.avif)
Nonconformance Reports in Food Manufacturing (Free Template)
A nonconformance report records that something did not meet a requirement, what happened to the affected product, and what was done so it does not happen again.
Search for an NCR template and you will find plenty. Almost all of them are built for medical devices, aerospace or construction, anchored to 21 CFR Part 820 or ISO 13485. Download one into a food plant and you will notice what is missing within about five minutes: there is nowhere to write the lot number.
That omission is not cosmetic. In food manufacturing the lot number determines how much product you have to account for, and an NCR without it is close to useless the moment an issue escalates.
This guide covers what a food manufacturing NCR needs to capture, how disposition and hold decisions work, how NCRs connect to your HACCP plan, and what 21 CFR Part 117 actually expects.
Download the Nonconformance Report Template
We have built a free Excel NCR template specifically for food and beverage manufacturers.
It has nine blocks covering identification, product and lot details, the nonconformance itself, immediate containment, risk assessment, disposition, root cause, corrective action, and verified closure. Lot number, production date and traceability lot code are flagged as Key Data Elements under FSMA 204.
It also includes an NCR log for tracking trends across a period, a disposition reference tab, and a fully worked allergen labeling example carried from detection through to closure.
What Is a Nonconformance Report?
A nonconformance report is the record created when a product, process, material or document fails to meet a defined requirement. It documents what was found, what happened to the affected product, why it happened, and what changed as a result.
The requirement can come from anywhere: a product specification, an SOP, your food safety plan, a customer agreement or a regulation. What makes something a nonconformance is the gap between a defined requirement and what actually happened.
What Counts as a Nonconformance in a Food Plant
Common triggers include product out of specification, a process deviation such as a missed temperature check, an allergen control failure, foreign material, a labeling error, a positive environmental or product test, a sanitation failure at pre-operational inspection, incoming material off specification, and equipment found out of calibration.
The last one catches people out. If a thermometer is found out of calibration, every reading since the last good check is in question, and the nonconformance covers all of that product rather than just the instrument.
NCR vs Corrective Action vs CAPA
These three get used interchangeably, which causes confusion in audits and in software selection.
| Term | What it is | When it is raised | What closes it |
|---|---|---|---|
| Nonconformance report | The record that a requirement was not met, and what happened to the affected product | At the moment of detection | Verified corrective action plus a recorded product disposition |
| Corrective action | The change made so the same nonconformance does not recur | After root cause analysis on an NCR | Evidence the change was implemented and effective |
| CAPA | A broader corrective and preventive action programme, used mainly in pharmaceutical and medical device quality systems | Often triggered by trends across records | Programme-level review and effectiveness check |
Raising an NCR is not the same as fixing the problem. The NCR is the container. The corrective action is the fix. Our guide to building a corrective action plan covers the distinction between a correction, which deals with this occurrence, and a corrective action, which prevents the next one.
What a Food Manufacturing NCR Must Capture
The field set is where generic templates fail food manufacturers.
| Field | Why it exists |
|---|---|
| NCR number and date raised | Traceable reference, and the start of the clock on closure |
| Site, line or station, shift | Lets you see patterns by location and shift in the log |
| Product name and code | Identifies what is affected |
| Lot or batch number | Determines recall scope; the single most important field |
| Production date and traceability lot code | Key Data Elements under FSMA 204 |
| Quantity affected and unit of measure | Scales the decision and the cost |
| Current physical location | Tells you whether you still control the product |
| Has any product shipped | Changes the decision from disposition to notification |
| Category and severity | Drives escalation and makes the log analysable |
| Description of the nonconformance | What was observed, not what caused it |
| Requirement not met | The specific limit or procedure step breached |
| Detection point and detected by | Shows which control caught it, and which did not |
| Bracketing assessment | What was made before and after, and has it been checked |
Lot and Batch Identification
This field decides everything downstream. Without it you cannot determine how much product is implicated, you cannot trace forward to customers, and you cannot trace back to incoming materials.
Record it at the moment the NCR is raised, not later from memory. Our guides to lot codes and food traceability cover how lot identification should work across your operation.
Quantity Affected and Where It Physically Is
"480 cases" is useful. "480 cases in warehouse hold cage H-2" is actionable.
Product that is still moving while you investigate is the problem getting larger. Recording the physical location forces the question of whether containment has actually happened.
The Requirement That Was Not Met
Write the specific requirement, with its document reference. "Product was out of spec" tells a reviewer nothing. "Water activity 0.88 against specification limit of 0.85 maximum, SPEC-FG-0220 rev 3" tells them everything.
Detection Point
Where the nonconformance was caught matters as much as what it was. Something caught at receiving inspection is a supplier issue contained early. The same issue caught at pre-shipment means every control in between missed it, and that is a separate finding worth investigating.
Product Disposition and the Hold Decision
Disposition is the decision about what physically happens to the affected product, and it is where auditors concentrate.
| Disposition | When it applies | What must be recorded |
|---|---|---|
| Release As Is | The nonconformance does not affect safety, legality or the customer specification | A written justification supported by data or a documented assessment |
| Rework | Product can be brought back into specification by a defined process | Rework instruction reference, quantity, supervisor, post-rework verification |
| Regrade or downgrade | Safe and legal but does not meet the original specification | New grade, intended channel, confirmation labeling matches |
| Return to supplier | Originated with incoming material and the supplier accepts return | Supplier reference, quantity, linked supplier corrective action |
| Destroy | Unsafe, illegal, or cannot be brought into specification | Quantity, method, date, witness signature |
| Hold pending further information | Assessment incomplete, waiting on a result or response | What is awaited, who owns it, and the review date |
Release As Is needs the strongest justification of the six. It is the option most often cited at audit, because it is the one where a commercial pressure and a quality decision meet.
Placing and Releasing a Hold
A hold has to be physical as well as administrative. A status flag in a system that nobody checks before picking is not containment.
Record who applied the hold, when, where the product went, and the hold reference. Release from hold should require a named approver and a recorded reason, and should never happen as a side effect of closing the NCR.
The bracketing assessment belongs here too. If a metal detector failed its test at 14:00 and last passed at 12:00, everything made in those two hours is implicated, not just the pack that triggered the check.
When a Nonconformance Becomes a Recall Decision
Certain triggers escalate immediately: affected product has already shipped, an undeclared allergen is involved, a pathogen is found in ready-to-eat product, foreign material with injury potential has been distributed, or a regulatory limit was exceeded.
Once product has left your control, the decision shifts from disposition to notification and retrieval. Our guides to running a mock recall and building a recall plan cover how to make that decision quickly rather than discovering your traceability gaps during a live event.
The NCR Workflow End to End
Detect, contain, record, assess risk, decide disposition, investigate root cause, implement corrective action, verify effectiveness, close.
Containment comes before investigation. This is the step most often done out of order, usually because the person who found the issue wants to understand it before escalating.
Who Raises, Who Approves, Who Closes
Anyone should be able to raise an NCR. Restricting that to QA guarantees problems found on the floor at 2am get mentioned verbally and forgotten.
Disposition approval should sit with QA management, with a second approver for Release As Is and anything rated critical. Closure should require someone other than the corrective action owner to confirm effectiveness, because self-verification is not verification.
Timeliness
Set expectations by severity. Critical nonconformances need containment within the shift. Minor ones can follow a longer path. What you do not want is an NCR sitting open for four months because nobody owned the verification step, which is exactly what the log tab in the template is designed to surface.
A Worked Example
During pre-shipment label verification, a QA technician finds 480 cases of almond granola packed in film pre-printed for a maple oat variant. The maple oat film does not declare almonds. The product inside contains them.
Containment happens first. The line stops, all 480 cases move to a hold cage and are tagged, remaining film is quarantined and the film store is checked for further mislabeled reels. The bracketing assessment confirms the previous run used correct film, verified against the start-up label check, so only this run is affected. Nothing has shipped.
The risk assessment rates food safety risk as high. An undeclared major allergen in a product whose label gives no warning is serious regardless of quantity, and it stays high even though the product never left the site.
Disposition is rework. The product itself conforms; only the outer film is wrong. Relabeling under QA supervision restores a compliant product. Destroy was considered and rejected as disproportionate, and that reasoning is recorded rather than left implicit.
Root cause analysis using five whys finds that the film changeover step required the operator to confirm the reel code but had no independent verification before restart. A single misread therefore went undetected until pre-shipment. Corrective action adds a second-person label check at every changeover, recorded before the line restarts, plus a staging rule limiting the line to one product's reels at a time.
Verification reviews thirty days of changeover records and observes two live changeovers before closure. That is what closing an NCR properly looks like.
How NCRs Connect to Your HACCP Plan
A deviation at a critical control point should generate an NCR automatically. In a lot of plants it does not, because CCP monitoring lives on one form and nonconformances live on another, and the link depends on someone remembering to make it.
When a critical limit is breached, three things have to happen: the affected product is identified and controlled, a corrective action is taken and recorded, and the deviation is documented. That is an NCR in everything but name. Treating it as a separate process creates two partial records instead of one complete one.
The same applies to OPRP failures, positive environmental monitoring results and failed pre-operational inspections. Our guides to critical control points, HACCP plans and hazard analysis cover how the monitoring side should be structured.
This is the specific gap Allera was built to close. Digital Forms carry your failure rules inside the form, so when a monitoring entry breaches a limit, the submission is flagged and a Corrective Action follow-up task is created and assigned automatically. Submissions export as PDFs when an auditor asks. See the food quality management software page.
Supplier Nonconformances
When the nonconformance originates with incoming material, the path splits. You still need an internal NCR covering the material you received and what happened to it, and you need a separate request to the supplier for their investigation and corrective action.
Keeping these linked but distinct matters. Your NCR closes when your product is dispositioned and your internal controls are verified. The supplier's corrective action may take considerably longer, and holding your NCR open while you wait distorts your metrics.
Our guide to the supplier corrective action request covers the supplier-facing side, and receiving inspection covers catching these issues at the gate.
What Regulators and Schemes Expect
This is where food manufacturers are poorly served by the generic guidance available.
21 CFR Part 117 is your regulation, not 21 CFR Part 820. Subpart C requires corrective action procedures for when a preventive control is not properly implemented, covering identifying and correcting the problem, reducing the likelihood of recurrence, evaluating affected food for safety, and preventing adulterated food from entering commerce. Subpart F covers the record requirements.
Those four elements map directly onto the containment, root cause, risk assessment and disposition blocks of a well-built NCR.
SQF, BRCGS and FSSC 22000
SQF Edition 10 requires documented procedures for handling nonconforming product, including identification, segregation, disposition and records, with responsibility and authority defined.
BRCGS Issue 9 requires procedures for managing nonconforming product covering identification, recording, quarantine and disposition, with clear authority for decisions. FSSC 22000 Version 7 follows ISO 22000 in requiring control of nonconformity, correction and corrective action, with evaluation of effectiveness.
All three expect the same chain: identify, contain, assess, disposition with justification, investigate cause, act, verify, record. Our comparison of GFSI, SQF and BRCGS covers the structural differences, and NCR records are among the first things reviewed during a food safety internal audit.
Common Mistakes That Weaken an NCR
Describing the suspected cause instead of the observation. Block 3 should record what was found. Writing a theory there biases the root cause analysis before it starts.
Leaving the lot number blank. Without it, the record cannot support a traceability exercise or a recall decision.
Recording a disposition with no justification. Release As Is with no written reasoning is among the most commonly cited findings against nonconformance records.
Skipping the bracketing assessment. It is the difference between holding one pallet and holding two hours of production.
Closing when the corrective action is implemented rather than when it is verified. Implementation is not effectiveness.
Treating each minor NCR in isolation. Three minor nonconformances on the same line in a month is a pattern, and only a log makes it visible. Our guides to quality assurance in the food industry and document control procedure cover the systems around this, and batch record template covers where production records should link in.
Bringing It Together
An NCR is only as useful as the fields it captures and the discipline behind closing it. For a food manufacturer that means the lot number, the quantity and its physical location, a bracketing assessment, and a disposition with a written justification.
Generic templates miss most of that because they were written for industries where product is serialised rather than batched. Start from a form built for food, anchor it to 21 CFR Part 117, and do not close anything until verification confirms the fix worked.
Download the template above, and if your deviations get recorded on one form while the follow-up lives elsewhere, see how Allera's food quality management software creates the Corrective Action automatically when a monitoring rule fails.
FAQs
How do you close a nonconformance report?
Close it once the affected product has been dispositioned, the root cause identified, the corrective action implemented, and verification confirms the action was effective.
Implementation is not effectiveness. Closing when the change was made rather than when it was verified is one of the most common weaknesses in nonconformance records.
What information must an NCR contain?
At minimum: a unique reference and date, product and lot identification, quantity affected and its physical location, a description of what was found, the requirement not met, detection point, containment action, risk assessment, disposition with justification, root cause, corrective action, and verification of effectiveness.
The lot or batch number is the single most important field in a food plant. It determines how much product you have to account for if the issue escalates.
What is the difference between an NCR and a CAPA?
An NCR records a specific instance of something not meeting a requirement, and what happened to the affected product.
CAPA is a broader programme, most common in pharmaceutical and medical device quality systems, that manages corrective and preventive actions across the organisation and is often driven by trends rather than single events.
What are some examples of non-conformance reports?
In a food plant, common examples include finished product out of specification, a missed temperature check at a critical control point, an allergen labeling error caught at pre-shipment, foreign material found in product, a failed pre-operational sanitation inspection, and incoming material that does not meet specification.
Equipment found out of calibration is another, and it is often underestimated. Every reading taken since the last good check is in question, so the nonconformance covers all of that product rather than just the instrument.
Who is responsible for an NCR report?
Anyone who identifies a nonconformance should be able to raise one, including operators and supervisors. Restricting who can raise an NCR reliably reduces how many get raised, not how many occur.
QA typically owns the investigation, the disposition decision and closure. Closure should be verified by someone other than the person who implemented the corrective action.
How do you fix a non-conformance?
Two things have to happen, and they are often confused. The correction deals with the affected product through a disposition decision. The corrective action changes something so the same nonconformance does not recur.
Work in order: contain the product, assess the risk, decide disposition with a written justification, investigate root cause, implement the corrective action, then verify it was effective before closing.
What does nonconformance mean?
A nonconformance is any instance where a product, process, material or document fails to meet a defined requirement.
The requirement can come from a product specification, an SOP, your food safety plan, a customer agreement or a regulation. What makes something a nonconformance is the gap between a defined requirement and what actually happened.
.avif)
.avif)
.avif)
.avif)
%20(1).avif)
.avif)
.avif)
%20(1).png)
.avif)
.avif)
