Skip to content
Sertiq Sertiq Docs

Non-Conformance Records (NCR)

A Non-Conformance Record (NCR) captures a single instance where a supplier-provided product, service, or process did not meet your specification. In Sertiq, every NCR is bound to one supplier and one ISO 9001 clause, and feeds the supplier’s scorecard and risk band.

NCR list grouped by supplier

The detail page collects everything that belongs to one NCR: description, containment, linked CAPAs, 8D, AI Root Cause analysis, supplier SCAR portal link, attachments, and export buttons.

NCR detail — Counterfeit component concern

How NCRs map to ISO 9001

Section titled “How NCRs map to ISO 9001”

NCRs in Sertiq map directly to ISO 9001:2015 clause 8.4 — Control of externally provided processes, products and services:

  • 8.4.1 General — supplier did not meet the controls you defined.
  • 8.4.2 Type and extent of control — the verification, inspection, or release step failed.
  • 8.4.3 Information for external providers — your spec, drawing, or PO requirement was not communicated or honoured.

For critical NCRs, Sertiq additionally records a containment action to satisfy clause 8.7 (“Control of nonconforming outputs”).

Supplier vs internal NCRs

Section titled “Supplier vs internal NCRs”

Sertiq now records where the NCR came from via a source field. The value drives whether supplier_id is required and widens the set of valid ISO clauses.

SourceMeaningsupplier_id
supplierA supplier-provided product, service, or process failed your spec. The original NCR shape.Required.
internal_auditRaised by converting a finding from an Internal Audit.NULL.
customer_complaintA customer reported a non-conformance against your output.NULL.
management_reviewRaised during an ISO 9.3 management review.NULL.
processAn internal process control surfaced the issue (incoming inspection, in-process check, final inspection on your own output).NULL.
otherAnything that does not fit the above.NULL.

The supplier dropdown is hidden on the NCR form when the source is not supplier. The database enforces the rule: a row with source = 'supplier' must have a supplier_id, and rows with any other source must not.

Internal NCRs use the same numbering series (NCR-YYYY-NNNN), the same status lifecycle, and the same CAPA flow as supplier NCRs. The ISO clause field is no longer restricted to 8.4.x — internal NCRs commonly carry 9.2 (audit), 10.2 (corrective action), 5.3 (organisational roles), 7.1.5 (monitoring resources), and others, depending on what was actually found.

When an internal audit finding is converted via Convert to NCR, Sertiq stamps source = internal_audit, copies the finding’s ISO clause (defaulting to 9.2 if absent), and maps severity per the table in Internal Audits → Convert finding to NCR.

Raise an NCR

Section titled “Raise an NCR”

  1. Open NCR → New (or use the + New NCR button from a supplier’s profile to pre-fill the supplier).

  2. Pick the supplier from the dropdown. The list is scoped to your organisation.

  3. Enter a short title (max 200 chars) and a description of at least 20 characters. The description is the part that ends up in your audit .docx, so be specific: part number, lot, drawing revision, measured value vs spec.

  4. Set the ISO clause (8.4.1, 8.4.2, or 8.4.3) and severity (minor, major, critical).

  5. If severity is critical, fill the containment action field. This is enforced at the database level — you cannot save a critical NCR without it.

  6. Optionally set a response due date and attach files (photos, PDFs, certificates) — up to 25 MB per file, stored in Cloudflare R2.

  7. Click Publish NCR. Sertiq assigns the next number in the NCR-YYYY-NNNN series for your organisation and routes you to the NCR detail view.

Severity levels

Section titled “Severity levels”
LevelWhen to useRequired fields
minorCosmetic or low-impact issue, no production stoppage.Standard fields.
majorAffects fit, function, or delivery; needs a CAPA.Standard fields.
criticalSafety, regulatory, or production-halting issue.Containment action mandatory.

The containment action is the immediate, short-term measure (segregate the lot, stop shipment, switch to alternate supplier) you take before the long-term corrective action lands. Auditors look for it on every critical NCR.

Status lifecycle

Section titled “Status lifecycle”
draft  ─►  open  ─►  inProgress  ─►  closed
                │                    ▲
                └────────────────► disputed
  • draft — saved but not published. Excluded from quota counts, dashboards, and analytics. See Drafts.
  • open — published; awaiting first action from the assignee or supplier.
  • inProgress — root cause investigation or CAPA work has started.
  • closed — verified resolved. closed_at is stamped automatically.
  • disputed — supplier rejects the NCR; escalation path for QE manager.

Auto-numbering

Section titled “Auto-numbering”

The NCR number is generated server-side inside a SECURITY DEFINER RPC, so two users raising NCRs at the same instant cannot collide. The pattern is:

NCR-{YYYY}-{NNNN}

YYYY is the calendar year of creation. NNNN is a zero-padded sequence that resets per organisation, per year — so NCR-2026-0001 is your first NCR of 2026 regardless of how many other Sertiq tenants exist.

Attachments

Section titled “Attachments”
  • Where: Cloudflare R2 object storage, keyed {org_id}/ncr/{ncr_id}/{file_uuid}.{ext}.
  • Size: up to 25 MB per file.
  • Access: private; downloads use short-lived signed URLs scoped to your organisation.
  • Retention: kept indefinitely until you delete the NCR or your plan storage cap forces cleanup.
Section titled “Related”