A nonconformity is the non-fulfilment of a requirement — a stated, implied, or obligatory need that was not met. That is the exact definition given in ISO 9000:2015, clause 3.6.9, the vocabulary standard that underlies ISO 9001, ISO 17025, ISO 13485, and every other management-system standard in the ISO 9000 family. A requirement can come from a customer, a regulator, the organization’s own documented procedure, or the management-system standard itself — if what actually happened does not match what was supposed to happen, that gap is a nonconformity, whether or not it produced a bad product.
This page covers what a nonconformity is, how it differs from a defect or a deviation, how auditors decide whether one is major or minor, what an NCR/NCAR record typically contains, and where the concept shows up across ISO 9001, ISO/IEC 17025, and ISO 13485.
The ISO 9000:2015 definition, in plain terms
ISO 9000:2015 defines two related terms in clause 3.6:
- Requirement (3.6.4): a need or expectation that is stated, generally implied, or obligatory.
- Nonconformity (3.6.9): non-fulfilment of a requirement.
Nothing in that definition says anything about a physical product. A missed calibration interval, a training record that was never signed, a procedure step an auditor cannot find evidence was followed, an uncontrolled document still in circulation after revision — all of these are nonconformities, because in each case a stated requirement (a calibration schedule, a training requirement, a documented procedure, a document-control rule) was not fulfilled. That is the single biggest source of confusion the plain-English phrase “non-conformity” or “lack of conformity” doesn’t convey: in a quality-management context it is a defined, auditable gap against a specific requirement, not a general judgment that something is unsatisfactory.
Nonconformity vs. defect vs. deviation
The three terms get used loosely outside formal quality systems, but ISO 9000:2015 and common industry practice separate them:
| Term | What it means | Example |
|---|---|---|
| Nonconformity | Non-fulfilment of any requirement — product, process, or system. | A batch record is missing a required countersignature. |
| Defect | ISO 9000:2015 3.6.10 defines a defect as non-fulfilment of a requirement related to an intended or specified use. Every defect is a nonconformity, but not every nonconformity is a defect (a missing signature doesn’t necessarily affect fitness for use). | A finished part’s dimension is outside the tolerance that determines whether it will actually fit and function. |
| Deviation | Not an ISO 9000 term. Common in GMP/pharma usage for a planned, pre-authorized departure from a specification or procedure — distinguished from a nonconformity, which is unplanned. | A batch is manufactured with an approved, documented temporary change to a process parameter. |
How auditors decide major vs. minor
Neither ISO 9001:2015 nor ISO/IEC 17025:2017 defines “major” and “minor” nonconformity as formal terms with fixed thresholds — the classification is an auditing convention, applied by the certification or accreditation body’s assessor at the time of the audit, and the exact criteria vary by scheme owner. The general principle used across most certification and laboratory-accreditation bodies (reflected in ISO 19011 auditing guidance and the ISO 9001 Auditing Practices Group’s own guidance on nonconformity) is:
| Major nonconformity | Minor nonconformity | |
|---|---|---|
| Scope of the failure | A systemic breakdown — a whole clause or process is not implemented, or a required element of the management system is completely absent. | An isolated lapse in an otherwise-functioning process. |
| Effect on outputs | Puts the validity of results, product conformity, or the effectiveness of the whole management system at real risk. | Unlikely on its own to affect the validity of results or product conformity. |
| Accumulation rule | A cluster of related minor nonconformities against the same clause is frequently escalated and treated as a single major. | Stands alone unless it repeats or clusters with related findings. |
| Typical consequence | Can block certification/accreditation, or trigger suspension, until closed and verified — often with a required on-site or documented follow-up before the certificate/scope is confirmed. | Requires a corrective action plan and evidence of closure, usually verified at the next surveillance visit rather than immediately. |
Because the classification is assessor and scheme-owner judgment rather than a numeric ISO threshold, the same underlying gap can be scored differently by two accreditation bodies, or differently on two audits of the same lab, depending on evidence of how contained the failure actually was. If your accreditation or certification depends on the outcome, the scheme owner’s own audit-classification guidance (ANAB, A2LA, UKAS, or your national accreditation body for ISO/IEC 17025; your certification body for ISO 9001) is the controlling document, not this page.
The NCR / NCAR record
Neither ISO 9001 nor ISO/IEC 17025 mandates a specific form, but in practice almost every quality management system logs each nonconformity on a standardized record, commonly called an NCR (Non-Conformance Report / Non-Conformity Report) or, when the same record also tracks the resulting corrective action through to closure, an NCAR (Non-Conformance/Corrective Action Report). A typical record captures:
- Identification — a unique tracking number, date raised, who raised it, and the source (internal audit, external assessment, customer complaint, process monitoring, proficiency-testing result).
- Description — the specific requirement that was not fulfilled and the objective evidence showing it wasn’t (which clause, procedure, specification, or record).
- Classification — major or minor, and which clause of the standard it maps to.
- Containment / correction — the immediate action taken to fix the specific instance (e.g., re-issue the batch record, quarantine the affected product or results, re-train the individual).
- Root cause analysis — why the failure actually occurred, not just what happened.
- Corrective action — the systemic change intended to prevent recurrence.
- Effectiveness verification — evidence, checked after enough time has passed, that the corrective action actually worked.
- Sign-off and closure date.
The sequence from item 4 through 7 — correction, root cause, corrective action, effectiveness check — is the CAPA (Corrective and Preventive Action) process. A nonconformity is the finding that opens an NCR; CAPA is what the organization does about it. See CASRAI’s CAPA definition for the full process and its standards basis (ISO 9001:2015 clause 10.2, ISO 13485:2016 clauses 8.5.2–8.5.3, ICH Q10).
Where nonconformity appears across the standards
| Standard | Relevant clause(s) | What it covers |
|---|---|---|
| ISO 9000:2015 | 3.6.9 (nonconformity), 3.6.10 (defect), 3.6.4 (requirement) | Defines the vocabulary used by every other standard in the family. |
| ISO 9001:2015 | 8.7 (Control of nonconforming outputs); 10.2 (Nonconformity and corrective action) | 8.7 covers identifying and controlling nonconforming outputs before they reach the customer; 10.2 covers reacting to a nonconformity, evaluating the need for corrective action, and updating the QMS. |
| ISO/IEC 17025:2017 | 7.10 (Nonconforming work) | Requires a laboratory to have a procedure for handling work that does not conform to its own procedures or to the customer’s agreed requirements — including evaluating whether previously issued results need to be recalled or flagged. |
| ISO 13485:2016 | 8.3 (Control of nonconforming product); 8.5.2–8.5.3 (corrective/preventive action) | Medical device manufacturers; as of February 2, 2026, FDA’s Quality Management System Regulation (QMSR) incorporates ISO 13485:2016 by reference, so this clause now largely governs U.S. device-sector nonconformity handling as well. |
For the accreditation standard most relevant to research and testing laboratories, see CASRAI’s guide to ISO/IEC 17025. For device-sector quality systems, see ISO 13485. Nonconformities identified through interlaboratory comparisons are a distinct trigger discussed in CASRAI’s guide to proficiency testing and external quality assessment, and the broader regulatory landscape a nonconformity can sit inside is covered in GxP compliance: what GLP, GCP, GMP, and GDP actually require.
Frequently asked questions
What is the difference between a major and minor nonconformity under ISO 9001?
Neither ISO 9001:2015 nor ISO 9000:2015 sets a fixed numeric or clause-based rule. In practice, auditors treat a major nonconformity as a systemic failure — a whole requirement or process area not implemented, or a gap that puts the validity of results or the effectiveness of the management system at real risk. A minor nonconformity is an isolated lapse in an otherwise-functioning process that is unlikely, on its own, to affect outputs. Several related minors against the same clause are commonly escalated to a major. The certification or accreditation body’s own audit guidance is the controlling reference for any specific audit.
What does NCAR mean in ISO auditing?
NCAR stands for Non-Conformance/Corrective Action Report (sometimes written Non-Conformity and Corrective Action Report). It is the same underlying record as an NCR, extended to also track the corrective action taken in response through to verified closure, rather than logging the finding and the corrective action on two separate documents.
Is “non-conformity” the same as “nonconformance”?
Yes, in ordinary usage the two are treated as interchangeable. ISO 9000:2015’s defined term is “nonconformity”; “nonconformance” is a widely used synonym in industry, especially in North American usage and on NCR/NCAR forms. Neither is materially different in meaning from the general English phrase “lack of conformity,” but only the ISO-defined term carries the specific, auditable meaning (non-fulfilment of a stated requirement) that this page covers.
Does every nonconformity require a CAPA?
ISO 9001:2015 clause 10.2 requires an organization to react to a nonconformity and evaluate the need for action to eliminate its cause(s) — it does not require a full corrective action for every single occurrence regardless of significance. In practice, most documented quality systems log every nonconformity, but reserve full root-cause corrective action for those judged significant enough to justify the effort, closing lower-risk isolated instances with correction alone (fixing the specific instance) after a documented risk-based decision.
