What a nonconformity register needs before the audit
A nonconformity register is the first thing an auditor asks to see after the quality manual, and it is usually the one that was assembled in a hurry. It does not have to be complicated. It has to be complete, current and traceable.
Clause 10.2 of ISO 9001:2015 asks you to keep documented information about the nature of each nonconformity, the actions taken and the results of any corrective action. A register is the ordinary way to do that. These are the columns that make it hold up.
The columns
- A number that never repeats. NC-0042 means one thing, forever. Never reuse a number after a row is deleted.
- Date raised, and who raised it.
- A description a stranger can understand. "Defect on batch" is not one. Say what was found, where, on which product or process.
- Where it came from. Incoming inspection, process, final inspection, customer complaint, internal audit, supplier. You cannot see a pattern without this column.
- Severity or category, using the scale you already defined in your procedure.
- One named owner. A team is not an owner. If two people share a row, neither of them chases it.
- Containment, what was done immediately, and the date.
- Root cause, once it is known, and the method you used to find it.
- Corrective action, with its own owner and due date. More on this below.
- Status and closing date, with the effectiveness check recorded before the row is closed.
Corrective actions are rows of their own
One nonconformity can need several actions, and each action has a different owner, due date and result. Cramming them into a single "Action" cell is where registers start to lie: the cell says "done" while one of three actions is still open.
Keep actions as their own list, each pointing at the nonconformity it belongs to. Then "show me every open action past its due date" is a filter, not a research project.
History is part of the evidence
The thing an auditor cannot get from a spreadsheet is when a value changed. A due date moved from March to June looks identical to one that was always June. If the register is going to count as evidence, changes need to be recorded: who changed what, when, from which value to which.
If your register lives in Excel today, you can approximate this with a locked "change log" sheet that someone fills in by hand. It works until the one week it does not get filled in.
A short test
Pick a nonconformity closed six months ago and answer, from the register alone and in under two minutes: who raised it, who owned it, what the root cause was, which actions closed it, and who checked that they worked. If you cannot, that is the column to add first.
If you keep this register in Excel and want to see it as an app with linked actions and a change history, there is a page for that: send the header row of your sheet and I will show you a first version on a short call.