Learn how to make defensible nonconformance disposition decisions, define approval authority, manage customer concessions, and recognize when repeated dispositions signal a larger quality problem.
"Use as-is" should never mean "someone decided it was probably fine." It can be right when justified by evidence, approved by the right authority, and cleared with required customer or design reviewers.
FAA Airworthiness Directive 2026-18-08 offers a recent example. It covers certain Boeing 767-300F airplanes with titanium cargo-track crown fittings that had suspect material certifications.
That leads to a practical QMS question: when something does not conform, who gets to decide what happens next?
An NCR that says only "requirement not met" leaves product status unresolved. Identify and contain affected output, then consider the requirement, technical impact, risk, customer and contract terms, regulation, design authority, traceability, and downstream exposure.
Responses can include correction, rework, repair, return or rejection, containment, concession, use-as-is, and scrap. A hold controls product during review; it is not a final disposition.
A disposition is a technical and quality decision, not simply a status field used to close the record.
Terms vary by procedure, standard, contract, and design authority. Use this practical comparison with those requirements.
| Disposition | Practical meaning | Key question |
|---|---|---|
| Rework | Bring product into conformity with the original requirement, then verify it. | Does it meet the original requirement? |
| Repair | Restore an acceptable condition that may still differ from the original requirement. | Is it technically acceptable and approved? |
| Use-as-is / concession | Accept a known deviation. A concession formally authorizes a defined departure where applicable. | Who can accept it? Is customer approval required? |
| Return / reject | Reject or return product while controlling affected stock. | What supplier follow-up is needed? |
| Scrap | Prevent unintended use through positive control or rendering product unusable. | How do you prevent re-entry? |
Terminology and approval requirements depend on the applicable standard, customer contract, design authority, regulatory environment, and organizational procedure.
Define authority before the next NCR. Production need, opening the record, a verbal engineering opinion, or a Quality field on a form does not alone establish who may accept the deviation.
Set approval scope and escalation rules. Depending on the issue, decision makers may include Quality, engineering, design authority, an MRB, customer or regulatory representatives, supplier personnel, program management, or delegated staff.
The person who needs the product released is not automatically the person authorized to decide that the nonconformance is acceptable.
IAQG's current register lists 9100:2016, known in the United States as AS9100 Rev D. Its public clause 8.7.1 guidance points to approval by a design-responsible representative or a person with delegated authority, plus customer authorization when a nonconformity affects contract requirements. Customer approval is not universal.
Aerospace guidance also calls for scrap controls that prevent rejected product being used as conforming. Check the edition and customer adoption in your contract. See the IAQG Standards Register, 9100:2016 evaluation guidance, and the clarification table.
One customer may permit internal dispositions; another may require approval for drawing departures, substitutions, repairs, special-process issues, or certificate discrepancies. Make customer rules accessible during review and record the exact condition accepted.
Customer approval should be a controlled requirement, not institutional memory.
A traceable signature can prove approval. The record should also show what was approved and why.
Disposition: Use-as-is
Reason: Acceptable
Approved: J. Smith
Identify the requirement and condition, product and intended use, technical evaluation, risk, required approvals, and authorized approver.
Review may consider fit, form, function, safety, reliability, downstream processing, interfaces, contract terms, regulation, and similar decisions. Explain why this condition is acceptable, with rigor suited to the risk.
The approval tells you who accepted the decision. The technical rationale tells you why it was defensible.
Material certifications, test reports, and certificates of analysis or conformance can support product identity and conformity. A file alone does not prove the right document belongs to the right lot. Link evidence to product and evaluate reported results against requirements.
IAQG clarification on 9100 clause 8.4.2 says test-report data needs evaluation. If raw material is a significant operational risk, validate report accuracy through an appropriate internal or external method. Organizations set the method and frequency based on risk. Options include periodic testing, independent lab checks, positive material identification, supplier surveillance, or certificate review. This does not mean every certificate must be retested.
The question is not whether a certificate exists. The question is whether your controls provide enough confidence that the material actually meets the requirement.
For a supplier issue, contain stock, check other lots and shipments, assess customer notification, and consider supplier action or revised incoming controls. "The supplier sent it that way" does not resolve your responsibility. Read why an approved supplier list is not a supplier management program.
An MRB brings needed expertise together, such as Quality, engineering, manufacturing, design authority, supplier quality, program management, or a required customer representative. Schedule matters, but cannot replace criteria or authority.
MRB exists to make technically justified disposition decisions, not to protect today's production schedule.
One deviation can be appropriate. If the same characteristic, supplier, process, or certificate issue recurs, ask why. Repetition may signal a problem with capability, requirements, inspection, tooling, training, equipment, supplier performance, or design.
Trend by cause, requirement, supplier, product family, or disposition. Recurrence may call for root cause analysis. Link supplier action, risk, corrective action, or change when warranted. See why related quality records should tell one connected story.
One justified use-as-is can be a disposition. Twenty against the same requirement may be a trend.
Do not make every NCR a CAPA. Consider severity, recurrence, customer or safety impact, regulatory duties, escapes, and control failures. A one-off may need correction only; a systemic issue may need corrective action. A lasting process change should enter change control.
A mature record lets someone who was not in the room reconstruct the decision:
ISO 9001:2026 is the current edition. Clause 8.7 covers nonconforming outputs; responses can include correction, containment, return or suspension, customer communication, or authorized concession. Records support understanding of the issue, actions, concessions, and deciding authority. Apply requirements in context. See the ISO 9001:2026 standard page. This article paraphrases requirements and does not imply ISO endorsement.
Auditors can sample records, trace approvals to defined authority, and check customer conditions and verification. See how internal auditors can test whether a process works.
The product question may be closed while the quality story continues through supplier action, investigation, corrective action, risk, change, effectiveness, or trending. Not every event needs each step. Keep the links when one process triggers another.
Athyrion uses the broader Quality Events concept for nonconformances, deviations, and customer complaints. Its eQMS is being designed to connect events with disposition, supplier, approval authority, corrective action, risk, change, and trends. See Athyrion Quality Events for current product information.
"Use as-is" is not a bad decision. Sometimes it is exactly right. The question is whether the right authority made it, using the right information, with a record the organization can defend later.
