NC, Change Order, or CAPA?

How to Route a Quality Problem

Every quality problem needs a home. Something fails inspection, a customer complains, an auditor writes a finding. The first decision is which process takes it: a nonconformance report (NC), a change order, or a corrective and preventive action (CAPA).

Route it wrong and you pay for it either way. Send everything to CAPA and the system clogs, deadlines slip, and real systemic issues get lost in the noise. Keep everything at the NC level and recurring problems never get a root cause. Both patterns show up quickly in an inspection.

This post explains what each process is for, where the requirements come from, and a practical way to decide, including when one issue needs more than one process.

The regulatory basis

Since FDA's Quality Management System Regulation (QMSR) took effect on February 2, 2026, 21 CFR 820.10(a) has required manufacturers to document a quality management system that complies with ISO 13485:2016, which Part 820 incorporates by reference. The old standalone sections for nonconforming product (820.90) and CAPA (820.100) are gone. The ISO 13485 clauses are now the requirement in the US as well.

Each routing option maps to its own clause:

The clauses also connect to each other. Complaint handling (8.2.2) must decide whether corrections or corrective actions are needed. Data analysis (8.4) must feed trends into improvement under 8.5. The routing decision is where those links happen.

Three tools, three jobs

The easiest way to route correctly is to be clear about the question each process answers.

Nonconformance: "What do we do with this product?" An NC handles a specific, contained problem: a lot that fails incoming inspection, a wrong part number, a single unit that doesn't work. It controls the product so it isn't used by mistake, and it records the disposition, such as rework, scrap, return to supplier, or use as-is under a documented concession. Most issues start here, and many end here.

Change order: "What do we need to change, and is it safe to change it?" A change order controls changes to the design or to specifications, drawings, files, and documents. Some issues need a change, such as a spec that turns out to be wrong or a part that is hard to manufacture. The change goes through review, verification, and approval before release, whether or not a CAPA is open.

CAPA: "Why did this happen, and how do we make sure it doesn't happen again?" A CAPA is for systemic problems: ones that recur, carry significant risk, or point to a failure of the quality system rather than a single product. It requires a root cause investigation, an action that removes the cause, and evidence the action worked. A preventive action asks the same question about a problem that hasn't happened yet.

One distinction runs through all three. A correction fixes the immediate problem, such as reworking the lot. A corrective action removes the cause. An NC almost always includes a correction. Only some issues also need a corrective action.

The routing decision

Three questions, asked in order, route almost any issue. They aren't either/or. A failed critical-to-quality spec can answer yes to all three.

Routing decision · 3 questions, 3 processes

Whatever the answers, record the reasoning. The decision record is what an auditor will ask to see.

An escalation guide

A written escalation guide turns the decision into something consistent and defensible. Here is a typical one. Some situations trigger more than one process, and that's expected.

Three patterns stand out. Contained, one-time product problems stay at the NC level. Anything that changes a design or controlled document goes through a change order, including changes that come out of a CAPA. CAPA is for complaints, audit findings, critical-to-quality issues, recurring problems, and supplier performance: the places where a systemic cause is most likely.

Treat the guide as a starting point. Quality or engineering should still make the final call and record the reasoning.

Gray areas and judgment calls

When does an NC become a CAPA? Clause 8.3.1 requires every NC evaluation to decide whether an investigation is needed. That is the natural escalation point. Escalate when the issue repeats, when the same cause could affect other products or lots, when risk to patients or compliance is more than minor, or when trend data shows a pattern. Record the reasoning either way, because the standard requires the rationale for decisions.

Do complaints always need a CAPA? Not necessarily. Clause 8.2.2 requires complaint handling to decide whether corrections or corrective actions are needed. If a complaint isn't investigated, the justification has to be documented. Many companies evaluate every complaint for CAPA, which is why complaints sit in the CAPA column above. But the outcome of that evaluation can be "no CAPA, here's why."

Does every CAPA need a change order? No. Some CAPAs end in training, a supplier action, or a process adjustment that changes no controlled document. When the fix does change a design, specification, or procedure, that change goes through change control. The CAPA should link to it.

Can a single low-risk failure stay an NC? Yes, and it should. The important step is trending. Clause 8.4 requires analysis of data, including product conformity and supplier performance. Individually minor NCs that add up to a pattern are a classic source of preventive actions.

Does every scrapped part need an NC? No. Most manufacturing processes produce some scrap. Parts that fall out at in-process checks, setup pieces, and units lost during normal handling are expected. Scrap at that level is part of how the process runs, not a nonconformance to investigate one by one. The key is knowing what "normal" looks like. Set an expected scrap rate for each process, based on validation data or production history, and track against it. Open an NC when the rate goes above that level, or when a new or unusual failure mode shows up. That shift is the signal that something in the process has changed. If the NC investigation finds a systemic cause, or the rate stays high, it may escalate to a CAPA.

Does every CAPA need an effectiveness check? Clause 8.5.2 requires reviewing the effectiveness of corrective actions. Clause 8.5.3 says "as appropriate" for preventive actions. The check should fit the problem. Completing one missing training record fully closes that gap. A new training process launched after repeated failures needs evidence that it works.

Routing mistakes auditors find

• CAPA for everything. A CAPA log full of one-off inspection rejects shows the system can't tell big problems from small ones. It also means long overdue lists.
  

• NCs that never escalate. The same NC opened again and again, each closed with "reworked" or "scrapped," is a missed corrective action.
  

• No documented investigation decision. Clause 8.3.1 requires the NC evaluation to decide whether an investigation is needed. A blank field is a finding.
  

• Changes made inside a CAPA without change control. A CAPA can't stand in for a change order. Design and document changes still need review, verification, and approval under 7.3.9.
  

• Complaints closed without a CAPA decision. Every complaint record should show whether corrective action was needed and why.
  

• No trending. Without data analysis, nobody notices patterns across NCs, and preventive action never happens.
  

• Unclear criteria. If two engineers would route the same issue differently, the escalation guide isn't doing its job.
  

The bottom line

An NC deals with the product, a change order controls the change, and a CAPA removes the cause. Under 21 CFR 820.10(a), each one answers to its own ISO 13485 clause: 8.3, 7.3.9, and 8.5.2 or 8.5.3. A written escalation guide, a documented decision at each handoff, and regular trending keep the routing consistent and easy to defend.

If your procedures still cite 820.90 and 820.100, or your teams route the same issue different ways, start there.

If you would like an additional set of eyes and hand on your project, schedule a meeting below.

Sources

• 21 CFR Part 820, Quality Management System Regulation (effective February 2, 2026), §820.10(a)

• ISO 13485:2016, Medical devices — Quality management systems — Requirements for regulatory purposes: clauses 7.3.9, 8.2.2, 8.3, 8.4, 8.5.2, 8.5.3