What the clause requires
Clause 8.7 deals with the nonconforming product or service itself: the part outside tolerance, the contaminated batch, the badly performed service. The organization identifies and controls those outputs to prevent their unintended use or delivery, and takes appropriate action based on the nature of the nonconformity and on its effect on conformity of products and services. This applies equally to nonconforming outputs detected during or after the provision of the service, and to those detected after delivery of the product has already taken place, which is precisely when the decision becomes uncomfortable and when organizations are most tempted to resolve it informally instead of recording it.
The standard sets out how such outputs may be dealt with: by correction, meaning rework or repair; by segregation, containment, return or suspension of provision of products and services; by informing the customer; and by obtaining authorization for acceptance under concession. More than one of these can apply to the same case. After correction, conformity has to be verified again, which is the step most often skipped when the shop floor is under pressure to ship.
The documented information retained has to describe the nonconformity, the actions taken, any concessions obtained and, importantly, identify the authority deciding the action in respect of the nonconformity. That last element is what turns a scrap note into a controlled record, because it shows that somebody with the authority to make the call actually made it. Clause 8.7 deals with the product, clause 10.2 deals with the cause. A very common mistake is to handle the part properly under 8.7, scrapping or reworking it and closing the file, and then forget to evaluate whether action is needed to eliminate the cause so that the same output does not appear again next month.
What the auditor asks to see
- A defined area or identification for nonconforming product, such as a red tag or a quarantine cage
- Record of each nonconformity with the disposition that was decided for it
- Identification of the person or function who decided that disposition
- Re-inspection after rework, with the result recorded against the acceptance criteria
- Concessions authorized by the customer where the requirement came from the customer
Where companies most often get it wrong
- Rejected product left unidentified and mixed in with approved product
- Rework carried out and shipped with no re-inspection at all
- Concession decided internally when the requirement belonged to the customer
- Nonconformity handled only on the product, with no evaluation of the cause
Example of a nonconformity
- Requirement
- ISO 9001, 8.7.2: retain documented information that identifies the authority deciding the action in respect of the nonconformity.
- Evidence
- Nonconforming product records for May 2026: 9 of the 14 batches were reworked with no indication of who decided on the rework and with no record of the re-inspection that followed.
- Finding
- There is no identification of the authority deciding the disposition, and no verification after correction.
How to comply using PrismaBiz
Ready-made templates for this clause
Frequently asked questions
What is the difference between 8.7 and 10.2?
Clause 8.7 deals with the nonconforming product or service, meaning what to do with the item itself. Clause 10.2 deals with the cause, meaning what to do so it does not happen again.
What is a concession?
It is the authorization to use or release a product that does not conform to the specified requirements. It normally comes from the customer and is limited to a defined quantity, batch or period.
Does a nonconforming service fall under 8.7?
Yes. A service performed badly has to be identified, corrected or communicated to the customer, and the action taken has to be recorded in the same way as for a physical product.