Morsa publishes this guide. Morsa is not a QMS; it is software with an AI agent that works in your ERP, email and Teams; it reminds CAPA owners before their due dates.
Quick answer
NCR: one record per failed part, lot or process, written the day it is found. Most close with a disposition: use as is, rework, repair, scrap or return to supplier [2][3].
CAPA: opened from one or more NCRs when the cause must go. ISO 9001 clause 10.2 asks you to find the cause, check whether it exists elsewhere, act, and review that the action worked [1]. ISO 9001:2015 has no separate preventive action clause; “preventive” here means that check for the same cause elsewhere.
When an NCR needs a CAPA: repeat, customer escape, safety or regulatory risk, supplier cause, a major audit finding, or cost over your threshold (table below).
What auditors write up: no root cause, no evidence the fix worked, the same cause not checked elsewhere, and actions left overdue.
Software: a spreadsheet works until a CAPA goes overdue and nobody notices until the audit. Then price 1factory first: NCR and CAPA in a $20 seat, $2,400 a year for 10 users [4].
The NCR form: fields and a filled-in example
An NCR report is also called a nonconformance report or nonconforming material report. The left column is your blank form; the right is a filled-in machine shop example.
Field | Example |
|---|---|
NCR number, date | NCR-2026-0147, 3 November 2026 |
Raised by, where found | J. Ortiz, final inspection |
Part, revision, job | Bracket 4410-B rev C, job 26-0912 |
Customer or supplier | A pump maker; the parts had not shipped |
Quantity | 400 made. A sample failed at final inspection, so all 400 were measured: 37 failed |
Requirement | Drawing note 4: hole position within 0.10 mm of datums A and B |
Found | Position 0.14 to 0.22 mm on 37 parts, all from Mill 2 |
Containment | 37 parts red-tagged and caged; the 363 good parts released; Mill 2 stopped on this part |
Disposition | Scrap 37; the hole cannot be moved |
Approved by | Quality manager and production manager |
Cost | 37 x $18.40 = $680.80 scrap, plus 6 hours measuring all 400 at $55 = $330, total $1,010.80 |
CAPA needed, why | Yes: second time in 60 days on the same fixture (NCR-2026-0098) |
Closed by, date | Quality manager, 4 November 2026; CAPA-2026-031 opened |
Write what was found as a measured fact against a named requirement, never as an opinion [2]. A supplier’s bad parts go on the same form, with the supplier in the customer or supplier field.
When an NCR needs a CAPA
A one-off minor defect closes on its disposition [2][3]. Open a CAPA when any of these is true, and set the thresholds once in your procedure so the call is not made case by case.
Trigger | Our example threshold |
|---|---|
Repeat | Same defect on the same part or process twice in 90 days |
Customer escape | Any defect a customer found |
Safety or regulatory | Any, whatever the quantity |
Supplier cause | Issue a SCAR (supplier corrective action request) instead |
Audit finding | Any major finding from a customer, registrar or internal audit |
Cost | Over $2,500 in scrap, rework and sorting on one NCR |
The NCR to CAPA flow, with dates
This is our example timeline. ISO 9001 sets no days; a customer’s SCAR or 8D may set its own. Using NCR-2026-0147, found on 3 November:
Day 0, 3 November: contain. Tag, cage and measure. This is clause 10.2’s “control and correct it” [1].
Day 1, 4 November: disposition and decide. The quality manager signs the disposition and opens CAPA-2026-031 because of the repeat.
Day 1: problem statement and team. One sentence of fact; an owner and two or three people who know the process.
By day 7: root cause, and where else the same cause exists [1].
By day 16: actions done, each with an owner, a due date and evidence.
About day 70: effectiveness check against a measure set on day 7. Close only if it passes [1][5].
ISO 9001 requires you to keep evidence of the nonconformity, what you did, and the result of the corrective action [1].
A worked CAPA: from root cause to effectiveness check
Again, the left column is the blank form.
Field | CAPA-2026-031 |
|---|---|
Source NCRs | NCR-2026-0098 (22 parts, 9 September), NCR-2026-0147 (37 parts, 3 November) |
Problem | Hole position out of tolerance on bracket 4410-B from Mill 2 |
Root cause | Fixture locating pins have no wear check (five whys below) |
Where else | The same pins are on three other fixtures |
Actions | Four, with owners and dates (table below) |
Effectiveness measure | Zero position rejects on the next 10 lots of 4410-B, about 4,000 parts, and pin gauge readings in tolerance at every weekly check |
Check date | 12 January 2027; if one lot fails, the CAPA reopens at root cause |
Closed by | Quality manager, after the check passes |
Five whys (our root cause analysis guide explains the method):
Why out of position? The part moved in the fixture during drilling.
Why did it move? The two locating pins had worn 0.08 mm undersize.
Why worn? They are soft steel and locate about 2,000 parts a week.
Why was the wear not caught? Fixture pins are on no inspection or maintenance list.
Why not? Fixtures were never added when the maintenance list was written.
Actions:
Action | Owner, due |
|---|---|
Replace both pins with hardened pins | Toolroom lead, 12 November |
Add a pin gauge check to the weekly maintenance list | Maintenance lead, 14 November |
Check hole position on the first piece after any fixture change | Quality lead, 14 November |
Inspect and fix the three other fixtures with these pins | Toolroom lead, 19 November |
Cost of poor quality, our figures: the two NCRs cost $1,635.60 ($1,010.80 plus $624.80 for 22 parts scrapped and 4 hours measuring). The fix cost $1,010 ($240 in pins plus 14 hours at $55), about what one more repeat costs, and it also fixes three other fixtures.
What auditors write up on CAPA, and how to answer a finding
Clause 10.2 is on DNV’s list of the ten ISO 9001 clauses it wrote up most in 2019 [6]. The findings come down to four things:
No root cause. DNV and its accreditation bodies read “cause” in 10.2 as root cause [6], so a CAPA that stops at “operator error” and retraining is exposed.
No evidence the fix worked. Actions are logged with no follow-up check [7].
The same cause not checked elsewhere. DNV expects every site on a multi-site certificate to investigate [6].
Actions not assigned, followed up or verified [7].
To answer a finding:
Correction: fix the example the auditor saw, such as adding the missing effectiveness check to that CAPA.
Root cause in your system: why your process let it happen, for example a CAPA form with no field for a check date.
Corrective action: change the form and procedure, and apply them to every open CAPA, with an owner and a date.
Evidence: the new form and procedure, and CAPAs closed under them.
Certification bodies set their own deadlines. Schellman, one certification body, asks for the root cause and action plan within 14 days, evidence of correction within 30, and for a major finding evidence of the fix within 60 [8]. Use the date on your registrar’s report.
Which CAPA software to buy
Check five things in any NCR software or CAPA software demo: an NCR opens a CAPA in one click with the link kept, overdue actions alert the owner and the quality manager, evidence attaches to each action, the effectiveness check is scheduled with a date, and an auditor can get one CAPA’s whole history in one export.
Option | Price |
|---|---|
Spreadsheet plus our 8D report template | $0 |
1factory QMS: NCR, material review board, CAPA, SCAR and complaints | $20 a user a month, 10-user minimum, so $2,400 a year [4][5] |
isoTracker: CAPA and nonconformance are separate modules | From $268.12 a month for 20 users on one module, which isoTracker rounds to $13.40 a user [9] |
ETQ, MasterControl, QT9 and other full QMS platforms | Quote only |
For a 60-person ISO 9001 shop with about 10 people who write or approve quality records, price 1factory first: it is the one published price here that covers NCR and CAPA in a single seat. All 13 QMS products we priced, with a 3-year view, are on QMS software pricing.
Getting every CAPA action done by its due date
The QMS holds the CAPA; someone still has to get the toolroom, maintenance and quality to do their part. Morsa reads CAPA-2026-031’s four actions, owners and dates from 1factory, ETQ, Business Central, JobBOSS2 or a shared spreadsheet. The quality manager approves the reminder once; after that, under that rule, Morsa asks each owner in Teams or email two days before their due date. That reminder is the only thing it sends without a person. When the toolroom lead replies with a photo of the new pins and the gauge reading, Morsa attaches it to the action. On 12 January it pulls the reject counts for 4410-B from the ERP and puts the closure in front of the quality manager to approve.
To see it on your own open CAPAs, book a 30-minute walkthrough.
What to do this week
List every open NCR and CAPA, with owner and age.
If you have an open finding, write its correction, root cause, action and evidence, and send it by the registrar’s date.
Write the six CAPA triggers and your thresholds into the procedure.
Add an effectiveness measure and check date to every CAPA that lacks one.
Sources
ISO 9001:2015 clause 10.2, Nonconformity and corrective action, as reproduced by Auditor Training Online (the standard itself is sold by ISO): https://blog.auditortrainingonline.com/blog/iso-9001-clause-10.2-nonconformity-and-corrective-action (read 8 November 2026)
GoAudits, Non-conformance report: https://goaudits.com/blog/non-conformance-report/ (read 8 November 2026)
QT9 Software, Nonconforming product (NCR): https://qt9software.com/glossary/nonconforming-product-ncr (read 8 November 2026)
1factory, Pricing: https://www.1factory.com/pricing.html (read 8 November 2026)
1factory, NCR, CAPA, SCAR and complaint software: https://1factory.com/ncr-capa-scar-complaint.html (read 8 November 2026)
DNV GL Business Assurance North America, ISO 9001 Top 10 Findings in 2019: Practical Actions for the Future, clause 10.2 slides: https://www.qualitydigest.com/pdfs/DNV-2019-ISO-9001-Top-10-Findings-03-03-20.pdf (read 8 November 2026)
Global Skill Development Council, 100 common non-conformities in ISO 9001:2015 audits, items 8 and 64: https://gsdcdata.gsdcouncil.org/gsdc/pdf/100-common-non-conformities-in-iso-90012015-audits.pdf (read 8 November 2026)
Schellman, What to do about an ISO-related nonconformity: https://www.schellman.com/blog/what-to-do-iso-related-nonconformity (read 8 November 2026)
isoTracker, How much does QMS software cost?: https://www.isotracker.com/blog/how-much-does-qms-software-cost/ (read 8 November 2026)
ISO 9001:2015 clause 8.7, Control of nonconforming outputs, as reproduced by Auditor Training Online: https://blog.auditortrainingonline.com/blog/iso-9001-clause-8.7-control-of-nonconforming-outputs (read 8 November 2026)
