How to create a non-conformance process
How to design a non-conformance process: contain and quarantine first, classify by impact, decide disposition through a defined authority, and route only the ones that warrant it into CAPA.
A worked example, stage by stage
Stop, then quarantine
Detection, stop work, quarantine affected material, then raise the record. Three actions before any question is asked about why — because the scope of a non-conformance grows for exactly as long as the affected work keeps moving.
Classify to size the response
Facts confirmed, impact on product assessed, then a classification decision routing minor, major and critical differently — with critical escalating immediately. Uniform handling either over-investigates the trivial or under-investigates the serious.
Investigate proportionately
Investigator assigned with a due date, evidence gathered, operators interviewed, root cause determined — while a critical deviation escalates to the qualified person in parallel. Interviewing the operators is where most causes are actually found.
Disposition, with authority
An impact decision, then a disposition choice between release with documented justification, reject and destroy, or rework under an approved protocol. The justification requirement on release is what makes use-as-is a decision rather than a shortcut.
The CAPA gate
An explicit decision on whether a CAPA is required, then a QA closure approval that can send it back for more evidence. Routing every non-conformance into CAPA guarantees a backlog; routing none guarantees repetition.
How it works
Define what counts as a non-conformance
Write it down: product outside specification, work not performed per procedure, a service outside its agreed level. Ambiguity here produces under-reporting, and under-reporting is much harder to detect than a noisy system. Make the reporting route obvious and low-friction for whoever finds it.
Make containment the first step
Stop work, quarantine the material, identify what else may be affected — before any analysis. Give it a named owner and a time expectation. Every hour of continued processing widens the batch scope and multiplies the eventual disposition cost.
Set classification criteria
Minor, major and critical need definitions in terms of product impact, safety, regulatory exposure and recurrence. Put them on the decision node. Classification drives the depth of investigation and the escalation route, so a vague scale produces inconsistent handling of identical issues.
Name the disposition authority
Decide who may authorise rework, concession, reject or scrap, and at what level. Quality should hold the veto on release. The person who found the problem should not be the person deciding the cheapest way past it.
Require justification for use-as-is
Release under concession is legitimate and the most abused disposition. Require a written rationale covering fitness for purpose, customer or regulatory implications, and who approved it — and keep it with the batch record, not in an email thread.
Gate the CAPA decision and trend the records
Make "does this need a CAPA?" an explicit decision with criteria, usually recurrence, severity or systemic cause. Then trend the register: three minor non-conformances with the same cause are one major one that nobody has classified correctly yet.
Frequently asked questions
What is the difference between a non-conformance and a deviation?
In most quality systems a non-conformance is output that fails to meet a requirement, while a deviation is a departure from an approved procedure — and GxP environments often use deviation for both. The control is the same either way: contain, record, classify, investigate proportionately, decide disposition through a defined authority, and gate the CAPA. Use whichever term your standard and your auditors use, and define it in your procedure so the reporting threshold is unambiguous.
What are the disposition options for non-conforming product?
Rework to specification, repair, use as-is under a documented concession, regrade for a different use, return to supplier, or scrap. ISO 9001 clause 8.7 requires you to control nonconforming output and retain documented information on the nonconformity, the actions taken, any concession obtained and who authorised it. Use-as-is is the option that most needs its justification recorded, because it is the one that reaches the customer.
Does every non-conformance need a CAPA?
No, and requiring it is a reliable way to make the CAPA system unusable. Gate it on criteria — severity, recurrence, evidence of a systemic cause, regulatory exposure — and handle the rest as correction with trending. The trending is the important half: three minor non-conformances sharing a cause are a major one that has not been recognised yet, and the register is the only place that pattern is visible.
Who should approve non-conformance disposition?
Someone independent of the work that produced it, with quality holding the veto on release. Depending on the sector and the classification that may be a quality manager, a material review board, or a qualified person for regulated product. What matters structurally is that the authority is defined in advance by classification, so the decision does not depend on who happens to be available when the batch is sitting in quarantine.