ISO 9001 Clause 8.7 Checklist: Nonconforming Outputs

ISO 9001:2015 clause 8.7.1 requires an organization to "ensure that outputs that do not conform to their requirements are identified and controlled to prevent their unintended use or delivery." That single sentence is the whole clause in miniature. Everything else in 8.7 — segregation, disposition, concessions, records — exists to make that one outcome true: a bad part, a wrong document, or a defective service never quietly slips out the door.

Clause 8.7 is also one of the more frequently cited nonconformities in third-party audits, not because organizations don't understand it, but because it sits at the point where a written procedure meets an actual shop floor. This guide is a practitioner's checklist, organized clause line by clause line, so you can walk your own process against it before an auditor does.

What Counts as a Nonconforming Output

ISO 9000:2015 clause 3.6.9 defines a nonconformity as "non-fulfilment of a requirement." Clause 8.7 applies that definition to outputs, and the standard is deliberately broad about what an output is. It includes:

A manufactured product that fails a dimensional check
A service delivered outside its defined parameters — a late shipment against a contractual delivery window, or a test result generated on a miscalibrated instrument
A document released with an error that affects its intended use
Raw material or purchased product that fails incoming inspection under clause 8.4
Work-in-process discovered to be out of spec mid-production, not just at final inspection

Many organizations mentally narrow clause 8.7 to "scrap and rework on the shop floor." That reading misses half the clause. If your organization is service-based, read this checklist alongside how you've defined your production and service provision controls. Control-of-nonconforming-output findings show up as a recurring category in third-party audits across both product and service organizations.

The Clause 8.7 Checklist

Walk your process against each item below. If you can't point to where it lives — a form, a system flag, a physical tag — you have a gap.

1. Identification

[ ] Nonconforming outputs are visibly and unambiguously marked (tags, labels, system status flags, physical stamps) the moment nonconformity is detected
[ ] The identification method survives handling. A sticky note that falls off in transit is not identification
[ ] Personnel at every stage — receiving, in-process, final inspection, post-delivery — know how to flag a nonconformity in your specific system

2. Segregation and Isolation

[ ] Nonconforming material is physically separated from conforming material, or electronically quarantined if it's a digital output or record
[ ] Segregation areas ("MRB cage," "hold area," "quarantine bin") are defined, marked, and access-controlled
[ ] There's no path by which a nonconforming item can be picked, shipped, or used by accident while awaiting disposition

3. Disposition Decision

[ ] A defined authority — a named role, not "the supervisor on duty" — is assigned to decide disposition
[ ] The organization has a documented set of disposition categories: correction, use-as-is under concession, regrade, return to supplier, scrap
[ ] The decision-maker considers the effect on conformity of subsequent outputs, not just the immediate part

4. Correction and Verification

[ ] Corrected outputs are re-verified against the original requirement before release. Clause 8.7.1(a) calls for correction; re-verification is what makes a correction real rather than assumed
[ ] Rework instructions are documented whenever rework is anything beyond trivial

5. Concession / Use-As-Is

[ ] "Use as is" or "accept with deviation" decisions include a documented justification
[ ] When the requirement originates in a customer-owned drawing, specification, or contract, concessions are obtained from the customer, not just signed off internally
[ ] Concession authority is documented. Clause 8.7.2(d) requires you to record who had the authority to make the disposition decision

6. Post-Delivery Discovery

[ ] A defined process exists for nonconformity discovered after delivery, or during or after service provision — clause 8.7.1 explicitly covers both cases
[ ] Customer notification criteria are defined in advance, not improvised in the moment
[ ] Recall, containment, or field-action procedures exist if your product risk profile calls for them

7. Records (Documented Information)

[ ] You retain documented information describing the nonconformity (clause 8.7.2a)
[ ] You retain documented information describing the actions taken (8.7.2b)
[ ] You retain documented information describing any concessions obtained (8.7.2c)
[ ] You retain documented information identifying the authority that decided the action (8.7.2d)

The fourth item under Records — clause 8.7.2(d) — is the one I see missed most often. Organizations document what happened to the nonconforming part but not who had the authority to make that call. An auditor who pulls a nonconforming material record and finds no name or role tied to the disposition decision has grounds for a finding, even if the disposition itself was correct.

Disposition Routes Compared

Not every nonconforming output gets the same treatment, and picking the wrong route creates its own nonconformity. Here's how the standard disposition options compare on customer visibility and record burden.

Disposition	What It Means	Customer Notification Needed?	Record Burden	Best Used When
Correction / Rework	Output is reworked to meet the original requirement	No, if the requirement is fully met after rework	Moderate — rework instructions plus re-verification record	Defect is fixable without affecting form, fit, or function
Use-As-Is (Concession)	Output is accepted despite not meeting spec	Yes, if the deviated requirement is customer-owned	High — justification, concession authority, customer sign-off if applicable	Deviation has no functional or safety impact and is defensible
Regrade	Output is reclassified to a lower grade or different use	Depends on contract terms	Moderate	Output meets a different, lesser requirement than originally intended
Return to Supplier	Nonconformity traced to purchased product, returned per clause 8.4 controls	Not usually applicable to the end customer	Moderate — supplier corrective action record	Root cause is incoming material, not internal process
Scrap	Output is destroyed or permanently removed from use	Rarely, unless contractually obligated to report	Low	Rework isn't viable, or the risk of using it is unacceptable

The pattern worth remembering: the further a disposition deviates from the original requirement, the heavier the record and notification burden gets. That isn't bureaucracy for its own sake. It's the traceability an auditor, and later a root-cause investigation, will actually need.

Clause 8.7 vs. Clause 10.2: Where One Ends and the Other Begins

Clause 8.7 and clause 10.2 (nonconformity and corrective action) get confused constantly, and the confusion causes real audit findings. Clause 8.7 governs the immediate containment and disposition of a specific nonconforming output. It answers "what do we do with this part right now." Clause 10.2 governs the underlying cause, so the nonconformity doesn't recur.

A simple test keeps them separate in your own procedure. If the action stops at fixing or disposing of this one item, you're still in 8.7. The moment the question becomes why it happened and what changes to prevent recurrence, you've crossed into 10.2. That means a corrective action record, root cause analysis, and often an update to your risk register under clause 6.1. Our risk-based thinking implementation guide covers that link from 8.7 into your risk register in more depth.

Not every nonconforming output needs a corrective action. Clause 10.2.1 only requires you to evaluate the need for action to eliminate the cause. A one-off measurement error, caused by a miscalibrated gauge that gets recalibrated immediately, can close entirely inside clause 8.7. No separate corrective action record is required. Auditors are generally satisfied when your evaluation of that need is documented, even if the conclusion is "no further action warranted."

Auditing Clause 8.7 Internally

A clause 8.7 finding rarely surprises an organization that runs a rigorous internal audit program, because the gaps are visible the moment you pull actual nonconforming material records and trace them end to end. A useful audit doesn't stop at the log. It walks to the physical hold area or electronic quarantine and checks whether what's tagged in the system matches what's actually there. A mismatch between the log and the hold cage is one of the fastest ways to generate a finding, and certification body auditors check exactly this.

A practical internal audit trace for clause 8.7 looks like this:

Pull the nonconforming material log for the last quarter
Select five to ten entries at random, weighted toward anything with a "use as is" disposition
For each entry, confirm: identification tag existed, segregation location matches the log, disposition authority is named, and a re-verification record exists if the item was corrected, or a customer concession exists if the requirement was customer-owned
Confirm the item is no longer in the hold area if disposed of, or correctly located if still pending
Cross-check whether any entries should have triggered a clause 10.2 corrective action, and whether one exists

Step five catches organizations most often. Individually, each entry in a nonconforming material log can be well documented. It's only when an internal auditor lays five or ten of them side by side that a repeating pattern becomes visible — the same defect, the same supplier, the same shift — that nobody connected in real time.

If your internal audit program isn't already doing this kind of physical trace, it's worth revisiting how audits are scoped. Our internal audits page covers how to structure that.

Common Findings and How to Close Them

These are the findings I see repeated across organizations, roughly in order of frequency.

Missing disposition authority on the record. The fix is procedural, not cultural. Add a required field to your nonconforming material form or system, and don't let the record close without it.

Segregation area is a suggestion, not a control. Plenty of shop floors have a "hold" bin sitting three feet from the "ready to ship" bin, with no physical barrier and no access restriction. If a temporary employee can pick from either bin without knowing the difference, segregation isn't real, no matter what the procedure says.

No defined process for post-delivery nonconformity. Organizations plan meticulously for catching defects before shipment and have almost nothing written down for what happens when a customer calls to report one. Clause 8.7.1 covers both cases explicitly. Your procedure should too.

Concession decisions without customer sign-off on customer-owned requirements. If the specification came from the customer's drawing, purchase order, or contract, an internal-only "use as is" decision is a gap. It doesn't matter how well-reasoned the engineering judgment behind it was.

Rework verified against convenience criteria instead of the original requirement. A reworked part checked against "good enough to ship" rather than the actual original specification isn't verification. It's a checkbox standing in for one.

Every item on this list is closeable in a single corrective action cycle. None require new software or headcount. They require someone to sit down with the actual clause text and compare it, line by line, to what the organization currently does.

Final Word

Clause 8.7 rewards organizations that treat nonconforming material control as a live discipline rather than a form filled out after the fact. The standard doesn't ask for perfection. It asks for identification, containment, a documented decision by a named authority, and a record trail that lets you reconstruct what happened months later. Build your checklist around those four pillars, and the audit evidence takes care of itself.

For the adjacent clauses you'll want in the same binder, our downloadable ISO 9001 checklist covers the full standard alongside clause 8.7.

Frequently Asked Questions

What is a nonconforming output under ISO 9001? A nonconforming output is any product, service, or documented result that fails to meet a specified requirement, as defined by ISO 9000:2015 clause 3.6.9: "non-fulfilment of a requirement." Clause 8.7 covers nonconformity detected during production, before delivery, and after delivery or during service provision.

Does clause 8.7 require a documented procedure? The clause itself doesn't use the word "procedure," but it does require documented information under clause 8.7.2 describing the nonconformity, the action taken, any concessions obtained, and the authority that decided the action. Most organizations maintain a written procedure to keep that documentation consistent across shifts and personnel.

What's the difference between clause 8.7 and clause 10.2? Clause 8.7 governs immediate identification, containment, and disposition of a specific nonconforming output. Clause 10.2 governs evaluating and acting on the root cause so the nonconformity doesn't recur. A single nonconforming output can close entirely within clause 8.7 if the organization evaluates and documents that no further corrective action is needed.

Who has the authority to accept a nonconforming output as a concession? The standard doesn't name a specific role. It requires the organization to define and document that authority itself under clause 8.7.2(d). If the requirement being deviated from originates with the customer, obtaining the customer's own concession is generally necessary in addition to internal authorization.

What records does clause 8.7.2 require? Four categories: a description of the nonconformity, a description of the actions taken, a description of any concessions obtained, and identification of the authority that decided the action in respect of the nonconformity.

Last updated: 2026-08-18