An industrial non-conformity rarely makes a noise at the start. A process deviation, a part out of tolerance, missing documentation, an "isolated" customer return.

The problem is not the deviation itself. The problem is what happens when the non-conformity is poorly qualified or poorly handled: lost time, rework, non-quality costs, regulatory risks, customer tension, and sometimes a safety incident.

Although the concept seems simple, it is still often confused with:

• an anomaly,

• a deviation,

• a concession.

These confusions have very concrete effects: wrong level of escalation, wrong workflow, superficial corrective actions, and recurrence.

In this article, you will find:

• an operational definition of industrial non-conformity,

• the key distinctions (anomaly / deviation / concession),

• a pragmatic method of handling (logging, root cause analysis, CAPA),

• best practices for formatting a coherent process that is traceable and compliant with ISO 9001 and, depending on the sector, IATF 16949 or ISO 13485.

1) Defining industrial non-conformity

What is an industrial non-conformity?

An industrial non-conformity is a deviation from a requirement.

This requirement can be:

• customer (specification, statement of work),

• internal (instruction, procedure, control plan),

• normative or regulatory,

• linked to design or manufacturing records.

A non-conformity can relate to:

• the product (part out of tolerance, visual defect, performance not achieved),

• the process (parameter not respected, step not completed),

• the documentation (incorrect version, incomplete record),

• the organisation (missing validation, control not executed).

Important point: a non-conformity is not "an incident". It is a deviation from a requirement.
This precision is the foundation of a coherent quality system.

2) Why do we still confuse non-conformity, anomaly, deviation and concession?

Anomaly

An anomaly is a dysfunction observed, but which does not necessarily breach a formal requirement at this stage.
Examples: weak signal, unusual behaviour, suspicion of deviation, defect with no confirmed impact.

Deviation

A deviation is a departure from the planned framework (process or organisation) which may or may not lead to a non-conformity.
The deviation must be tracked because it can create a risk even if the product is compliant.

Concession

A concession is a documented authorisation, usually temporary, allowing a situation out of specification to be accepted under conditions (assessed risk, formal validation, duration and scope).

Non-conformity

A non-conformity involves a proven failure to meet a requirement and generally triggers:

• a formal record,

• an analysis,

• and corrective / preventive actions according to risk.

Why is this critical? Because the same event can generate very different decisions depending on the qualification: batch segregation, customer information, CAPA, concession, supplier audit, management escalation.

3) Classifying non-conformities to act quickly and effectively

Classification allows you to adapt:

• the immediate response,

• the level of escalation,

• the degree of investigation,

• and the speed of closure.

A simple approach consists of distinguishing:

• Minor: deviation with no major impact on product compliance or safety, quickly correctable.

• Major: potential or actual impact on product/process compliance, requires a formal corrective action.

• Critical: immediate risk to safety, regulatory compliance or the customer, requires immediate containment and escalation.

Best practices:

• document the classification and examples in the quality system,

• define explicit escalation rules,

• link the classification to the workflow (who validates, who is notified, what deadlines).

4) Why does a non-conformity occur (and what does it actually cost)?

Common causes

The actual cause is rarely unique. We often find:

• raw material or supplier,

• process drift,

• machine setup / insufficient maintenance,

• operator error (often a symptom of a workstation or standard issue),

• unsuitable procedure,

• variability between sites or teams.

Underestimated impacts

The cost of a non-conformity is not limited to scrap. It includes:

• investigation time,

• reworks,

• withholding of batches,

• capacity losses,

• penalties,

• extra logistics costs,

• and sometimes reputational cost.

To steer this, quality data must be linked to:

• the ERP (costs, batches, flows),

• maintenance / CMMS (machine events),

• and the quality system (non-conformities, CAPA, audits).

5) Detecting and reporting non-conformities: the decisive factor

A non-conformity is first and foremost an operational event. The detection speed and the quality of the record determine everything else.

What actually helps:

• a simple reporting channel (shop floor, production, quality control),

• a structured non-conformity report (paper or digital),

• minimum mandatory fields,

• associated evidence (photos, measurements, batch numbers),

• simple training: "when to trigger, how to qualify, whom to escalate to".

At this stage, the objective is simple: capture a clear, traceable and actionable event.

6) Analysing root causes: avoiding "paperwork" that changes nothing

Root cause analysis is the most critical part. It is also the one that is most often rushed, which explains why they recur.

A robust approach follows three principles:

1. Start from facts (evidence, measurements, conditions, context)

2. Formulate hypotheses and then validate them

3. Link cause → action → effectiveness verification

5 Whys and Ishikawa: when to use them

• 5 Whys: fast, useful to go from a symptom to an actionable cause on simple cases.

• Ishikawa (6Ms/5Ms): useful in collective workshops to methodically explore all families of causes.

If the risk is high or systemic, supplementing with an FMEA-type approach (severity, occurrence, detectability) helps with prioritisation.

7) CAPA: turning an analysis into actions that stand the test of time

An effective CAPA is based on a simple rule: no action without an effectiveness criterion.

Best CAPA practices:

• distinguish between correction (treating the incident) and preventive (preventing recurrence),

• assign a single owner per action,

• define a realistic deadline,

• define a measurable success criterion,

• integrate the change into standards (procedures, instructions, training, maintenance).

A non-conformity is genuinely "closed" when:

• the action is completed,

• the effectiveness is verified,

• and the learning is capitalised on.

8) Standards and best practices: key takeaways

Depending on the sector, frameworks vary, but the expectations are similar:

• recording and traceability,

• analysis proportionate to the risk,

• actions and effectiveness verification,

• management review,

• document control.

ISO 9001 sets the standard. IATF 16949 and ISO 13485 reinforce, in particular, the strictness around traceability, document control and risk management.

9) Core mistakes (and how to avoid them?)

• Confusing symptom and root cause

• Closing without verifying effectiveness

• Treating locally without capitalising (same defect, another site)

• Leaving information in separate tools (quality / maintenance / ERP)

• Multiplying manual files or spreadsheets without workflow and without clear ownership

Conclusion

An industrial non-conformity is a deviation from a requirement. What makes the difference is not the capacity to "correct quickly", but the capacity to:

• qualify correctly,

• analyse rigorously,

• turn the analysis into measurable CAPAs,

• and capitalise on it to prevent recurrence.

A simple process, traceable and shared by everyone, reduces processing time, increases consistency and reinforces compliance. This is also the basis for truly managed, and not solely reactive, continuous improvement.