What Counts as a Nonconformity

A nonconformity is the non-fulfilment of a requirement. That definition, used in the quality management vocabulary standard of the International Organization for Standardization (ISO), ISO 9000, is short, but every word matters. If there is no requirement, there is no nonconformity. If the requirement is unclear, people will argue about whether one exists instead of fixing it.

Where requirements come from

• Customer requirements: drawings, specifications, purchase orders, service agreements.
• Statutory and regulatory requirements: laws, permits, licences, product safety rules.
• Internal requirements: your own procedures, work instructions, control plans and policies.
• Management system requirements: standards the organisation has chosen to follow, such as ISO 9001.

Related words that are not the same

A defect is a nonconformity related to intended or specified use. In some industries "defect" has a legal meaning linked to product liability, so many organisations prefer "nonconformity" in internal records. A deviation or deviation permit is permission, given before production, to depart from a requirement for a limited quantity or time. A concession is permission given after the output exists. Using these words carefully keeps records clear and avoids accidental legal statements.

Worked example: one event, three nonconformities

A machining cell ships a batch with an oversize bore. Investigation shows the in-process gauge check was skipped on night shift, and the control plan did not say what to do when the gauge was unavailable. The oversize bore is a product nonconformity. The skipped check is a process nonconformity. The missing reaction plan is a system weakness. Fixing only the bore would leave the other two in place.

Worked example: a service nonconformity

A facilities contractor's service agreement requires emergency call-outs to be attended within two hours. A log shows a call attended after three hours. No product exists, but the requirement is clear and it was not met. This is a service nonconformity, and it needs the same handling as a physical one: record, correction, and, if it repeats, corrective action.