CAPA & Deviations
Explore this topic in more depth to build a complete picture of your quality and compliance operations.
Explore
Glossary Term
Nonconformance
A requirement not met — and how it differs from a deviation.
Nonconformance and deviation get used interchangeably and mean different things. Getting the distinction right is the difference between a clean investigation and a confused one.
On this page
What a nonconformance is
A nonconformance (or nonconformity) is the non-fulfilment of a requirement — a product, material, process, or record that does not meet its specification, procedure, or regulatory expectation. The classic case is nonconforming material: a component, in-process material, or finished unit that fails a spec and must be dispositioned (use-as-is, rework, repair, scrap, return).
In device GMP it is anchored in 21 CFR 820.90 (control of nonconforming product) and ISO 13485 §8.3; the FDA QMSR carries the same expectation through the ISO clause. The defining features are consistent: identify it against the specific requirement it failed, segregate it so it can't be used unintentionally, document the disposition decision with justification, and decide whether a CAPA is warranted for the underlying cause.
The term sits within a family of overlapping concepts — deviation, nonconformance, defect, out-of-specification, quality event — that different quality systems slice differently. What matters is not the label but that your QMS defines the boundaries clearly and routes each event type consistently, because the routing determines the rigour applied.
Nonconformance vs deviation
A deviation is a departure from an approved procedure or process — often caught as it happens, and the dominant term in pharma GMP. A nonconformance is a requirement not met, classically about product or material against a spec — the ISO and device-industry vocabulary. They overlap heavily, the terms blur in practice, and the healthy answer is that your QMS defines which is which and applies the right process to each — not that you pick the 'correct' word.
Why the distinction is worth getting right
Mislabelling drives bad routing, and bad routing is where quality systems leak. Call a genuine process deviation a 'nonconformance' and you may skip the root-cause investigation it needed, treating a systemic problem as a one-off material disposition. Treat every nonconforming unit as a full deviation investigation and you bury the quality unit in process, slowing release and breeding shortcuts. Inspectors notice both patterns.
Control of nonconforming product (820.90) and review/disposition decisions are recurring inspection topics, and the findings cluster around predictable gaps: nonconforming material not segregated, so it risks unintended use; use-as-is dispositions granted without adequate justification or the right authority; rework performed without a procedure or without re-inspection; and — the systemic one — repeated nonconformities of the same type never escalated to a CAPA, so the cause is never addressed and the disposition treadmill runs forever.
The healthy pattern is a defined intake that classifies the event, applies proportionate rigour, records the disposition with justification and the approving authority, and escalates to CAPA when the cause — not just the instance — needs systemic action. Trend analysis across nonconformities is itself an expectation: a string of individually-dispositioned events that are never read together is a missed signal.
Where the requirements live
- 21 CFR 820.90 — control of nonconforming product: identification, documentation, evaluation, segregation, and disposition (carried into the QMSR via ISO 13485)
- ISO 13485 §8.3 — control of nonconforming product, including actions before and after delivery, rework, and concessions
- 21 CFR 211.192 — for drug products, review of any unexplained discrepancy or batch/component failure to meet specifications
- EU GMP Chapter 5 / Chapter 8 — production controls and handling of complaints, quality defects, and recalls
- ISO 9001 §8.7 — control of nonconforming outputs, for quality systems outside the device-specific frameworks
- ICH Q10 — the pharmaceutical quality system context in which nonconformity handling and CAPA operate
From detection to disposition
A workable nonconformance flow runs from detection to closure with a record at every step:
Detect and describe. Capture the nonconformity against the specific requirement it failed — not a vague “material rejected,” but which spec, which limit, what was observed. Vague descriptions undermine every downstream decision.
Segregate. Flag or physically separate the affected material or record so it cannot be used or shipped unintentionally while under evaluation. Segregation is a control, not a formality — unsegregated nonconforming product is a top finding.
Assess impact. One unit, a batch, or a trend? Does it affect other lots, products, or sites that share the cause? The impact assessment scopes the response.
Disposition with justification. Use-as-is (with a documented concession and the right authority), rework (to a procedure, with re-inspection), repair, scrap, or return. Record the decision, the rationale, and who approved it.
Decide on CAPA. Determine whether the underlying cause needs systemic correction or prevention. A correctly-dispositioned one-off may not; a recurring or systemic nonconformance should escalate, with the judgement documented either way. And periodically, trend the nonconformities to surface the patterns single events hide.
What strong nonconformance handling shares
Programs that handle nonconformities cleanly — and pass inspection on 820.90 / §8.3 — share these controls:
The disposition that should have been a CAPA
The most expensive nonconformance pattern is the one handled perfectly, every time, forever — each instance correctly identified, segregated, and dispositioned, but never escalated to address why it keeps happening. Inspectors read the trend the quality unit didn't. Defined escalation criteria, plus a periodic trend review, are what turn a disposition treadmill into a closed loop.
- Defined intake and classification — clear boundaries between deviation, nonconformance, OOS, and complaint, with consistent routing
- Enforced segregation — nonconforming material flagged or separated so unintended use is prevented, not just discouraged
- Requirement-specific descriptions — every nonconformity stated against the spec or procedure it failed
- Authority-gated dispositions — use-as-is and concessions require the right role to approve, with justification
- Procedure-controlled rework — rework to a defined procedure with re-inspection and records
- CAPA escalation criteria — defined rules for when an instance becomes a systemic action
- Trend analysis — nonconformities read together on a cadence, not only handled one at a time
- Full traceability — each event linked to its material/batch, its disposition, and any resulting CAPA
How Complere handles nonconformities
Complere captures nonconformities as governed quality events in CAPA & Deviations, with the intake, disposition, and escalation discipline the regulations expect — and whether your QMS calls a given event a deviation or a nonconformance, the controlled workflow and the evidence trail are the same.
Events are classified at intake so the right level of rigour applies; the disposition decision — use-as-is, rework, scrap, return — is recorded with its justification and routed for the appropriate authority's approval, so the “who approved this concession and why” question has a clean answer. Each event is linked to its material or batch context and to any resulting CAPA, giving the end-to-end traceability from the nonconformity to the systemic action. Root-cause investigation uses structured tools, and escalation to CAPA follows your defined criteria, captured as a deliberate, documented decision rather than an afterthought. Because the events are connected records rather than scattered forms, trend analysis across nonconformities — the signal single dispositions hide — becomes a query rather than a manual collation exercise.
Every step carries the platform's audit trail, so the disposition history, the approvals, and the CAPA linkage are attributable, time-stamped, and retrievable. What stays with your team is the quality judgement — the disposition decisions, the classification boundaries your QMS defines, and the escalation calls; Complere makes the workflow governed and the trend visible.
Frequently asked questions
Common questions about Nonconformance sourced from regulatory references and inspection patterns.
What is the difference between a nonconformance and a deviation?
A deviation is a departure from an approved procedure or process - often the pharma-GMP term, caught as it happens. A nonconformance is a requirement not met, classically about product or material failing a specification - the ISO/device term. They overlap; what matters is that your QMS defines which is which and routes each consistently.
Where is nonconforming product control required?
In device GMP, 21 CFR 820.90 (control of nonconforming product) and ISO 13485 section 8.3, carried into the FDA QMSR. The expectation: identify it, segregate it so it cannot be used unintentionally, document the disposition decision, and decide whether a CAPA is warranted.
What dispositions apply to nonconforming material?
Typically use-as-is (with justification, often via a concession), rework, repair, scrap, or return to supplier - each recorded with the rationale and the approving authority. The decision and its justification are the inspectable record.
When does a nonconformance become a CAPA?
When the underlying cause - not just the single instance - needs systemic correction or prevention. A one-off correctly dispositioned may not need a CAPA; a recurring or systemic nonconformance should escalate to one. The judgement and its basis should be documented either way.
Continue Exploring
Explore related topics, modules, and compliance resources for a deeper understanding of your quality system.
See nonconformance handled in a governed workflow
Walk through the modules and workflows that address this area inside a controlled, validation-ready quality system.