Nonconformance disposition system map: QMS, MES, inspection and mailbox records joined by five keys

Short answer

Reconstructing one nonconformance disposition takes five keys across four or five systems: the NCR number, the work order or lot number, the part number with its drawing revision, the inspection report ID, and the customer concession reference. The QMS records the decision, the MES records what happened to the parts, inspection software holds the measurements, and the concession often sits in a mailbox. If one key is missing, a verdict and its evidence sit in separate systems with nothing proving they describe the same parts.

Visual briefFull-size diagram
Five system nodes, the QMS, MES, inspection software, drawing vault and quality mailbox, arranged around one nonconformance case, with the keys NCR number, work order, inspection report ID, part and revision, and concession reference traveling in to join it.
Illustrative system map for a fictional enclosure maker; real systems, field names and keys differ by plant.

This map belongs to the nonconformance disposition guide, which covers what to inventory before a QMS migration. Here the job is narrower: the wiring between systems. The worked exception tells one case as a sequence of decisions; this page shows which node holds each record, which key leaves it, and who administers it.

Five nodes in a typical plant

Each system answers one question about the case. None answers all of them, which is why a single QMS export rarely explains a disposition on its own.

QMS: what was decided and by whom. The nonconformance report, the material review board entry, the disposition (use as is, rework, repair, scrap, return to supplier) and the workflow signatures. Its key out is the NCR number.

MES or ERP: what physically happened to the parts. The hold on the lot, the rework traveler, the routing step where the defect was found, quantities scrapped or reworked. Its key out is the work order or lot number.

Inspection software or CMM files: the evidence behind the verdict. Measurement results, coating thickness readings, first article results, re-inspection after rework. Its key out is the inspection report ID, sometimes only a file name. The first article inspection report page describes one of the record types that lands here.

Drawing vault or PLM: which requirement applied. The part number and revision that define the specification the parts failed. Its key is the part number plus revision letter.

Quality mailbox or customer portal: what the customer accepted. ISO's quality vocabulary defines a concession as permission to use or release product that does not conform to specified requirements, generally within specified limits. Where a customer must approve that release, the approval is often an email thread, with only a reference typed into the QMS.

System map: record, linking key and owner

Read across a row to see what each system contributes, which key leaves it, and which record that key should reach.

SystemRecordLinking key outShould reachAdministered by
QMSNonconformance reportNCR numberMES hold and rework transactionQuality engineering
QMSMRB minutes and dispositionNCR number plus signature dateRework traveler; concession requestQuality director
MES or ERPLot hold and rework travelerWork order or lot numberNCR header; re-inspectionManufacturing engineering
Inspection softwareMeasurements and re-inspectionInspection report IDNCR attachment or link fieldQuality inspection lead
Drawing vault or PLMDrawing and specificationPart number and revisionNCR header; inspection planDocument control
Quality mailbox or portalCustomer concessionConcession referenceNCR closure noteQuality director; customer quality contact

Two keys are typed by people instead of generated by systems: the work order on the NCR header and the concession reference in the closure note. Those are where joins break most often, so ask about them first.

One fully joined case (Illustrative)

Illustrative and invented for this page. A fictional 310-person maker of anodized aluminum enclosures finds that one lot passed its dimensional check but failed coating thickness. Here is the same case when every key holds.

KeyValueFound inJoins to
NCR numberNCR-2417QMS; typed on the MES holdHold on WO-88412
Work orderWO-88412, 240 piecesMES; NCR headerRework traveler RW-0933
Part and revision7730-114, revision CDrawing vault; NCR headerCoating thickness requirement
Inspection report IDIR-5521, then IR-5540 after reworkInspection software; linked on NCRMRB entry and closure
Concession referenceCR-061, email from customer qualityQuality mailbox; NCR closure noteRelease of 6 pieces with a cosmetic mark

Read top to bottom: the lot was held under a named NCR, the part revision fixed the requirement, the first inspection report showed the failure, MRB ordered strip and re-anodize, the second report showed a pass, and six pieces with a minor cosmetic mark shipped under a customer concession. ISO 9001 auditing guidance has auditors check that such a release was approved by a relevant authority and, where applicable, by the customer, which is why the concession row matters. Remove CR-061 from the closure note and those six pieces look like an unexplained release.

Chronology and revision drift

Joining records is half the work; the order of events has to hold up too. Three checks catch most problems:

  • Revision at the time. The NCR should cite the drawing revision in force on the inspection date. If the header was updated to the current revision later, the case is judged against the wrong requirement.
  • Signature dates against MES timestamps. MRB approval should precede the rework traveler. If the plant runs the QMS in one time zone and the MES in another, note it before anyone claims an order.
  • Pre-QMS history. Early NCRs may sit in spreadsheets or scanned forms with no inspection report ID at all. They are not useless, but the map should mark them as partly joinable.

For medical device makers, FDA's Quality Management System Regulation took effect on February 2, 2026 and incorporates ISO 13485:2016 by reference, so some device makers may restructure their quality systems around it. A restructure is when keys get renamed or dropped, so it is worth asking whether old NCR numbers will survive in the new system. If the plant runs Epicor, the Epicor Kinetic historical export page and the Epicor migration page cover the ERP side.

Join questions for the quality director

One yes-or-no question per key, asked at metadata level. Do not describe any QMS or MES export feature to the client as fact; what each product can export, and how much history it holds, varies by product and contract, so the company confirms it with its own vendors.

  1. NCR to MES. "When a lot is held or reworked, does the MES transaction carry the NCR number, or only a reason code?"
  2. NCR to inspection. "Are inspection results attached or linked to the NCR, or stored only in the inspection tool?"
  3. NCR to drawing. "Does the NCR store the revision letter as it was, or look it up live?"
  4. NCR to concession. "Where are customer concessions filed, and is the reference written on the NCR?"
  5. Coverage. "From which year does each key exist, and what came before the current QMS?"

Write the answers as metadata: years covered, rough NCR volume per year, which keys hold. Who can open a licensing discussion once the map looks good is covered on who can license nonconformance disposition records. The introduced company needs 50+ full-time employees at peak (contractors excluded), a documented operating history, rights to license and an authorized contact. Companies in the U.S., Canada and the EU qualify, as do companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 90% of the data is in English. Whether joined records that cite customer drawings can be licensed stays unknown until SourceX's rights review.

Next step

Refer a company. Earn up to $100,000. Default reward: 25% of Actual Supplier Payout, capped at $100,000 cumulatively per referred company. Eligibility and payment conditions apply, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.

If the quality director answers yes to most of the five join questions, register as a partner, check the plant against who qualifies, and read the program terms before you make the introduction.

  1. Step 1Share your linkSend your personal link to a company you know.
  2. Step 2Company appliesThe company applies itself at /apply.
  3. Step 3Company signs and is paidThe company signs, delivers its data and is paid by SourceX under its agreement.
  4. Step 4You get your rewardYour 25% of the actual supplier payout. A reward becomes payable after SourceX has paid the referred company under its signed agreement and the payout conditions in the program terms are met, including finance approval and your tax and payment details.

Common questions

Which of the five keys is most often missing?

The NCR number on the MES rework transaction. Operators often record rework against the work order with a free-text reason, so the rework traveler cannot be tied to the NCR that ordered it without matching dates and part numbers by hand.

Can a consultant check the joins without opening records?

Yes. The quality director can say, field by field, whether each key is captured and in which system. Partners never ask for NCRs, exports, drawings or logins.

Does an all-in-one ERP with a quality module remove the problem?

It shortens some joins, because the NCR and the work order share a database. Inspection measurements, customer drawings and concession emails usually still sit elsewhere, so the map keeps at least three nodes.

Sources

  1. committee.iso.org/files/live/sites/tc176sc1/files/Terms in TC …
  2. committee.iso.org/files/live/sites/tc176/files/PDF APG New Dis…
  3. fda.gov/medical-devices/postmarket-requirements-devi…
  4. refer.sourcex.si/terms

Free resources

Know a company with valuable proprietary data?

Become a referral partner, get your link and introduce the company’s CEO (in an owner-run company, usually the owner). Referral partners can join from most countries. We can't work with partners in countries or regions under U.S. sanctions or on U.S. restricted-party lists. The companies you introduce should be based in the U.S., Canada and the EU, or in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia with at least 90% of their data in English.

Refer a company →

I own a business

Explore licensing your company's data directly to SourceX for AI training and evaluation. Start a short assessment; no uploads needed.

Start an assessment