NCR vs CAPA: the distinction matters
NCR (Non-Conformance Report) is the document that records that something failed - a part was out of tolerance, an audit found a deviation, a customer rejected a shipment. NCR captures what happened. It does not solve anything by itself.
CAPA (Corrective and Preventive Action) is the response. It contains the root-cause analysis (what allowed the failure to happen), the corrective action (what is being done to fix this instance), and the preventive action (what is being changed to ensure this does not happen again).
An NCR without a CAPA is a record of failure. A CAPA without an NCR is an unfocused improvement project. Both must exist together to satisfy IATF 16949 Clause 10.2 (Nonconformity and Corrective Action) and Clause 8.7 (Control of Nonconforming Outputs).
When to raise an NCR
IATF 16949 expects NCRs to be raised for, at minimum:
- Any production part out of specification (incoming, in-process, or final inspection failure).
- Customer complaint or rejected shipment.
- Internal audit finding.
- External audit finding (IATF surveillance, customer audit, third-party).
- Process deviation observed during production.
- Document control failure (out-of-date drawing on the shop floor, missing record).
- Calibration overdue or instrument out of accuracy.
- Training gap identified during operator monitoring.
The NCR document structure
A complete NCR contains:
- Unique NCR number (format: NCR-YYYY-NNNN or per organisation policy).
- Date raised and date discovered (these can differ - a defect found in a 3-month-old batch is dated differently).
- Part number, batch/lot number, quantity affected.
- Source of NCR - incoming, in-process, final, customer, audit.
- Description of non-conformance - specific, measurable, attached evidence.
- Specification or requirement - what was supposed to happen.
- Affected stock segregation - where the bad stock is held (red bin, quarantine area).
- Initial containment action - immediate action to prevent further damage (sort, hold, recall).
- Severity classification - critical/major/minor or per organisation policy.
- NCR raised by and NCR assigned to (the person responsible for resolution).
The CAPA process: 5 steps
Once an NCR is raised, the CAPA process kicks in:
- Step 1: Containment - prevent further customer impact. Sort, hold, recall, 100% inspect, customer-notify.
- Step 2: Root cause analysis - find the real cause, not the symptom. Use 5-why, fishbone, or 8D.
- Step 3: Corrective action - what is being done to fix the current instance.
- Step 4: Preventive action - what is being changed in the system (process, design, inspection, training) to prevent recurrence.
- Step 5: Verification of effectiveness - track whether the preventive action actually prevented recurrence over a defined period (usually 30-90 days).
5-Why analysis (the simplest root cause tool)
5-why is Toyota's root-cause analysis tool. The investigator asks 'why?' five times in sequence, each answer becoming the input for the next why.
Worked example - a customer rejected a shipment because of a wrong dimension on a brake bracket:
- Why was the dimension wrong? The CNC operator used the wrong tool offset.
- Why did the operator use the wrong tool offset? The setup sheet had the old tool offset value from before a tool change.
- Why was the setup sheet old? The tool change was logged in the maintenance system but not reflected in the production setup sheet.
- Why was the change not reflected? The maintenance system and production system are separate spreadsheets; manual sync only happens weekly.
- Why is sync manual and weekly? No automated link between the two systems.
Fishbone (Ishikawa) diagram
When the root cause is not obvious or could be multiple, a fishbone diagram brainstorms causes by category. The classical 6M categories:
- Man - operator skill, training, fatigue, motivation.
- Machine - condition, calibration, capability, tooling.
- Material - quality, specification, supplier.
- Method - process design, work instructions, parameters.
- Measurement - gauge accuracy, sampling, method.
- Mother Nature (environment) - temperature, humidity, vibration, lighting.
8D problem solving (for major customer issues)
When a Tier-1 customer raises a customer-complaint NCR (a serious one, often with line stoppage at the OEM plant), most OEMs require an 8D response. 8D is Ford's eight-step methodology:
- D0: Plan - emergency response.
- D1: Build the team - cross-functional, including customer if needed.
- D2: Describe the problem - quantified, specific.
- D3: Containment - stop the bleeding immediately.
- D4: Root cause analysis - find the real cause.
- D5: Permanent corrective actions - select and verify.
- D6: Implement and validate - deploy the corrective action.
- D7: Prevent recurrence - update systems, FMEAs, control plans.
- D8: Recognise the team - close out the report.
CAPA effectiveness verification
IATF 16949 Clause 10.2.6 requires verification that the preventive action was actually effective - not just implemented, but effective. This is the most-skipped step in Indian Tier-1 supplier CAPAs.
How to do it:
- Define a measurable success criterion at CAPA creation (e.g., 'recurrence rate for failure mode X drops to less than 1 per 6 months').
- Set a verification period (usually 90 days for medium-severity, 180 days for high-severity).
- After the period, check the metric. If improved, close the CAPA as effective. If not, re-open and re-investigate.
- Document the verification with data, not opinion.
How ERP automates NCR and CAPA
Spreadsheet-based NCR/CAPA management is the norm in many Indian SMEs and is also the most common source of IATF audit findings. The fixes are:
- Single source of truth: every NCR has a unique ID and lives in one system, not 5 Excel sheets.
- Workflow enforcement: NCR cannot close without containment, root cause, corrective, preventive, and verification fields completed.
- Linked to inspection data: NCR pulls measurement, batch, and operation data automatically from the QC module.
- Automated escalation: NCRs not actioned within SLA escalate to the next level.
- Recurrence tracking: system flags when the same failure mode recurs within the effectiveness verification window.
- Audit-ready reports: IATF auditor asks for last 12 months' NCR/CAPA log; system produces it in 30 seconds.
Frequently Asked Questions
What is the difference between NCR and CAPA?
NCR (Non-Conformance Report) is the document that records a failure - a part out of spec, an audit finding, a customer rejection. CAPA (Corrective and Preventive Action) is the structured response: root cause analysis, corrective action for the current instance, preventive action to stop recurrence, and effectiveness verification. NCR captures what happened; CAPA fixes it. IATF 16949 requires both to exist together.
What is the 5-why analysis?
5-why is Toyota's root-cause analysis tool. The investigator asks 'why?' five times in sequence, each answer becoming the input for the next why. By the fifth why, you typically reach a systemic cause rather than a symptom. The common mistake is stopping at 'operator error' - real root causes are systemic (process gaps, missing controls, system integration issues), not human error.
When is an 8D required instead of a regular CAPA?
8D is required for major customer complaints, typically when a Tier-1 OEM customer raises an NCR that caused line stoppage or major rejection at their plant. Most OEMs require an interim 8D within 24 hours and a final 8D within 14-21 days. 8D is a more structured methodology than regular CAPA, with team formation, formal problem description, and explicit recognition steps. The 8D form itself is the deliverable customers read.
What is the expected NCR rate for a mature quality system?
0.5-2% of production batches in a mature IATF 16949 quality system. Indian factories with fewer NCRs are typically under-raising, which IATF auditors flag as a red flag - no production system is perfect, and zero NCRs indicates discipline gaps in NCR raising rather than zero failures.
What does effectiveness verification mean in CAPA?
Effectiveness verification means measuring whether the preventive action actually prevented recurrence over a defined period (usually 30-90 days for medium severity, 180 days for high severity). IATF 16949 Clause 10.2.6 specifically requires effectiveness verification to be documented with data, not just claimed. CAPAs closed without verification are the most-skipped step and the most common Indian Tier-1 supplier audit finding.
Can CAPA be closed with 'training given to operator' as the action?
It can but it should not be the only action. Training alone rarely prevents recurrence because it does not change the underlying system that allowed the failure. Best practice is to require every CAPA to include a system-level change (process modification, inspection change, design change, or system integration) in addition to any training. SteelCraft Industries reduced CAPA recurrence by 47% in 8 months simply by making 'training-only' CAPAs non-acceptable.
What does IATF 16949 require for NCR/CAPA documentation?
IATF 16949 Clause 8.7 (Control of Nonconforming Outputs) requires documented control of non-conforming product. Clause 10.2 (Nonconformity and Corrective Action) requires: identification of the non-conformity, containment, root cause analysis, corrective action, preventive action, and effectiveness verification. All steps must be documented and the documentation must be retained for the period specified in the customer's contract or quality plan, typically 7-15 years.
Sources & References
This article cites the following primary sources. Click through for the official source documents: