Non-Conformance Report (NCR) is a controlled quality record that documents a product, component, material, or process that fails to meet a specified requirement. It captures what deviated, where it was found, how the affected material was segregated, and the approved disposition. In medical device manufacturing, the NCR is the entry point into control of nonconforming product.
What is a Non-Conformance Report (NCR)?
A Non-Conformance Report (NCR), sometimes written as nonconformance report or NCMR (non-conforming material report), records a single instance where something did not meet its specification. That specification might come from a drawing, a work instruction, an inspection plan, a purchase order, or a regulation.
The NCR sits inside production and post-production, but it touches nearly everything upstream. A dimension out of tolerance on a molded housing, a failed solder joint caught at automated optical inspection, a sterilization cycle that ran below its validated parameter window: each of these opens an NCR.
Why Non-Conformance Report (NCR) discipline matters in medical device development
A nonconforming product that escapes to the field becomes a complaint, a vigilance report, or a recall. The NCR is the last documented control point before that happens.
Regulators treat this record as a window into whether a quality system actually functions. FDA investigators sample NCRs during inspection to see whether trends were detected, whether investigations were opened when they should have been, and whether corrective action followed. Notified bodies do the same under EU MDR 2017/745. Weak NCR practice shows up as observations about inadequate investigation, unjustified use-as-is dispositions, and records left open past their own procedural timelines.
There is a commercial cost too. Every hour a lot sits in quarantine is inventory that cannot ship.
The Non-Conformance Report (NCR) process
Under ISO 13485:2016, control of nonconforming product falls under Clause 8.3: general control (8.3.1), product detected before delivery (8.3.2), product detected after delivery (8.3.3), and rework (8.3.4). The US Quality Management System Regulation at 21 CFR Part 820 became effective on February 2, 2026, and incorporates ISO 13485:2016 by reference, so those clauses now carry the force of federal regulation.
A typical NCR flow runs like this:
- Detect and identify. Someone finds the deviation at incoming inspection, in-process check, final release, or during servicing.
- Segregate. Nonconforming material is physically or logically quarantined so it cannot be used or shipped by accident.
- Describe. The NCR records the requirement, the observed condition, quantity affected, lot or serial identification, and detection point.
- Evaluate. Clause 8.3.1 requires a determination of whether an investigation is needed. Risk drives that call, per ISO 14971:2019.
- Disposition. Clause 8.3.2 allows three routes: rework, preclude the original intended use (scrap or return to supplier), or acceptance under concession. Concession requires justification, authorization, and that applicable regulatory requirements are met.
- Verify and close. The reworked product is reverified against acceptance criteria. Records go into the device history record.
- Escalate where warranted. Recurring or high-risk nonconformities feed CAPA under Clause 8.5.2.
Disposition of Class II and Class III devices usually routes through a material review board with quality, engineering, and regulatory representation. Rework instructions need the same review and approval level as the original work instruction.
Common challenges and best practices
The most frequent failure is treating every NCR as a candidate for CAPA. That floods the CAPA system and starves the records that actually deserve investigation. Set a documented threshold based on risk and recurrence, then hold to it.
Use-as-is is the second trap. It is legitimate, and Clause 8.3.2 permits it, but only with a written technical justification. Auditors read a pattern of thin concessions as evidence that specifications are not being taken seriously. If a tolerance is repeatedly accepted at concession, the tolerance is probably wrong, and the design should change through change control.
Write the nonconformity against the requirement, not a vague symptom, so a reader two years later can reconstruct what happened. Code NCRs consistently by defect type, process step, and supplier so the data supports trending under Clause 8.4. Close records inside the interval your own procedure states, because a procedure you do not follow is worse than no procedure.
Rework deserves separate attention. It is a repeat manufacturing operation on validated hardware, and it can introduce failure modes the original process never had. Assess that risk before authorizing it, not after.
How SJML helps with Non-Conformance Report (NCR) handling
Syrma Johari MedTech is an end-to-end medical device CDMO operating under ISO 13485 and aligned to FDA 21 CFR Part 820, EU MDR and IVDR, and MDSAP. Manufacturing runs in ISO Class 7 and 8 cleanrooms with SAP-integrated MES traceability, so nonconformities can be traced to lot, process step, and supplier. Our teams support process validation (IQ, OQ, PQ), PFMEA, supplier qualification, and root cause analysis feeding CAPA.
Talk to SJML’s manufacturing team →
Frequently asked questions
An NCR documents and disposes of one specific nonconformity, answering what happened to this lot or unit. CAPA addresses the underlying cause so the problem does not return. Not every NCR becomes a CAPA. Escalation should follow a documented, risk-based threshold, typically triggered by severity, recurrence, or an adverse trend detected under ISO 13485 Clause 8.4.
Yes. The Quality Management System Regulation became effective on February 2, 2026, and incorporates ISO 13485:2016 by reference into 21 CFR Part 820. The old subparts are reserved, so nonconforming product requirements now come from Clause 8.3 of the standard rather than a standalone regulatory paragraph. The substantive obligation to identify, segregate, evaluate, and dispose of nonconforming product is unchanged.
Approval authority is defined in the manufacturer’s procedure. For low-risk cosmetic defects, a quality engineer may dispose of them alone. Higher-risk items and anything accepted under concession normally go to a material review board that includes quality, manufacturing engineering, and regulatory affairs. Records must identify the individuals who authorized the concession, per ISO 13485 Clause 8.3.2.
Only under concession, and only when justification is documented, authorization is obtained, and applicable regulatory requirements are met. The justification should rest on technical evidence that safety, performance, and intended use are unaffected. Concession is intended for isolated cases. A manufacturer that ships routinely under concession is signaling that its specifications, its process capability, or both need correction.
Related terms
- CAPA (Corrective and Preventive Action)
- Device History Record (DHR)
- Change Control
- Process Validation (IQ, OQ, PQ)
- Root Cause Analysis (RCA)
