Skip to content
Qualio Docs

Non-Conformance Records (NCR)

A Non-Conformance Record (NCR) captures a single instance where a supplier-provided product, service, or process did not meet your specification. In Qualio, every NCR is bound to one supplier and one ISO 9001 clause, and feeds the supplier’s scorecard and risk band.

How NCRs map to ISO 9001

Section titled “How NCRs map to ISO 9001”

NCRs in Qualio map directly to ISO 9001:2015 clause 8.4 — Control of externally provided processes, products and services:

  • 8.4.1 General — supplier did not meet the controls you defined.
  • 8.4.2 Type and extent of control — the verification, inspection, or release step failed.
  • 8.4.3 Information for external providers — your spec, drawing, or PO requirement was not communicated or honoured.

For critical NCRs, Qualio additionally records a containment action to satisfy clause 8.7 (“Control of nonconforming outputs”).

Raise an NCR

Section titled “Raise an NCR”

  1. Open NCR → New (or use the + New NCR button from a supplier’s profile to pre-fill the supplier).

  2. Pick the supplier from the dropdown. The list is scoped to your organisation.

  3. Enter a short title (max 200 chars) and a description of at least 20 characters. The description is the part that ends up in your audit .docx, so be specific: part number, lot, drawing revision, measured value vs spec.

  4. Set the ISO clause (8.4.1, 8.4.2, or 8.4.3) and severity (minor, major, critical).

  5. If severity is critical, fill the containment action field. This is enforced at the database level — you cannot save a critical NCR without it.

  6. Optionally set a response due date and attach files (photos, PDFs, certificates) — up to 25 MB per file, stored in Cloudflare R2.

  7. Click Publish NCR. Qualio assigns the next number in the NCR-YYYY-NNNN series for your organisation and routes you to the NCR detail view.

Severity levels

Section titled “Severity levels”
LevelWhen to useRequired fields
minorCosmetic or low-impact issue, no production stoppage.Standard fields.
majorAffects fit, function, or delivery; needs a CAPA.Standard fields.
criticalSafety, regulatory, or production-halting issue.Containment action mandatory.

The containment action is the immediate, short-term measure (segregate the lot, stop shipment, switch to alternate supplier) you take before the long-term corrective action lands. Auditors look for it on every critical NCR.

Status lifecycle

Section titled “Status lifecycle”
draft  ─►  open  ─►  inProgress  ─►  closed
                │                    ▲
                └────────────────► disputed
  • draft — saved but not published. Excluded from quota counts, dashboards, and analytics. See Drafts.
  • open — published; awaiting first action from the assignee or supplier.
  • inProgress — root cause investigation or CAPA work has started.
  • closed — verified resolved. closed_at is stamped automatically.
  • disputed — supplier rejects the NCR; escalation path for QE manager.

Auto-numbering

Section titled “Auto-numbering”

The NCR number is generated server-side inside a SECURITY DEFINER RPC, so two users raising NCRs at the same instant cannot collide. The pattern is:

NCR-{YYYY}-{NNNN}

YYYY is the calendar year of creation. NNNN is a zero-padded sequence that resets per organisation, per year — so NCR-2026-0001 is your first NCR of 2026 regardless of how many other Qualio tenants exist.

Attachments

Section titled “Attachments”
  • Where: Cloudflare R2 bucket qualio-attachments, keyed {org_id}/ncr/{ncr_id}/{file_uuid}.{ext}.
  • Size: up to 25 MB per file.
  • Access: private; downloads use short-lived signed URLs scoped to your organisation.
  • Retention: kept indefinitely until you delete the NCR or your plan storage cap forces cleanup.
Section titled “Related”