Suppliers should provide objective, traceable evidence that shows the nonconformance was contained, investigated, dispositioned, corrected, and verified. The exact package depends on the customer contract, purchase order flowdowns, part criticality, regulatory context, and the supplier’s quality management system. A narrative response is rarely enough for an external NCR; the customer usually needs records that can be traced to parts, lots, serial numbers, processes, approvals, and dates.
An external NCR is not just a form to close. It is part of the customer’s quality record. Evidence should be specific enough for the customer to understand risk to delivered product, work in process, inventory, and future shipments without relying on assumptions.
Evidence normally expected
Common evidence includes:
- NCR acknowledgement and scope: the NCR number, affected part numbers, revisions, purchase orders, quantities, lot numbers, serial numbers, shipment dates, and current product location.
- Containment evidence: quarantine records, inventory checks, stop-ship actions, segregation labels, warehouse or WIP search results, and confirmation that suspect material was identified across relevant locations.
- Traceability records: shop travelers, routers, batch records, certificates of conformance, material certifications, inspection reports, test records, special process certifications, and sub-tier supplier records where relevant.
- Disposition evidence: documented disposition such as scrap, rework, repair, return, replace, or use-as-is, including required customer, MRB, engineering, or quality approvals. Use-as-is and repair dispositions often require explicit authorization, not supplier judgment alone.
- Correction evidence: records showing what was done to fix the specific nonconforming item or shipment, such as rework instructions, replacement shipment details, retest results, or final inspection records.
- Root cause analysis: a documented method such as 5 Why, fishbone, fault tree, or 8D, with evidence that the supplier considered both occurrence cause and escape cause. The analysis should distinguish a true root cause from a restatement of the defect.
- Corrective action evidence: updated procedures, revised work instructions, tooling changes, poka-yoke, training records, maintenance actions, inspection plan changes, supplier controls, or process parameter changes tied to the identified cause.
- Effectiveness verification: follow-up inspection results, audit results, process capability data, first-pass yield checks, repeat-defect monitoring, or a defined time-and-quantity window showing whether the action held.
- Calibration and personnel records, when relevant: gage calibration status, measurement system evidence, operator qualification, training records, or certification status if these factors could have contributed to the issue.
- Communication records: notices to the customer about suspect shipped product, shipment holds, recovery plan timing, and any agreed deviations or concessions.
What makes the evidence credible
Good evidence is tied to controlled records, not informal claims. It should include dates, signatures or electronic approvals, revision levels, system-generated identifiers, and links to the affected product or process step. Screenshots can help, but they should not be the only evidence if the underlying system record is required for traceability.
In regulated manufacturing, the customer may expect evidence from QMS, MES, ERP, PLM, inspection systems, supplier portals, calibration systems, and document control repositories. In brownfield environments, those systems are often not fully integrated. That does not remove the evidence obligation; it usually means the supplier must reconcile records carefully and preserve a clear chain of custody between systems.
Common failure modes
Weak NCR responses often fail because they provide activity instead of proof. Examples include stating that operators were retrained without attaching training records, claiming inventory was checked without listing lots and locations, or identifying “operator error” without explaining why the process allowed the error and why inspection did not detect it.
Another common failure is closing the response around the immediate defect while ignoring systemic risk. If the same process, tool, supplier, material lot, program, or inspection method was used elsewhere, the customer may reasonably ask how the supplier ruled out broader exposure.
Limits and data controls
Suppliers should not send unrestricted technical data, export-controlled information, customer-proprietary data, or sub-tier records unless the contract, portal, and access controls allow it. In aerospace and defense contexts, ITAR, DFARS, customer confidentiality terms, and supplier flowdowns may limit how evidence is transmitted and who may view it.
Where records cannot be shared in full, the supplier should say so plainly and provide an acceptable alternative, such as redacted records, controlled portal access, a certificate summary, or customer-witnessed review. That workaround should be agreed with the customer; it should not be used to avoid objective evidence.
Bottom line
The supplier’s evidence package should let the customer answer three practical questions: what product is at risk, what has been done to control that risk, and what prevents recurrence. The level of detail should scale with severity, customer requirements, product criticality, and recurrence history. An external NCR can be closed only when the required parties accept the evidence; the supplier should not assume that a completed form is sufficient.