7.1.5 Nonconformity: Write a Response That Closes It

The finding reads something like this: "Outside micrometer 25–50 mm, asset M-0147, was in use at Cell 4 twenty-three days past its calibration due date. No evidence that calibration status was checked before use. Contrary to ISO 9001:2015 clause 7.1.5.2." The auditor has left. You have thirty days to respond, and the first draft on your screen says "Operator retrained on checking calibration labels."

That draft will probably be returned. If it isn’t, the same finding tends to reappear at the next surveillance audit, written up as a repeat nonconformity, which is a much harder conversation.

This autumn a lot of quality engineers are in exactly this position. Q4 surveillance and recertification audits are under way, and responses to findings raised in September and October fall due in October and November. Here is how to write a 7.1.5 response that an auditor can accept, using the micrometer above as a worked example.

What the auditor is actually checking

Clause 7.1.5.2 is short. Where measurement traceability is required, measuring equipment must be calibrated or verified at specified intervals or prior to use, identified so its status can be determined, and safeguarded against adjustments, damage or deterioration that would invalidate results. When equipment turns out to be unfit, the organisation has to determine whether previous results were affected and take action. IATF 16949 adds calibration-record requirements in 7.1.5.2.1, including an assessment of risk to the intended use when equipment is found out of specification. AS9100 adds a requirement to maintain a register and recall equipment.

The response itself is governed by clause 10.2, and 10.2 has a clear sequence. React to the nonconformity and correct it. Deal with the consequences. Determine the causes. Determine whether similar nonconformities exist or could occur. Implement action. Review its effectiveness. The ISO TC 176 Auditing Practices Group guidance on reviewing nonconformity responses makes the same point from the auditor’s side: correction, cause and corrective action are assessed separately. A response that blends them into one sentence gives the auditor nothing to verify.

That sequence gives you five parts. Each one needs its own evidence.

1. Correction: deal with the gauge in front of you

Quarantine M-0147, send it for calibration, and record the as-found result before any adjustment. The as-found result is what makes the correction meaningful. If the micrometer was within tolerance as found, you document that and the product question is largely closed. If it was out of tolerance, clause 7.1.5.2 requires you to assess the validity of every measurement taken with it since its last good calibration. That means identifying the lots or characteristics measured, judging whether the deviation matters against the part tolerance, and deciding what to do about any product already shipped.

Evidence: the quarantine record, the calibration certificate with as-found and as-left values, and a short impact assessment.

2. Extent: the gauge the auditor didn’t see

This is the part most responses skip, and it is the part 10.2 names directly: determine whether similar nonconformities exist. The auditor sampled one gauge. Your response has to say how many others were in the same state.

Pull every controlled instrument, not just micrometers, and compare its calibration due date with today. Check the instruments you would rather not check: the ones in personal toolboxes, the ones lent to another department, the empty cut-out in the crib drawer. Report the number. "Sweep of 412 controlled instruments on 6 October found 3 further items past due, none in use; all quarantined" is a sentence an auditor can verify. "No other instruments affected" without a method is not.

If you cannot run that sweep in an afternoon because the register is a spreadsheet nobody fully trusts, you have probably found your root cause.

3. Cause: why "human error" gets rejected

"The operator didn’t check the label" describes what happened. It does not explain why the system allowed it. Ask the question one more time: why was a person the only thing standing between an overdue gauge and a production measurement?

In the M-0147 case, honest answers tend to look like this:

• Due dates were calculated by hand in a spreadsheet and reviewed monthly, so an instrument could go overdue between reviews without anyone noticing.
• Nothing at the point of use prevented an overdue gauge from being issued. The label was the only control, and labels fade, fall off, or never get read.
• There was no record of who had the micrometer, so it could not be recalled when it fell due.

Each of these is a systemic cause. Each one points to a corrective action you can verify. Retraining addresses none of them. It has a place as a supporting action, but a response that relies on people remembering better is really promising that the nonconformity won’t happen again without changing anything that would prevent it.

4. Corrective action: change the system, not the reminder

A corrective action should remove the cause, so it should mirror the cause list:

• Calculate due dates from the calibration record, not by hand. When a calibration is logged, the next due date follows from the interval assigned to that instrument. In PrüfDesk this is automatic: record the pass/fail result and certificate, and the due date is recalculated.
• Enforce status at the point of use. PrüfDesk lets each tenant configure overdue behaviour as a hard block, where an overdue instrument cannot be checked out, or a soft warning, where the user sees the status and the override is recorded. For a 7.1.5 finding, a hard block is the stronger answer, because the control no longer depends on anyone reading a label.
• Know who holds each instrument. Check-outs and permanent allocations with a full possession history mean that when M-0147 falls due, you know whether it is in the crib, at Cell 4, or in someone’s toolbox.
• Standardise the procedure. If the as-found step was inconsistent, a reusable calibration procedure template for the instrument type, with per-unit overrides where needed, makes the steps the same every time.

One caution applies. Buying software is not a corrective action in itself. The corrective action is the rule plus its enforcement: "Overdue instruments are blocked from issue; configured on 14 October; procedure QP-07 revised accordingly." Software is how you implement that rule and prove it holds.

5. Effectiveness: evidence that it worked

Effectiveness is judged later, not on the day you close the action. Set a date 60 to 90 days out and decide now what you will show: a compliance report listing zero instruments in use past their due date, blocked check-out attempts logged and handled, and the next as-found results recorded on time. PrüfDesk produces these as audit-ready PDF compliance reports, so the effectiveness evidence is a dated document rather than a screenshot taken the morning of the audit.

If the review shows an overdue instrument slipped through, that is useful too. It tells you the cause analysis missed something, and there is still time to go back to step 3 before the auditor returns.

Checklist before you submit

• Correction: quarantine, as-found and as-left recorded, product impact assessed
• Extent: every controlled instrument swept, method stated, count reported
• Cause: systemic, and not "human error" or "retraining"
• Corrective action: one action per cause, each verifiable and dated
• Effectiveness: review date set, and the evidence you will show defined in advance

A calmer next audit

A 7.1.5 finding rarely means the lab is careless. Usually it means the programme depended on memory and labels. Fix that dependency, and the next time an auditor picks a micrometer off the bench, the record already shows when it was calibrated, who has held it, and why it could not have been used overdue.

If you would like to see how PrüfDesk handles due dates, overdue blocking and compliance reports on your own instrument list, you can explore it at your own pace.