IATF16949 Practical Application (21) | Nonconformity Closure: NC Grading, Root Cause Depth Five-Step Ladder, and Closure Evidence Package

A company underwent a customer second-party audit, during which the auditor reviewed 12 new supplier qualification evaluation records in the procurement department. Four of these records lacked capacity assessments, leading to one minor nonconformity. The first corrective action report was rejected: the action column stated "training has been organized and the process emphasized"; the second report was rejected again: it included a training sign-in sheet and the revised procedure document, but the auditor asked only two questions—“From which day did the revised document take effect? How many new suppliers were qualified after the document took effect, and where are the records?”; the third time, the auditor required on-site verification because the previous two corrective actions did not address the true cause: the template for the qualification evaluation form did not include a "capacity assessment" column, and the evaluators filled out the form according to the template, which would never include this item.

The nature of the problem changed over these three rounds: the first time, the company did not follow the process, while the third time exposed a design flaw in the process itself. This article provides four deliverables that can be directly used: the NC three-level grading and closure authority table, the four-element writing method for fact descriptions with counter-examples, the root cause depth five-step ladder judgment table, and the closure evidence package list with evidence strength grading.

1. Grading Before Rectification: Three-Level Judgment Table and Closure Authority

The first column of the nonconformity ledger should not be the problem description but the level. If the level is incorrectly determined, the verification resources and closure authority will also be misaligned—serious issues treated as minor nonconformities will recur after three months; minor issues treated as serious will result in a pile of unactioned items in the ledger.

Three rules to make this table effective:

1. Grading authority does not lie with the audited department. The level is proposed by the internal audit leader or auditor and confirmed by the system manager; in case of disputes, the level is upgraded based on "impact on customers and product safety," not downgraded based on "amount of rectification work."
2. Serious nonconformities must submit a three-part plan, not just a "rectification plan." The plan must include containment (client, in transit, in inventory, in production), root cause (to L4 and above), and actions (including verification methods). Any missing part will result in rejection.
3. Observation items are not a free pass. If the same observation item appears in two consecutive audits without being initiated or explained in writing, it will be treated as a minor nonconformity in the next audit—observation items are valuable when addressed, not just collected.

Extensions must have limits, otherwise, "pending closure" items in the ledger will become a permanent status:

External deadlines follow the certification body's rules for submitting and closing nonconformities; the table above is the internal control value, which should be stricter than external requirements to allow for verification and additional evidence.

2. Fact Description: Making It Reproducible by a Third Party

Unclear nonconformity descriptions discount every subsequent step—responsible departments cannot see where the problem lies, verifiers do not know what to check, and quarterly analyses cannot produce categorized data. Fact descriptions require only four elements, all of which are essential.

One rule for internal auditors: Do not write causes, responsibilities, or actions in the fact description. Mixing these elements makes it impossible to distinguish facts from judgments during rectification, and verification becomes difficult. Causes go in the root cause column, actions in the corrective action column, and responsibility determination in another process.

Avoid another common mistake: vague quantifiers like "some records missing." Any occurrence of "some," "individual," or "many" in the audit report must be replaced with "sampled N items, M of which were nonconforming." This is not about being pedantic but ensuring that the M items can be verified as corrected and that similar N items have been investigated during closure.

3. Root Cause Depth Five-Step Ladder: Pushing Back "Training Inadequacy"

This is the most challenging part of the entire method. Most companies are not unfamiliar with root cause analysis tools but do not know at which level to stop for qualification—after the third 5Why, they conclude with "training inadequacy"; after filling a wall with a fishbone diagram, they circle "human factors." The tools are all there, but what is missing is a standard for level determination.

The boundary between L3 and L4 is one sentence: L3 fixes one issue, L4 fixes a category of issues. For the same case, L3's answer is "add a capacity assessment column to the supplier qualification evaluation form"; L4's answer is "new or revised form templates must be co-signed by the process owner and the system manager, and template changes must be included in the documented information list and change management." The former ensures that this form is completed, while the latter ensures that future forms do not miss items.

Human factors are not entirely off-limits, but they must meet three conditions: other personnel in the same position do not have similar deviations under the same conditions; the person has valid authorization and capability evidence; the process itself has no poka-yoke or redundant verification. If all three conditions are met, "human error" can be retained as L3, but an additional L4 must be added—why this process allows single-point human error without detection, i.e., the lack of detection and poka-yoke design. Writing only human factors and not detection is the most common reason for rejection by auditors.

Cross-functional differences in writing must be highlighted. Nonconformities in R&D are often written as "incomplete design output," in procurement as "inadequate supplier evaluation," and in HR as "unimplemented training"—all of these stop at the L3 threshold. Their truly fixable L4 levels are: the linkage rules between design review checklists and DFMEA control measures; the graded authorization rules for supplier qualification and performance monitoring; the alignment rules between job capability matrices and job authorization. The conflict is clear: process owners want to close the item quickly to restore their performance scores, while system managers require depth. The judgment rule is predefined—level determines depth: minor nonconformities can stop at L3, serious nonconformities must reach L4 and above; the validity of L4 is determined by the system manager, not by the audited department's self-assessment.

Four self-check questions before closure, any one of which cannot be answered will result in rejection, no need for a meeting:

1. Is the root cause identified to a specific line in a specific document, specific parameter, or specific responsibility item at L3 or below?
2. Do the actions correspond one-to-one with the root causes? Each root cause should have a corresponding set of actions, not a single "strengthen management" covering everything.
3. Does the evidence package include execution evidence (E2) and effectiveness data (E4)?
4. Is the scope of horizontal expansion clearly stated—which similar processes, which functions under the same clause, which other locations and shifts?

4. Closure Evidence Package: Four Types of Evidence and Strength Grading

The phrase "rectified" is not valid in the system; only evidence is valid. Each type of evidence has minimum requirements, and any missing type can be easily identified.

Evidence is divided into three levels based on verifiability, each with different uses:

• A Level: Third-party independently verifiable. Record numbers can be traced, system logs can be exported, and there are before-and-after comparison data. Can be used as a basis for closure at any level.
• B Level: Self-narrative materials plus partially verifiable records, such as department self-inspection forms with a few records. Can only be used as supplementary evidence for minor nonconformities.
• C Level: Commitment materials, including plans, notifications, meeting minutes, and rectification commitment letters. Cannot be used as a basis for closure.

One hard rule: in quarterly statistics, list "the number of items closed with C-level evidence" separately, with a target value of 0. This number reflects the true state of the system more accurately than the closure rate—closure rate can be inflated by signatures, but the proportion of C-level evidence cannot.

Many companies are not unwilling to collect E2 and E4 evidence for non-manufacturing functions but do not know what to collect:

These columns also serve as evidence collection guidelines: include E2 and E4 in the rectification plan in advance, so the responsible department knows what records to keep when submitting the plan, saving half the effort compared to adding them before closure.

5. Recurrence Judgment and Escalation: Making Recurrence Rate Calculable

Recurrence is not feared; what is feared is that it occurs but no one recognizes it. Three judgment rules are predefined in the procedure document:

1. The same root cause type appears in the same process within 12 months, 2 or more times, it is judged as recurrence. Root cause types must be pre-coded (e.g., "missing form template," "change not linked," "insufficient detection means," "unclear authorization"), otherwise, it relies on human memory.
2. The same system cause appears in 2 or more functions or locations, it is judged as a systemic defect, and the NC is escalated.
3. Actions fail within 90 days after closure (metrics return to pre-action levels), actions are downgraded, and the root cause is redone to L4, no additional patches are allowed on the original actions.

Escalation actions are fixed to three:

• Retain the original number and open a recurrence record. It is not allowed to "open a new number" to resolve the issue—this would make the recurrence rate impossible to calculate and make the same issue appear as two new issues in the ledger.
• The management representative signs the recurrence explanation, detailing why the previous closure did not identify the systemic cause.
• The issue is included in the management review input and the process is listed as a focus in the next year's internal audit plan.

The observation period must be recorded in the ledger status: 60 days for minor nonconformities, 90 days for serious nonconformities. During the observation period, metrics are monitored at the pre-action frequency, and the status is recorded as "closed-observation period." Closure without an observation period essentially shifts the verification cost to the customer.

6. Quarterly Distribution Matrix: Moving from Counting Items to Systemic Prevention

Incomplete ledger fields result in quarterly analysis only counting items. The minimum field set is: NC number, source of discovery (internal audit/second-party/third-party/customer), clause number, responsible function, level, fact description, root cause level, action type (document/equipment/parameter/personnel/system), submission date, closure date, closure cycle, highest evidence level, recurrence status.

Four indicators are rolled over monthly and summarized quarterly:

Two Pareto charts are drawn for each dimension because the conclusions of the two charts are entirely different:

• By Clause: If concentrated in 7.5 Documented Information, 8.4 External Provision, 7.2 Capability, it indicates a system design issue—form templates, responsibility divisions, and authorization rules need to be redone.
• By Function: If concentrated in procurement, HR, IT, it indicates a capability and resource issue—position configuration, capability matrices, and system support are insufficient.

The countermeasure for clause concentration is to change rules and templates; the countermeasure for function concentration is to change capabilities and authorizations. Drawing only one chart easily turns a system issue into a departmental issue for accountability, and the problem will recur in the next quarter.

Quarterly outputs are fixed to three items: assign a functional head (not the quality department) for the top 3 recurrence root causes; list the focus processes for the next quarter's internal audit (processes with nonconformities in two consecutive quarters); provide a one-page input for management review—four indicators, two matrices, and a list of improvement items.

7. Key Points for Implementation and Common Mistakes

• Writing causes and actions in the fact description. The consequence is that closure cannot be verified because it is unclear which statement is a fact.
• Stopping root cause analysis at L2. "Training inadequacy" is the most expensive root cause, as it downgrades a systemic design issue to a single training session, which is the least costly and quickest to recur.
• Evidence only includes E1. Changing the document but not the records is equivalent to no change; the first thing an auditor does is compare the effective date with the record date.
• E2 records are earlier than the document effective date. This is the easiest false evidence to spot on-site; verify the dates item by item when supplementing materials.
• Delegating closure authority to the audited department. Self-judgment makes the observation period meaningless, and serious nonconformities may be "internally downgraded."
• No upper limit for extensions. "Pending closure" items hanging for two years distort all quarterly indicators, making the problem disappear in the data but appear with the customer.
• Opening a new number for recurrence. Recurrence rate resets to zero, satisfaction rises, but real risks remain unchanged, a typical indicator illusion.
• Quarterly analysis only counts items. Not examining the root cause level, clause, or function distribution means improvements always target symptoms.
• Using observation items to pad the number of nonconformities. Level inflation dilutes serious nonconformities and desensitizes the audited department to levels.
• Nonconformity ledger and corrective action system are disconnected. Non-interoperable numbers mean the same issue is closed twice in different places, making recurrence judgment impossible.

Nonconformity closure is not about how well the report is written but whether the organization has the capability to turn a "single deviation" into a "category immunity." Grading determines the investment, fact description determines verifiability, root cause level determines whether to fix one issue or a category, evidence package determines whether it can be independently verified by a third party, and recurrence judgment determines whether this capability is improving.

Root cause not reaching the system level means closure is just a change of date.

Knowledge code: 2.1.2

Version: v20261009

Author: QTank QTank is dedicated to providing systematic professional knowledge, methodologies, and practical tools for quality management practitioners, helping enterprises continuously improve their quality capabilities.