ISO 9001 clause 8.7: control nonconforming outputs
ISO 9001:2026 clause 8.7 requires outputs that do not meet requirements to be identified and controlled so they are not unintentionally used or delivered. Appropriate action depends on the nature of the failure and its effect on product or service conformity. The requirement also applies when the problem is discovered after delivery or during or after a service.
What clause 8.7 requires in practice
Clause 8.7 deals with what happens when something goes wrong with an output. Its first part, 8.7.1, expects outputs that do not conform to requirements to be identified and controlled so that they are not used or delivered unintentionally. The organisation takes action suited to the nature of the problem and its effect on conformity, including problems found after delivery or during or after provision of a service.
Several responses are available, alone or combined: correction, segregation, containment, return or suspension of provision, informing the customer, and obtaining authorisation to accept the output under concession. Where output is corrected, conformity is verified again.
Its second part sets out the evidence to keep: the nature of the nonconformity, the actions taken, any concessions obtained, and the authority that decided what to do. The overall idea is controlled, visible, accountable handling of failure.
Understand the two parts of the requirement
Clause 8.7.1 explains identification, control and appropriate response. Depending on the situation, the response may involve correction, containment, return, suspension of the relevant provision, customer communication or authorised acceptance under concession. More than one action can be necessary.
Clause 8.7.2 addresses the evidence: what the nonconformity was, what action was taken, any concession obtained and who had authority to decide the action. The two parts work together. A sound decision without traceable evidence is difficult to demonstrate; a detailed record without effective control leaves the customer exposed to the same output problem.
Build a proportionate response
First establish the requirement that was not met and identify the affected output sufficiently to control it. Decide what immediate action prevents unintended use or delivery. In a physical process this may involve segregation; in a service it may mean restricting access to an incorrect file, stopping further processing or preventing a message from being sent.
Next decide the appropriate disposition and authority. If correction is chosen, verify conformity afterwards. If a concession is considered, retain the authorisation and its scope rather than quietly changing the requirement to make the failure disappear. Customer communication should reflect the issue and applicable obligations, not depend only on whether the customer has already noticed.
Then consider whether the issue also needs action on its causes under clause 10.2. Correcting an output and preventing recurrence are related but different tasks. The standard does not require every isolated output failure to trigger the same full-scale investigation; the need for corrective action must be evaluated appropriately.
Why controlling nonconforming outputs matters to the business
Every organisation produces defects occasionally; what separates strong ones is whether defects reach customers. Controlled handling stops faulty output from slipping into deliveries, keeps costs down by choosing the right response rather than automatically scrapping, and preserves trust when a problem does emerge because the customer is told accurately. It also generates useful data about recurring weaknesses, supporting improvement. Weak control, on the other hand, is a common source of recalls, penalties and lost contracts. Auditors tend to test this area by asking how staff recognise problems and what they do next, and answers from the floor reveal how well the system works.
How to implement clause 8.7
Aim for a response that every employee understands, from the operator who spots a fault to the manager who decides what happens next. Practise the response with front-line staff, using realistic examples, so that it works under time pressure. Remember that service organisations face the same need with errors in reports, advice or data. Revisit the arrangements after any serious case.
- Define what counts as nonconforming output in each process, using the acceptance criteria already set for products and services.
- Provide a simple way to label or physically or digitally separate suspect output so that it cannot move forward.
- Decide who has authority to choose between correction, rejection, return, suspension or acceptance under concession.
- Include rules for informing customers, and for dealing with problems discovered after delivery.
- Require re-checking after correction before output is released again.
- Keep a record of each case, and review the records regularly to spot patterns that need corrective action.
Evidence an auditor expects for clause 8.7
Auditors usually combine observation of how suspect output is handled with a review of past cases. Interviews matter here because staff behaviour at the moment of discovery cannot be seen in paperwork alone. Records should be easy for the team to retrieve.
- Observation of segregated or labelled nonconforming output and the controls that prevent its use.
- Records of sampled cases describing the problem, the action chosen and who decided.
- Concession records and any communication with customers.
- Interviews with operators on how they recognise and report problems.
Illustrative construction example: an incorrect installed item
A contractor discovers that a fitted door assembly does not match the approved specification for a particular location. The team identifies the affected opening and stops the relevant handover activity while the discrepancy is assessed. It checks whether other installations used the same order information rather than assuming that the visible item is the only one affected.
The authorised decision is to replace the assembly with the specified item and verify the result before release. The record connects the location, requirement, discrepancy, replacement and verification. This example does not prescribe a technical construction solution for every case; the appropriate response depends on the design, contractual requirements and applicable obligations.
Illustrative IT example: a misconfigured account
An IT service provider completes a customer access request with permissions broader than those authorised in the request. The service desk identifies the affected account and follows the relevant control route to correct access and assess the consequences. A completed ticket is reopened rather than left as evidence of successful delivery.
The team verifies the corrected permissions against the authorised request and records the action and decision authority. It also checks whether the same request rule affected other accounts. Any information-security or legal response is handled through the applicable arrangements; an ISO 9001 record alone cannot resolve those separate duties.
Avoid controls that exist only on paper
Typical weaknesses are unclear status labels, restricted items that can still be selected for dispatch, and service errors recorded without controlling the incorrect output. Another is allowing a person without relevant authority to accept a deviation because correction would delay delivery. The control should work in the actual process, including handovers between teams.
Records should describe facts with enough precision to support the decision. “Quality issue” is rarely a useful description on its own. Identify the requirement and departure, the action, any concession and the authority. Additional references to affected batches, versions or transactions can make evidence retrievable without creating a compulsory universal form.
Explore each numbered part
8.7.1 · identify and act on nonconforming outputs
Identification is useful only when it changes what people can do with a failed output. This guide explains practical containment and disposition under clause 8.7.1, including correction, concession and problems discovered after delivery. Manufacturing and BPO examples show how to control the affected work, verify corrected results and avoid confusing immediate action with recurrence prevention.
8.7.2 · record nonconforming output decisions
A nonconforming-output record should explain what failed and what was decided, not merely show that a ticket was closed. This guide covers the evidence required by clause 8.7.2 and shows how to connect affected outputs, actions, concessions and decision authority in practical software and construction cases without prescribing one compulsory form.
Frequently asked questions
Does clause 8.7 apply to services?
Yes. A service output can fail a requirement through incorrect processing, incomplete work or an unsuitable delivered result. The controls should fit the service, such as correcting a report and preventing reuse of its superseded version.
Is a concession the same as correction?
No. Correction addresses the nonconforming output. A concession is an authorised acceptance of a specified departure in the relevant circumstances. Preserve the actual failure and authorisation; do not describe an uncorrected deviation as verified conformity.
What if the problem is found after delivery?
Clause 8.7 still applies. Assess the nature and effects, identify the affected output, and take appropriate action, which can include customer communication. The fact that delivery occurred does not remove the need to respond.
Connect output control with practical learning
Sterling can help design a proportionate disposition process and connect it with corrective action through ISO 9001 implementation support. Agreed access to Effivity ISO & GRC automation software can support the scoped system. Independent certification bodies retain responsibility for certification decisions.
The live Nonconformity Management course is a relevant next step for teams learning to describe, control and follow up issues. Ask Sterling Academy about the forthcoming QMS courses for a wider pathway.