Managing nonconformities in industrial SMEs: what to do and how to digitize the process
2026-05-12
A nonconformity is any failure to meet a requirement (regulatory, legal, contractual, or internal) detected in a product, process, or service. The first action is not to investigate the cause, but to contain the problem and record it immediately with objective evidence. Only then comes root cause analysis, the design of corrective action, and verification that the action actually worked.
In brief:
Classifying a nonconformity as major, minor, or potential directly affects the urgency and resources needed to resolve it.
Effective management requires detecting and containing the issue, analyzing the root cause, implementing actions, and verifying the results with objective evidence.
Digitizing the record speeds up closure, prevents errors, and makes it possible to link nonconformities to production, maintenance, and the batch in real time.
Integrated platforms make shop-floor control easier, automate owners and deadlines, and simplify audit preparation.
It is essential to document verifiable facts and attach clear evidence so that a nonconformity can withstand an external review.
Table of contents
-
How to implement the system so it does not become dead paperwork
-
Digitize your nonconformity control without endless projects
What a nonconformity is and why it matters
ISO 9001:2015 defines a nonconformity as the failure to meet a requirement, whether it is a technical specification, a contractual clause, or an internal procedure established by the company itself. A customer does not have to be affected for one to be opened: a part that is out of tolerance and detected before it leaves the factory is already a nonconformity, even if it never reaches the market.
The most common confusion on the shop floor is treating correction as if it were the end of the process. It is not. Correction eliminates the immediate symptom (repainting the defective part, reworking the batch, replacing the unit for the customer). Corrective action addresses the cause that generated the failure so it does not happen again. If an operator adjusts a machine incorrectly and you simply fix the part without reviewing why the incorrect adjustment occurred, tomorrow you will have the same problem with another batch.
Clause 10.2 of the standard requires something very specific: responding to the nonconformity, evaluating whether its cause needs to be eliminated, implementing the necessary action, and reviewing its effectiveness. That sequence is the backbone of any serious nonconformity management system:
-
Respond: contain the damage and prevent the defect from progressing through the process.
-
Evaluate: decide whether the case warrants root cause analysis or whether a one-off correction is enough.
-
Act: design and implement corrective action when appropriate.
-
Verify: check with data that the action worked, rather than simply assuming it did.
Without that last step, the cycle is incomplete and the system is no longer reliable during an audit.
Types and classification of nonconformities
Misclassifying a nonconformity is as serious as failing to record it: overestimating every finding drains the quality team’s resources, while downplaying a serious failure can expose the company to a safety incident or legal claim. The three common levels in industrial SMEs are:
-
Major nonconformity: directly affects the customer, people’s safety, or legal compliance. Example: an entire batch shipped out of specification or a machine operating without the required guard.
-
Minor nonconformity: fails to meet a documented requirement but has no significant immediate impact, such as a calibration record not being updated on time.
-
Observation or potential finding: a condition that could lead to a failure to meet requirements if not corrected, although it has not caused one yet—for example, an ambiguous procedure that two operators interpret differently.
The criteria that should carry weight in the classification are the impact on the end customer, safety risk, legal or regulatory exposure, and recurrence of the failure. An isolated cosmetic defect is not the same as the same defect appearing for the third time in a month: recurrence automatically turns a minor nonconformity into a case that warrants deeper root cause analysis.
How to manage a nonconformity step by step
The operational process has six phases that overlap very little and are best carried out in order. Skipping steps to “go faster” usually results in the same failure reappearing weeks later, with the added cost of having to investigate it twice.
Detection and recording. Any operator, inspector, or quality manager should be able to open a nonconformity as soon as they detect it, without relying on someone else to do it for them. At this point, the minimum information is recorded: what happened, where, when, which batch or serial number was involved, and who detected it. A photograph of the part or a reading from the measuring instrument is worth more than half a page of written description.
Containment or immediate correction. The affected product is isolated, the process is stopped if necessary, and steps are taken to prevent the defect from spreading further. This phase is not about resolving the cause, only stopping the damage: separate the suspect batch, stop the line, notify the next shift.
Root cause analysis. This is where you determine why the failure occurred, not just what happened. Two techniques cover most shop-floor cases:
-
5 Whys: repeatedly ask “Why?” about the symptom until you reach a cause which, if eliminated, prevents recurrence. Example: a part is out of tolerance → Why? The machining tool was worn → Why? There was no preventive replacement plan → Why? The CMMS did not generate service-life alerts. The root cause is not the part; it is the absence of a maintenance alert.
-
Ishikawa diagram (fishbone): organizes possible causes into categories (machine, method, material, manpower, measurement, environment) when the failure has several interrelated factors and the 5 Whys are too linear.
Design and implementation of corrective action. Once the cause has been identified, define what will change permanently: a new control point, a procedure modification, an automated maintenance alert, or a supplier review. Assign an owner and a deadline.
Verification and closure. Implementing the change is not enough: you have to check with data that it works. If the cause was a worn tool and there is now a preventive replacement alert, verify that the next production run of that part number is within tolerance. Only then should the nonconformity be closed, with objective evidence attached.
Professional tip: It is advisable to set indicative deadlines for managing nonconformities, without specifying exact periods, to prevent them from remaining open indefinitely and losing their value as a source of improvement. Without deadlines, nonconformities remain open indefinitely and lose all value as a source of improvement.
Some key indicators to track include the number of open nonconformities, average closure time, and the percentage of effective corrective actions, without specifying exact figures.
How to write a nonconformity that can withstand an audit
A well-written record saves the auditor and the quality team hours of work when the history needs to be reviewed months later. The fields that must be included in any nonconformity form are:
-
Unique identifier and detection date.
-
Objective description of the finding: what was observed, using which instrument or method, and under what conditions.
-
Requirement not met, citing the specific procedure, specification, or clause.
-
Attached objective evidence: photograph, measurement reading, batch or serial number.
-
Origin of the failure (process, supplier, design, operation) and severity classification.
-
Owner of the investigation and implementation of the action.
-
Correction applied and, if applicable, a link to the resulting corrective action.
-
Date and evidence of effectiveness verification for closure.
The wording should describe verifiable facts, never opinions. “The operator did not follow the procedure” is a value judgment; “The recorded torque reading was 12 Nm, compared with the 18 Nm specified in procedure PR-045” is a fact that an external auditor can verify without relying on anyone’s memory. Always attaching the same type of evidence (photos with a visible reference, screenshots of digital readings, batch number) makes it easier to compare similar cases and detect recurrence patterns.
How to prioritize the severity and risk of each case
Not all nonconformities deserve the same level of resources. A simple impact-by-probability matrix makes it possible to decide in seconds whether a case requires immediate corrective action or can wait until the next periodic review.
Impact is assessed according to three dimensions: people’s safety, legal or regulatory compliance, and customer satisfaction. When both axes are high, corrective action cannot wait: consider a line stoppage that jeopardizes a signed delivery deadline or a legal noncompliance detected during a machinery safety inspection.
Examples from the shop floor:
-
A part out of tolerance detected before final assembly, with no prior history: low impact and probability. One-off correction and recording, with no need to escalate.
-
The same deviation appearing for the second time in a month at the same workstation: high probability. Root cause analysis should be opened even if the individual impact is moderate.
-
An unplanned line stoppage that delays a committed delivery: high impact due to the commercial effect; corrective action with a short deadline is required.
-
A noncompliance detected during a machinery safety review: high impact due to legal and personal safety risks; escalate to management immediately.
Cases with a high impact on safety or legal compliance must be escalated to management without waiting for the periodic quality meeting, regardless of whether the likelihood of recurrence seems low at that point.
Why digitizing the nonconformity register speeds up closure
Keeping the nonconformity register on paper or in Excel sheets scattered across different workstations creates the same problem over and over: no one knows how many nonconformities are actually open or who is responsible for each one. A centralized register solves this at the root, because the entire shop floor works with the same information in real time.
Integrating maintenance data with quality data, as recommended by Siemens’ quality control approach, makes it possible to anticipate failures before they generate a nonconformity: if the system knows the actual condition of a piece of equipment, it can prioritize preventive interventions instead of waiting for the defect to appear in production.
The features that really make a difference in an industrial SME are:
-
Mobile access so any operator can open or update a nonconformity without returning to the office.
-
Attach photos and readings directly from the point where the failure is detected.
-
Automated workflows that assign an owner and deadline, and send notifications when an action is waiting to be verified.
-
Integration with production and maintenance systems, to link each nonconformity to the batch, machine, or operator involved.
-
Automatic reminders that prevent a case from being forgotten for weeks.
There are platforms designed for this scenario that bring production (MES), planning (MRP), warehousing (WMS), and maintenance (CMMS) together in a single system, so a nonconformity detected on the shop floor is automatically linked to the batch, machine, and maintenance history without anyone having to manually cross-reference several spreadsheets.
How to implement the system so it does not become dead paperwork
The most common mistake when launching a nonconformity management system is designing a perfect procedure on paper that nobody uses on the shop floor. A simple process that employees actually follow is worth more than a twenty-page manual that is consulted once a year.
-
Pilot on a specific line or process. Choose an area with enough cases to test the workflow over four or six weeks, using a minimal recording template and a single review owner.
-
Short, practical training. A thirty- or forty-minute session showing real examples from your own shop floor is more convincing than a theoretical talk about the standard.
-
Periodic review routine. A short weekly meeting to review open nonconformities, how long they have been open, and the status of corrective actions awaiting verification.
-
Gradual rollout to the rest of the shop floor, adjusting the template based on what was learned during the pilot.
The minimum indicators to review in this routine are the number of open nonconformities, average closure time, and the percentage of corrective actions verified as effective. Without this periodic review, standardization deteriorates as soon as the staff who put it in place move on.
Professional tip: Automating deadline reminders and verification checklists reduces dependence on individual memory. A new operator who follows a digital checklist makes fewer mistakes than one who tries to remember a procedure explained just once during onboarding.
To prepare evidence for an external audit, always keep the record up to date when the finding occurs, not at the end of the month: reconstructing dates and attachments weeks later introduces errors that an auditor can easily detect.
What almost nobody says about nonconformities
Most quality manuals treat nonconformity as a problem to be minimized, almost like a blemish on the record. That mindset leads many SMEs to hide minor findings instead of recording them, and it is exactly the opposite of what works in practice.
A company that records few nonconformities is not necessarily a company that produces better. Often it is a company where nobody bothers to open them because the process is tedious or because they do not see the point. Properly conducted root cause analysis turns every detected failure into a permanent change that prevents it from happening again, and that accumulated learning is the real driver of the continuous improvement process—not the absence of incidents.
Discipline matters more than the sophistication of the procedure. A simple system followed consistently by all employees produces better results than a comprehensive procedure understood only by the quality manager. Maintaining that consistency, especially when staff change or production grows, requires management to be actively involved in reviewing the data, not just approving the manual.
Digitize your nonconformity control
A custom implementation project to digitize quality control usually takes months and requires a budget that an industrial SME rarely has available. There are solutions that address that same need in days, not months: they can be implemented without a long-term commitment and without custom development, with an interface any operator can learn to use on tablets on the shop floor during their first shift.
Bold Factory directly connects the nonconformity register with production, maintenance, and warehousing, so each finding is linked to the batch, machine, and maintenance history without anyone having to cross-reference spreadsheets. Production control with full traceability lets the operations director see at a glance how many nonconformities are open, how long they have been open, and which corrective actions are still awaiting verification—all from a single screen instead of chasing information from different people responsible for each case.
Sources
ISO 9001:2015 is the primary standard reference for all nonconformity management. This article is complemented by ISOTools’ practical guide to the management process, Eurofins’ documentation approach, and Siemens’ technical material on quality control, which is useful for understanding the integration of maintenance and quality. For recruitment processes for operational roles that support these routines, Filmijob’s guide to recruiting operators provides additional context.
Frequently asked questions
What is a nonconformity, and what are some examples?
It is a failure to meet a regulatory, legal, contractual, or internal requirement. Common examples include a part out of tolerance, a batch shipped without the required documentation, or a safety procedure not followed on the shop floor.
What are the most common types of nonconformities?
In industrial practice, they are classified into three levels: major (impact on the customer, safety, or the law), minor (documentary noncompliance without immediate impact), and observation or potential (a condition that could lead to a failure to meet requirements).
How are nonconformities handled in an industrial SME?
They are detected and recorded with objective evidence, contained immediately, and analyzed to find the root cause using methods such as the 5 Whys or Ishikawa. Corrective action is implemented, and its effectiveness is verified before the case is closed. Platforms such as Bold Factory let teams carry out this entire workflow on tablets on the shop floor, linking each case to production and maintenance.
What is the difference between correction and corrective action?
Correction eliminates the immediate symptom, such as reworking a defective part. Corrective action modifies the process so that the cause does not generate the same failure again.
What evidence should be attached when closing a nonconformity?
Photographs of the defect, readings from measuring instruments, the batch reference or serial number, and any data that allows an external auditor to verify the finding and the effectiveness of the action taken.
