NCR vs CAPA: What's the Difference?

An NCR (non-conformance report) records that something did not meet a requirement: a part out of tolerance, a procedure skipped, a missing record. A CAPA (corrective and preventive action) is the structured action you take to remove the cause of a problem so it does not happen again. The NCR captures the fact that something went wrong. The CAPA is how you stop it recurring.

If you only remember one thing: an NCR is the record of a problem, a CAPA is the action to fix its cause. An NCR often triggers a CAPA, but not every NCR needs one.

The quick comparison

	NCR	CAPA
What it is	A record that something did not meet requirement	Action to remove the cause and prevent recurrence
Question it answers	What went wrong, and what did we do with the affected item?	Why did it happen, and how do we stop it returning?
Focus	The specific non-conforming item or event	The underlying cause across the process
Typical scope	One part, batch, document or event	The process, system or behaviour behind it
Closes when	The affected item is dispositioned (use, rework, scrap, concession)	The cause is fixed and the fix is verified as effective
Always needed?	Yes, whenever a non-conformity occurs	No, only when the cause warrants systemic action

What an NCR actually does

An NCR is the immediate, factual record of a non-conformity. A goods-inwards inspector measures a shaft and it is outside drawing tolerance. A machine setter notices a batch was run against a superseded work instruction. An auditor finds a calibration certificate has expired. Each of these is a non-conformity, and each gets logged on an NCR.

The NCR does two jobs. It describes the problem clearly (what the requirement was, what was actually found, where and on which item), and it drives a disposition decision for the affected material. That disposition is usually one of: use as is with a documented concession, rework to bring it back into specification, regrade to a different use, or scrap. Until that decision is recorded, the non-conforming item should be quarantined so it cannot be used by mistake.

An NCR is about the thing in front of you. It contains the damage. It does not, on its own, ask why the problem happened or whether it will happen again.

What a CAPA actually does

A CAPA goes after the cause. Where the NCR asks "what do we do with this part?", the CAPA asks "why did this happen, and what change stops it returning?"

The corrective part deals with a problem that has already occurred: investigate the root cause, put a fix in place, and verify the fix worked. The preventive part deals with a problem that has not happened yet but could: you spot a weakness, a trend, or a near miss, and act before it turns into a non-conformity. Both halves share the same discipline. Find the cause, change something real, check the change held.

A good CAPA is more than "we told the operator to be more careful." It identifies why the error was possible at all, changes the process, documentation, tooling or training, and then confirms with evidence that the cause is gone. That verification step is what separates a real CAPA from a closed ticket.

How they fit together

The relationship is sequential but not automatic. A non-conformity is found and an NCR is raised. The affected item is quarantined and dispositioned. Then someone decides whether the cause needs a CAPA.

That decision is a judgement call, and it should be. A one-off slip with an obvious, contained cause may need nothing beyond the NCR and its disposition. A non-conformity that is serious, recurring, or rooted in a process weakness usually does warrant a CAPA. Raising a CAPA for every minor NCR buries your quality team in paperwork; raising none lets the same defect come back next month. A practical filter: open a CAPA when the problem is significant, recurring, or clearly sits in the process rather than a single isolated event. Otherwise, disposition the item, record the rationale, and move on.

Where ISO 9001 fits

ISO 9001 is the framing most UK manufacturers run these workflows against. The standard's clause on nonconformity and corrective action sets out the expectation in plain terms: when a non-conformity occurs you must react to it and deal with the consequences, then evaluate whether action is needed to eliminate the cause so that it does not recur or happen elsewhere. If it is, you take that action, review whether it was effective, and keep records of both the non-conformity and what you did about it.

Notice what the standard does and does not say. It does not use the word "CAPA," and it does not force you to open a corrective action for every single non-conformity. It asks you to evaluate the need. That evaluation is exactly the NCR-to-CAPA decision above. The standard also expects documented evidence: the record of the non-conformity, the action taken, and the outcome of any corrective action. In everyday language, that evidence is your NCR and CAPA records.

One point worth getting right: ISO 9001 names corrective action, not "preventive action," as a clause. It folds prevention into its risk-based thinking rather than a separate preventive-action procedure. Most teams still use the "CAPA" label because it is well understood, but the formal clause your auditor checks is the one on nonconformity and corrective action.

The typical workflow

On a working shop floor the sequence runs like this. Someone identifies a non-conformity and raises an NCR. The affected item is quarantined. A reviewer decides the disposition (use, rework, regrade or scrap) and records it. The team then evaluates whether the cause needs a CAPA; if it does, the root cause is investigated, an action is implemented, and the action is verified as effective before the CAPA closes. The NCR closes when the item is dispositioned; the CAPA closes when the cause is fixed and proven fixed.

This only works if the records are current, findable and trusted. The drift that affects every other quality document affects NCRs and CAPAs too: an investigation references a procedure that has since changed, or a recurring defect is never spotted because nobody can search across past NCRs. For the document-control discipline underneath all of this, see our guide to ISO 9001 document control, and for how task-level and process-level documents relate, work instruction vs SOP.

How Promptable helps

Promptable's compliance module runs the NCR and CAPA workflow against the documents you already have. It scans your procedures and records against your controls, so when a non-conformity is raised, the related requirements, SOPs and past records surface automatically instead of being hunted down by hand. A CAPA investigation starts with the relevant evidence already in front of you, and a corrective action that changes a document is linked back to the control it satisfies, so the audit trail stays intact. Recurring patterns across past NCRs become visible rather than buried in a spreadsheet.

If your quality records live across SharePoint, drives and people's memories, see what Promptable does with the documents you already have.

Frequently asked questions

Does every NCR need a CAPA?

No. Every non-conformity needs an NCR and a disposition decision, but a CAPA is only opened when the cause warrants systemic action: when the problem is serious, recurring, or rooted in the process rather than a one-off event.

What is the difference between correction and corrective action?

A correction fixes the immediate problem, for example reworking or scrapping the affected part. Corrective action goes further and removes the cause so the problem does not recur. The NCR disposition is the correction; the CAPA is the corrective action.

Is CAPA required by ISO 9001?

ISO 9001 requires corrective action where a non-conformity's cause needs eliminating, and it requires you to keep records of the non-conformity and the action taken. It does not use the term "CAPA" or mandate a preventive-action procedure; prevention is handled through risk-based thinking. Most firms still use the CAPA label as shorthand.

Who raises an NCR?

Anyone who finds a non-conformity: an inspector, an operator, an auditor, or a customer complaint that feeds back into your system. The point is to capture it quickly and accurately so the affected item can be controlled. For more on the terms used here, see the glossary.