ISO 9001 clause 8.7.1: identify and act on nonconforming outputs

What clause 8.7.1 requires in practice

This subclause focuses on the moment a nonconforming output is found. The organisation ensures such outputs are identified and controlled to prevent unintended use or delivery. It then acts in proportion to what the nonconformity is and how it affects conformity of products and services. That includes nonconformities detected after delivery, and those detected during or after provision of a service. In practice the clause means that every employee knows what to do on finding a fault.

Responses may be used singly or together:

• correction;
• segregation, containment, return or suspension of provision;
• informing the customer;
• obtaining authorisation for acceptance under concession.

When correction is chosen, the organisation checks again that the corrected output meets requirements. The evidence expected in 8.7.2 sits alongside this, but the subclause itself is about recognition, containment and a proportionate response.

Identify the output and make the status effective

Describe what requirement was not met and what output is affected. Where the full extent is uncertain, assess the boundary instead of assuming the problem is limited to the first item found. A common input, work instruction or processing rule may have affected other outputs.

Choose control that works in the actual workflow. A tag may be sufficient in a controlled physical area, but it will not help if staff can bypass the area and select the item electronically for shipment. For a digital output, a visible warning may need to be supported by access or distribution control. The clause requires an effective outcome, not a specific label colour.

Consider whether production, delivery or part of a service should be paused while the issue is assessed. The response must fit the effect; it should not be an automatic shutdown of everything or an automatic decision to continue. Make the authority and escalation route clear enough that people can act promptly.

Select the disposition that fits the facts

Correction may restore the output to the requirement. Containment, segregation, return or suspension can prevent further unintended use while a decision is made. Informing the customer and obtaining authorised acceptance under concession may be relevant. These actions can be combined; they are not mutually exclusive boxes requiring one universal selection.

A concession needs appropriate authorisation and a defined scope. It does not make the original result conforming or remove other applicable obligations. If the output is corrected, check the corrected characteristic and any relevant effects of the work before treating it as acceptable. Rework completion alone is not the required verification.

Why acting promptly on nonconforming outputs matters

The first hours after a defect is found usually decide the cost. Quick identification and containment keep one faulty batch, file or service case from becoming many, and a measured response avoids both overreaction and cover-up. Customers who hear about a problem from you, with a clear remedy, often judge the organisation more favourably than if they discover it themselves. Handling that is inconsistent, with some staff fixing quietly and others escalating, hides trends and exposes the business to repeated failures. During audits, staff answers to simple questions about what they do when something is wrong are a quick test of this control.

How to implement clause 8.7.1

Make the first response automatic: spot, stop, separate, then decide. Keep the steps short enough to be remembered, and make sure that urgent customer situations are covered by the same route rather than by improvisation. Revisit the steps after any serious case. Keep it practical and brief.

1. Teach employees how to recognise nonconforming output in their own work, using examples from the processes they perform.
2. Give them a clear stop-and-separate action, such as a hold tag, quarantine area or system status, that anyone can apply.
3. Provide a rapid route to someone empowered to judge severity and choose a response.
4. Set rules for when customers must be informed, and who contacts them, including when problems are discovered after delivery.
5. Define when concession is acceptable, who may grant it, and when customer agreement is also needed.
6. Verify corrected output against the original requirements before release, and look for the cause so the problem does not return.

Evidence an auditor expects for clause 8.7.1

Evidence shows that identification and containment worked in practice, not simply that a procedure exists. Follow-up of root causes is also commonly sampled. Samples should cover different shifts or teams.

• Observation of held, tagged or quarantined output and the controls around it.
• Records of recent nonconforming outputs and the action chosen for each.
• Re-inspection or retest results showing corrected output now meets requirements.
• Evidence of customer notification where problems were found after delivery.
• Interview with a front-line employee about what they do on finding a defect.

Common nonconformities with clause 8.7.1

Typical findings show containment or response failing. Each reveals a gap between the procedure on paper and the response people actually give on the floor.

• Suspect output is not segregated and has been used or delivered before a decision.
• Staff rework problems quietly without reporting, so the extent of the issue is unknown.
• Corrected output is released without a further check against requirements.
• Problems found after delivery are not communicated to the customer.
• Concessions are granted informally by someone without the authority to do so.

Illustrative manufacturing example: a mixed component batch

Illustrative BPO example: an incorrect customer statement

A processing provider discovers that a generated statement contains transactions from the wrong reporting period. Before distribution, it restricts the affected file and checks whether the date-selection rule was used for other statements. The corrected output is regenerated from the right period and reconciled before the service owner authorises its release.

If a version has already been sent, the provider assesses the consequences and uses the applicable communication route to replace or correct it. The team does not assume that deleting its own copy removes the customer's version. The evidence distinguishes the original failure, containment and verified replacement so later users do not treat both versions as valid.

Keep immediate control separate from cause analysis

Clause 8.7.1 can require action before the cause is fully understood. Waiting for a complete investigation while a known failed output remains available for use defeats the control. At the same time, immediate correction should not close off evaluation of whether the same failure can recur or exist elsewhere.

Use clause 10.2.1 for the response to nonconformity and evaluation of action on causes. A minor, isolated error and a repeated systemic failure may justify different investigations. Neither the standard nor this guide requires a particular branded problem-solving method for every event.

Common failures include ambiguous hold status, unauthorised release under deadline pressure and correction without subsequent verification. Another is accepting a concession verbally without a retrievable record or clearly bounded decision. Test the control with a real case: can staff identify what is blocked, who can decide its disposition and what evidence permits the status to change?