How to write a non-conformance report that drives improvement

A non-conformance report (NCR) records a case where work, a product or a process didn't meet a requirement. To write one that drives improvement, describe what happened with facts, attach the evidence, find the root cause rather than the symptom, set corrective actions with a named owner and due date, and close the report only after you've checked the fix worked. An NCR that stops at "retrain the worker" rarely prevents the next one.

NCRs are most often used in quality management, but the same method works for health and safety. A missing scaffold tag, a skipped pre-start check and a SWMS step nobody followed are all non-conformances against a requirement.

What counts as a non-conformance?

A non-conformance is a failure to meet a requirement. The requirement might be a product specification, a procedure, a SWMS, a client's standard or a legal duty. ISO 9001 and ISO 45001 both require you to deal with non-conformities and take corrective action, so an NCR is the usual record for that.

Some examples from the worksite:

• A scaffold was used without its inspection tag.
• A crew started high-risk work without the SWMS being on site.
• A batch of concrete failed its slump test.
• A worker skipped the lock-out step on a switchboard.

An incident is an event that caused, or could have caused, harm. An NCR records the gap against a requirement. Some events are both, and the incident report and NCR should point to each other.

What to include in an NCR

The table below lists the fields a useful NCR needs and what a good entry looks like.

A non-conformance report template gives you these fields ready to fill in. A corrective and preventative actions register then tracks every action across all your reports.

1. Contain it first. Before you write anything, make the situation safe. Stop the work, quarantine the product or tag out the equipment. Record what you did, because the NCR needs to show that the risk was controlled straight away.

2. Describe the facts. Write what happened in the order it happened. Say who was involved, what was done, what was expected and where the gap is. Leave out opinions and blame. "The supervisor didn't care" is not a finding. "The tag was 21 days old and the register showed no inspection in that period" is.

3. Attach the evidence. A photo, a record or a copy of the procedure is worth more than a long description. Note the date and time each item was captured.

4. Find the root cause. Ask why until you reach a cause you can change. The 5 Whys method is the simplest way to do this:

• The scaffold was used without a tag. Why? The tag had expired.
• Why? Nobody inspected it in time.
• Why? The inspection was on a weekly list, and that list wasn't checked.
• Why? Nobody was named to check the list.
• Why? The handover from the previous supervisor didn't assign the task.

The root cause is the missing owner, not the untagged scaffold. Fixing the owner stops the next scaffold going untagged. For more complex problems, a fishbone diagram groups possible causes under headings such as people, methods, equipment, materials and environment.

5. Choose corrective and preventive actions. A corrective action fixes this instance. A preventive action stops the cause recurring. Where you can, choose actions higher up the hierarchy of controls. A redesigned process or a physical barrier is more reliable than a reminder in a toolbox talk.

6. Name an owner and a due date. Each action needs one person accountable for it. "The team" is not an owner. Set a due date that matches the risk. A safety issue needs a shorter timeframe than a documentation fix.

7. Verify and close. Check that the action worked, and record how you checked. Only close the NCR when the verification is done. If the issue comes back, reopen the NCR and look again at the root cause.

When an NCR shows a control isn't working

Sometimes an NCR reveals that a safety control has failed. Under regulation 38 of the model WHS Regulations, a control measure must be reviewed when it isn't working. Record that review in the NCR, including who reviewed it and what changed. If the control sits in a SWMS, update the SWMS as well.

Consult the workers who do the job before you change the control. Their consultation duty under section 47 of the WHS Act applies to changes that affect their safety, and they usually know what will and won't work in practice.

Common mistakes

Too many issues in one report. One NCR per problem keeps the root cause clear. Bundling three issues makes all three harder to fix.

Retraining as the only fix. Training matters, but it's the weakest control. Pair it with a change to the process, the equipment or the way the work is checked.

Closing before checking. An action marked "done" hasn't fixed anything until someone has seen it working.

No trend review. A single NCR is a fix. Ten NCRs about the same thing are a system problem. Review the register each month and look for repeats. Track the counts alongside your other measures, as described in our guide to health and safety KPIs.

Blame in the description. Naming a worker in the facts is fine. Writing that they were careless is not. It makes people hide the next problem.

How SafetyDocs helps

SafetyDocs includes non-conformance report forms and corrective action registers, so the actions from every NCR sit in one list with owners and due dates. Job, client and site details fill themselves in. Each job's activity log is a dated record of posts, photos, issues, and who read and signed what, so you can show what was found, when it was fixed and who checked it.

Common questions

Do I need an NCR for every problem? No. Use one for issues that break a requirement, repeat, or carry a safety risk. Minor fixes that are done on the spot can be noted in the daily log. Many NCRs come from audits, inspections and incidents.

Who should write the NCR? The person who found the problem drafts it, and the supervisor of the work reviews it. Root cause analysis should include the people who do the job, because they usually know what happened.

How long should an NCR stay open? Until the fix is verified. Set due dates by risk, and review every open NCR at each safety or quality meeting.

Is an NCR a legal requirement? The WHS laws don't set a form for NCRs. They do require you to review controls that aren't working, and an NCR is a practical way to show you did. Quality standards such as ISO 9001 and ISO 45001 expect a documented corrective action process.

This is general information, not legal advice. Check the current law with your WHS regulator.