ISO 9001 clause 8.7.2: record nonconforming output decisions
ISO 9001:2026 clause 8.7.2 requires documented evidence of the nature of a nonconformity, the actions taken, any concessions obtained and the authority deciding the action. These records make the treatment of a failed output understandable after the immediate event. They should describe the actual problem and decision, rather than merely demonstrate that a reporting system was used.
What clause 8.7.2 requires in practice
Clause 8.7.2 sits directly behind the control of nonconforming outputs in clause 8.7.1 and asks for evidence that the decision about a failed output was made and can be traced afterwards. The organisation needs to be able to show four things. First, what the nonconformity actually was: which output, and in what way it fell short of its requirement. Second, what was done about it, whether that was correction, holding the output back, telling the customer or something else. Third, whether any concession was granted for accepting the output as it stood, including what that concession covered. Fourth, who held the authority to decide the action. The clause is about evidence, so the form is open: a quality system entry, a line on a job record or a signed note can all do the work if they carry those four elements. The output of this clause is a record trail that lets a reviewer, a customer or an auditor reconstruct the decision without relying on anyone's memory. What the clause does not do is prescribe a form, a numbering scheme or a particular tool.
Why clause 8.7.2 matters to the business
A nonconforming output is rarely a problem only on the day it is found. Customers ask what happened, insurers ask who agreed, and the next shift asks why a batch was held. If the decision was never written down, the organisation has to rebuild it from recollection, which is slow and often wrong. Clear decision records protect the business when a concession is later challenged, show customers that failed work was handled responsibly, and give management reliable material for spotting repeat failures. They also make audits calmer: an auditor who can follow a case from detection to authorised decision in a few minutes is far less likely to widen the sample. Weak records, by contrast, turn a single isolated defect into a doubt about whether the whole control of nonconforming work operates.
How to implement clause 8.7.2
The aim is a short, dependable way of capturing decisions at the time they are made, not a heavier form. A practical route is as follows.
- List where nonconforming outputs are found today, such as inspection points, customer complaints and internal handovers, and note where a decision is currently recorded, if anywhere.
- Agree the minimum content for a record: the output affected, the requirement not met, the action chosen, any concession and who decided.
- Name the roles allowed to decide each type of action, so that a concession is never granted by someone without the authority to give it.
- Choose where the record lives, ideally inside the system people already use, so that capturing it costs seconds.
- Make the record at the time of the decision, and write facts first, keeping suspected causes clearly labelled as suspected.
- Where a concession involves the customer, keep their agreement together with the record rather than in a separate mailbox.
- Sample a few closed cases each quarter, checking that a stranger could understand what happened, and refine the fields if they could not.
Describe the failure precisely enough to support action
Identify the output and explain the requirement it did not meet. A short factual statement is usually more useful than a broad category such as “poor quality.” Connect the statement with the affected batch, location, version, case or service transaction where that detail is needed to understand the scope.
Distinguish what is known from what remains under investigation. For example, a failed test result is an observation; a suspected cause is a hypothesis until supported. Keeping that distinction helps the decision-maker choose a proportionate action and prevents later analysis from treating an early assumption as established fact.
Record the action taken and the authority behind the disposition. If a concession was obtained, preserve its scope and authorisation. If no concession applies, do not invent one merely to fill a mandatory field in a locally designed form. The standard specifies the evidence needed, not a universal screen layout or coding scheme.
Illustrative software example: an accepted limited deviation
A software provider finds that an export function produces the correct data but does not apply a customer-specified column order. The customer needs a limited release while a correction is prepared. The issue record identifies the agreed format, affected release and actual departure. The team assesses whether the proposed arrangement is permissible before seeking the relevant authorisation.
The resulting record preserves the bounded concession, who authorised it, the applicable release and the action for correction. It does not change the failed check to “pass.” When the corrected export is verified, the new result is linked to the issue. The example illustrates traceable decision-making, not a rule that every software deviation can be accepted.
Illustrative construction example: a damaged delivered component
A construction team receives prefabricated panels and finds damage on two identified units. The record describes the affected panel references, observed damage and applicable acceptance requirement. It links photographs as supporting evidence, while the written description explains what the images are intended to demonstrate.
The authorised disposition is return and replacement. The team records that decision, the authority and the action taken, then connects the replacement inspection to the original issue. A generic supplier complaint saying “materials rejected” would be weaker because it would not reliably identify which units were restricted or what happened to them.
Make the evidence usable across handovers
A practical record should allow the next person to understand the current status without reconstructing it from private messages. Where action takes place in another system, a stable reference may be sufficient if the information remains accessible and controlled. Avoid disconnected records that contradict each other about whether an output is held, corrected, accepted or returned.
Use documented-information controls to address access, protection, changes and retention as appropriate. Corrections to the record should preserve a trustworthy account of the event. Quietly replacing the original description after disposition can destroy the evidence needed to understand why the decision was made.
The clause does not prescribe a separate record for every data field. A controlled service ticket, inspection system or disposition record can provide the required information. The test is whether the combined evidence clearly shows the nonconformity, actions, concessions and deciding authority, not whether it uses a particular quality-management acronym.
Use records for learning without overstating the data
Consistent descriptions can help reveal repeated output problems. However, a rise in recorded issues may reflect better reporting rather than worsening quality. Interpret trends alongside workload, severity and process changes. The immediate record should remain factual; broader analysis belongs in the relevant performance and improvement processes.
Common weaknesses include closing records before the action is complete, recording an approver's role without identifying the actual authority involved, and storing concession terms only in an inaccessible email. Another is capturing the correction but omitting the original requirement failure, making later evaluation of recurrence difficult.
Frequently asked questions
Does ISO 9001 require a specific nonconformity form?
No. The organisation chooses a suitable format. The documented information must provide the required evidence and remain appropriately controlled. A familiar form is useful only if it captures the facts and decisions reliably.
Can one record cover several affected outputs?
Yes, where the record clearly identifies the affected scope and the actions and decisions that apply. If different outputs receive different dispositions, preserve that distinction so a shared issue record does not conceal separate decisions.
Is an approval email enough to record a concession?
It can form part of the evidence if it clearly establishes the relevant authorisation and scope and remains accessible with the issue. An ambiguous message or a private mailbox reference may not provide a dependable account of the concession.
Improve the quality of disposition evidence
Sterling's QMS support can help connect output control with proportionate records and decision authority. Effivity ISO & GRC automation software can support scoped workflow needs where agreed; certification decisions remain independent.
Choose the live Nonconformity Management course for learning focused on handling and describing issues, or register interest in the forthcoming QMS pathway when the team needs wider system context.