope described here excludes workplace safety and health and hygiene nonconformities, which have their own obligations, forms and responsibilities.
\nThe academic survey [7] measures perceived effectiveness in already-certified Brazilian manufacturing companies: the result guides the reading, but it does not prove the Italian case or that of non-certified companies.
\nThe wording of the vocabulary and requirements [1][2] is paraphrased from paid standards: anyone who has to demonstrate conformity to a certification body should refer to the text of the standard, not to this article.
\nThe batch case is constructed for teaching purposes: the figures show how to fill in a report, they do not estimate a result, and in a real situation the cause and the disposition may be different.
\nYes, because the five steps do not depend on certification: detecting, recording, disposition, deciding and verifying apply in exactly the same way in a firm with two team members and in a hundred-employee company.
\nActive ISO 9001 certificates in Italy remain a fraction of the companies in operation [3][4], and most of those who manage nonconformities do so without a certified system.
\nNo: a corrective action is opened when the deviation recurs, when the cumulative cost is measurable or when the downstream risk would fall on the customer.
\nIn the other cases — an isolated event whose cause has already been removed, negligible extent on a non-critical requirement, frequency still unknown — correction is enough, and the line stays in the log for the next comparison.
\nWith the completed report, origin \"supplier\": a description of the expected and actual requirement with measurements, the extent, the immediate disposition — usually the return or acceptance under concession.
\nThe report becomes a written request with a date, and it closes with the check on the following deliveries: without that check, the supplier has replaced the batch and nothing has changed.
\nFor organizations with a certified system these are requirements, not choices of method: control the nonconforming output, review the nonconformity, determine its causes, decide on corrective action and verify its effectiveness, retaining documented information on what happened and what was done [2].
\nThe reference is to the edition of the standard in force at the date of publication, and the five steps described above are the same sequence in plain language, valid for non-certified organizations too.
\nYes: the five steps do not require dedicated software, and among Italian companies with fewer than 250 employees, less than half use an integrated ERP [5].
\nThe columns are those of the report — date, origin, description, extent, disposition, decision, cause, action, verification — and what matters is that the sheet is kept in one place and readable by whoever decides, not the medium it is written on.
\nThe minimum procedure fits into five steps and a little over twenty minutes per nonconformity: detect the deviation, record it with date, origin and extent, deal with the nonconforming item, decide whether a corrective action is needed, and verify after some time that it has not come back.
\nThe step that carries the weight is the fourth, and it has three triggers: recurrence, measurable cumulative cost, and risk that would fall on the customer.
\nWhen none of the three is present, correction is enough and the line stays in the log for the next comparison.
\nWhen at least one is present, the action comes with an owner, a date and an indicator to check again.
\nThe log is for whoever decides, not whoever audits: that is the only condition that holds everything else together.
\nManaging nonconformities is not about filing errors: it is about deciding for each one whether correcting the effect is enough or the cause must be removed, and verifying it after some time.
\nThe out-of-tolerance batch case applies to a firm with two team members just as it does to a hundred-employee company: the objects on the table change, the five steps do not.
\nWhen the answer at step 4 is \"the cause must be removed,\" the path from symptom to cause is described here: https://blog.prodability.com/analisi-cause-radice/
\nWhen there is more than one problem to close and you need to choose the method, the overview is in the guide to business problem solving: https://blog.prodability.com/problem-solving-aziendale/
\nWhen the nonconformity comes from a customer and calls for a formal response, the full sequence — containment, root cause, verified corrective action — is that of the 8D report.
\nA company that keeps eight verified lines instead of forty open ones has, after a year, a written list of what it has stopped redoing.
\nPhone calls to the supplier get shorter, because instead of an impression they contain a number and a date.
\n\n[1] UNI, \"UNI EN ISO 9000:2026 — Sistemi di gestione per la qualità — Fondamenti e vocabolario\", Ente Italiano di Normazione, in force since May 27, 2026 (replaces UNI EN ISO 9000:2015). Available at: https://store.uni.com/uni-en-iso-9000-2026
\n[2] UNI, \"UNI EN ISO 9001:2015+A1:2024 — Sistemi di gestione per la qualità — Requisiti\", Ente Italiano di Normazione, in force since October 16, 2024. Available at: https://store.uni.com/uni-en-iso-9001-2015-a1-2024
\n[3] Accredia, \"ISO Survey 2024: le imprese accelerano su sostenibilità e digitalizzazione\", AccrediaHub, October 30, 2025 (ISO data as of December 31, 2024). Available at: https://www.accredia.it/comunicazione/accrediahub/iso-survey-2024-le-imprese-accelerano-su-sostenibilita-e-digitalizzazione/
\n[4] ISTAT, \"Censimento permanente delle imprese 2023: primi risultati\", press release, November 14, 2023 (reference year 2022; about 280,000 responding companies, representative of 1,021,618 companies with at least 3 employees). Available at: https://www.istat.it/comunicato-stampa/censimento-permanente-delle-imprese-2023-primi-risultati/ — PDF: https://www.istat.it/it/files/2023/11/REPORTCensimprese.pdf
\n[5] ISTAT, \"Imprese e ICT — Anno 2025\", press release, December 15, 2025 (companies with at least 10 employees). Available at: https://www.istat.it/comunicato-stampa/imprese-e-ict-anno-2025/ — PDF: https://www.istat.it/wp-content/uploads/2025/12/Statreport_ICT2025.pdf
\n[6] Istituto della Enciclopedia Italiana, \"Conformità\", Vocabolario on line Treccani. Available at: https://www.treccani.it/vocabolario/conformita/
\n[7] de Toledo, J. C., Silva, J. I., Moreno, M. G. M., Lizarelli, F. L., Poltronieri, C. F. and González, M. O. A., \"Industry 4.0 technologies applied to nonconformity management: an empirical study of Brazilian manufacturing firms with certified quality systems\", International Journal of Quality & Reliability Management, vol. 43, no. 3, 2026, pp. 816-847. DOI 10.1108/IJQRM-08-2025-0293 (online since December 2, 2025). Available at: https://www.emerald.com/ijqrm/article-abstract/43/3/816/1320509/Industry-4-0-technologies-applied-to-nonconformity
","headings":[{"level":2,"text":"From \"we fixed it\" to the log: what a nonconformity is and what sets it apart","id":"from-we-fixed-it-to-the-log-what-a-nonconformity-is-and-what-sets-it-apart"},{"level":2,"text":"The minimum five-step procedure, even without a certified system","id":"the-minimum-five-step-procedure-even-without-a-certified-system"},{"level":2,"text":"A nonconformity example: the completed report on an out-of-tolerance batch","id":"a-nonconformity-example-the-completed-report-on-an-out-of-tolerance-batch"},{"level":2,"text":"From nonconformity to corrective action: the step most often skipped","id":"from-nonconformity-to-corrective-action-the-step-most-often-skipped"},{"level":2,"text":"Correct or prevent: the difference between corrective action and preventive action","id":"correct-or-prevent-the-difference-between-corrective-action-and-preventive-action"},{"level":2,"text":"The mistakes that empty the nonconformity log, and how to avoid them","id":"the-mistakes-that-empty-the-nonconformity-log-and-how-to-avoid-them"},{"level":2,"text":"Limitations and conditions of applicability","id":"limitations-and-conditions-of-applicability"},{"level":2,"text":"FAQ","id":"faq"},{"level":3,"text":"Do you need a nonconformity procedure even if the company is not certified?","id":"do-you-need-a-nonconformity-procedure-even-if-the-company-is-not-certified"},{"level":3,"text":"Does every nonconformity require a corrective action?","id":"does-every-nonconformity-require-a-corrective-action"},{"level":3,"text":"How do you report a nonconformity to a supplier?","id":"how-do-you-report-a-nonconformity-to-a-supplier"},{"level":3,"text":"What does ISO 9001 require for nonconformities?","id":"what-does-iso-9001-require-for-nonconformities"},{"level":3,"text":"Can the nonconformity log be kept on a spreadsheet?","id":"can-the-nonconformity-log-be-kept-on-a-spreadsheet"},{"level":2,"text":"Operational summary","id":"operational-summary"},{"level":2,"text":"Conclusion","id":"conclusion"},{"level":2,"text":"Sources and references","id":"sources-and-references"}],"tldr":"When a batch arrives out of spec or a delivery does not match the order, should you stop and write down what happened, or fix it the same day and move on?","tldrItems":null}