An internal NCR and a supplier NCR are both nonconformance records, but they assign the problem to different parts of the value chain. An internal NCR is used when the nonconformance is created, detected, or controlled within your own operation. A supplier NCR is used when the nonconformance is attributed to a supplier-provided material, part, assembly, process, document, or service. The distinction matters because it affects containment, disposition authority, supplier communication, cost recovery, performance reporting, and corrective action ownership.
Internal NCR
An internal NCR typically applies when your own process produced or allowed the nonconformance. Examples include machining a feature out of tolerance, using the wrong revision of work instructions, damaging a part during handling, missing an in-process inspection step, or assembling a component incorrectly.
The normal ownership is internal: operations, quality, engineering, manufacturing engineering, maintenance, or another accountable function. Disposition may involve use-as-is, rework, repair, scrap, or return to a previous operation, depending on site procedures and customer or regulatory requirements. If the issue is significant or recurring, it may lead to CAPA or an internal RCCA process.
Supplier NCR
A supplier NCR applies when the nonconformance is believed to originate from the supplier’s product, process, documentation, packaging, labeling, certification, or service. It may be found at receiving inspection, source inspection, dock-to-stock verification, assembly, test, or even later in production if traceability supports supplier attribution.
Supplier NCRs often involve purchasing, supplier quality, receiving inspection, planning, and sometimes engineering. They may trigger supplier containment, replacement material, return material authorization, debit or chargeback activity, supplier corrective action requests, or supplier scorecard impacts. Those actions depend on contract terms, purchase order requirements, customer flow-downs, and the organization’s supplier quality process.
The boundary is evidence-based
The difference is not simply where the defect was found. A bad part discovered on your shop floor may still be a supplier NCR if the supplier caused the condition and the lot, serial, certificate, revision, and inspection evidence support that conclusion. Conversely, a defect found soon after receipt may still become an internal NCR if the part was damaged, modified, mishandled, or incorrectly processed after acceptance.
When the cause is unclear, many organizations open a nonconformance for containment first, then classify or reclassify it after investigation. That is usually safer than delaying segregation while teams debate ownership. The record should preserve the original detection point, suspected source, final attribution, and approval history.
Common system differences
In brownfield environments, the distinction often crosses several systems:
- QMS: usually owns the NCR workflow, MRB decisions, approvals, CAPA links, and audit trail.
- MES: may place work-in-process on hold, control rework steps, update digital travelers, and preserve operator or inspection evidence.
- ERP: often controls inventory status, purchase orders, returns, replacement demand, cost accounting, and supplier performance data.
- PLM: provides the governing engineering definition, revision, specification, and approved configuration.
- Supplier portals: may manage supplier response, SCAR workflow, evidence upload, and communication history.
Poor integration can create real failure modes: parts released from hold in one system but not another, supplier defects counted as internal scrap, internal process escapes charged to suppliers, missing lot traceability, incomplete MRB records, or corrective actions closed without objective evidence.
Why the distinction matters
The classification affects accountability and traceability. It influences who performs root cause analysis, who approves disposition, whether the supplier is formally notified, whether material can be returned or replaced, and how cost of poor quality is reported. It may also affect customer reporting where contracts or flow-down requirements specify notification, approval, or special handling.
It does not, by itself, prove liability or guarantee compliance. The record still needs adequate evidence, controlled disposition, validated workflow behavior where required, and appropriate change control. Site procedures, customer requirements, product criticality, and regulatory context determine the exact workflow.
Practical rule
Use an internal NCR when your organization owns the process failure. Use a supplier NCR when the supplied item or supplier-controlled activity is the nonconforming source. If the source is not yet proven, contain the material first, preserve traceability, and let the investigation determine final ownership.