What Is a Nonconformity Under ISO 9001:2015 Clause 10.2?

A nonconformity is the non-fulfilment of a requirement — any departure from a specified standard, procedure, process, or expectation. Under ISO 9001:2015, a nonconformity is not limited to a defective product. It includes process failures (a procedure not followed), system failures (a required record not maintained), supplier failures (material that does not meet specification), and measurement failures (a gauge that was out of tolerance when used to make a quality decision).

Clause 10.2 applies whenever a nonconformity occurs, including those arising from complaints. There is no de minimis threshold — a minor procedural lapse and a major product failure are both nonconformities under the standard, even though the corrective action they attract will be very different in scale and urgency. The proportionality is in the response, not in whether the clause applies.

It is worth distinguishing between a nonconformity and a corrective action. The nonconformity is the finding — the gap between what happened and what was required. The corrective action is the response — the steps taken to eliminate the cause and prevent recurrence. ISO 9001:2015 is explicit that corrective action must address the cause, not merely the symptom. Replacing a defective component without understanding why it became defective is a containment action, not a corrective action.

The Required Response Steps Under Clause 10.2

Clause 10.2.1 specifies the sequence of actions the organisation must take when a nonconformity occurs. Auditors will check for evidence of each step:

1. React to the nonconformity — Take action to control and correct it, and deal with the consequences. For a product nonconformity this typically means quarantining affected stock, raising a non-conformance report (NCR), and initiating a customer notification if required. For a process nonconformity it means stopping the non-compliant activity and reverting to a known-good state. The reaction must be documented: what was found, when, by whom, and what immediate action was taken.
2. Evaluate the need for corrective action — Determine whether a corrective action is required by reviewing the nonconformity, its magnitude, its potential recurrence, and its impact. Not every minor deviation requires a full corrective action — but the decision not to raise one must itself be documented, with a brief rationale. An undocumented non-decision looks identical to an omission.
3. Investigate the root cause — Where corrective action is required, the organisation must determine what caused the nonconformity. This is the step most commonly done superficially. Root-cause analysis is covered in detail in the section below.
4. Implement the corrective action — Take action to address the root cause and prevent the nonconformity from recurring. Document what was done, who did it, and when.
5. Review effectiveness — After a suitable period, verify that the corrective action worked — that the nonconformity has not recurred and the root cause has been addressed. Document the effectiveness review and its outcome.
6. Update risks and opportunities — If the nonconformity reveals a gap in the organisation's risk assessment, update the risk register accordingly. This connects clause 10.2 to clause 6.1 (actions to address risks and opportunities).
7. Amend the quality management system if needed — If the nonconformity arose because a procedure, work instruction, or system element was absent, inadequate, or not followed, the QMS should be updated to close the gap.

How to Write a Root-Cause Analysis

Root-cause analysis is the technical core of a corrective action. It is the step that separates a system that learns from its failures from one that merely firefights them. ISO 9001:2015 does not mandate a specific method, but auditors look for evidence that the analysis went beyond the immediate symptom and reached an actionable underlying cause.

The most widely used methods in UK manufacturing are:

• 5 Whys — Ask "why?" repeatedly until the answer points to a cause that, if addressed, would prevent recurrence. Effective for simple, linear failure chains. Prone to stopping too early if the team lacks discipline or stops when the answer becomes uncomfortable.
• Fishbone (Ishikawa) diagram — Map potential causes across six categories: Man, Machine, Method, Material, Measurement, and Environment. Useful for complex nonconformities where multiple contributing factors may be in play. The diagram itself should be retained as part of the corrective action record.
• Fault tree analysis — A top-down deductive approach that maps logical relationships between a failure event and its possible causes. More rigorous than 5 Whys and appropriate for safety-critical or high-impact nonconformities.
• 8D (Eight Disciplines) — A structured eight-step process that includes team formation, problem description, containment, root-cause identification, corrective action, verification, prevention, and team recognition. Common in automotive (IATF 16949) supply chains and used where the customer requires a formal 8D report.

For calibration-related nonconformities — for example, an out-of-tolerance gauge used to make product acceptance decisions — the root-cause analysis should address at minimum: why the instrument drifted beyond its tolerance (physical cause), whether the calibration interval was appropriate, and whether the handling, storage, or usage conditions contributed to the drift. A root cause of "instrument drifted with age" without further investigation will not satisfy an assessor.

What a Corrective Action Record Must Contain

Clause 10.2.2 requires the organisation to retain documented information as evidence of the corrective actions taken. While the standard does not specify a form, an auditable corrective action record should contain the following elements:

• Reference number and date raised — A unique identifier so the record can be traced from an audit finding, a complaint, or an OOT event to its resolution.
• Description of the nonconformity — What went wrong, where, when, and how it was detected. Sufficient detail to allow someone unfamiliar with the event to understand what happened without having to ask.
• Immediate containment action — What was done to stop the nonconformity from progressing or affecting further output. For a product nonconformity: quarantine, rework, scrap, or customer notification. For a process nonconformity: who was instructed to stop the activity and what interim measure was put in place.
• Root-cause analysis — The method used, the analysis itself, and the identified root cause. The root cause must be specific and actionable: it must point directly to the corrective action that follows.
• Corrective action taken — What was changed, who made the change, and when. Actions should be specific: "Updated calibration interval for all workshop micrometers from 12 months to 6 months" is auditable. "Reviewed procedures" is not.
• Target and actual completion date — Evidence that the action was implemented within a defined timescale and that open actions are tracked to closure.
• Effectiveness review — The date of the review, the criterion used to judge effectiveness, and the outcome. This section is frequently absent from corrective action records and is a reliable predictor of repeat non-conformances.
• Authorisation and closure sign-off — Who reviewed the completed record and confirmed it was closed. For significant nonconformities, this is typically the Quality Manager.

How to Verify Effectiveness

An effectiveness review answers a single question: has the corrective action eliminated the root cause? The review should take place after a period sufficient to demonstrate that the nonconformity has not recurred — typically one production cycle, one audit cycle, or one calendar quarter, depending on the frequency of the activity in which the nonconformity arose.

The method of verification should be defined when the corrective action is raised, not retrospectively. For a procedural nonconformity, verification might be a process audit or a review of compliance records from the relevant period. For a product nonconformity, it might be a review of inspection results for the affected part numbers over the following quarter. For a calibration nonconformity, it might be a check that the amended calibration interval has been applied to all affected instruments and that no repeat OOT findings have been recorded in the subsequent calibration cycle.

If the effectiveness review finds that the nonconformity has recurred, the corrective action has failed — most likely because the root cause was not correctly identified. The corrective action should be reopened, the root-cause analysis revisited, and a revised action raised. This cycle of review and revision is not a process failure; it is the system working as intended. What the auditor is looking for is evidence that the organisation recognised the failure and responded systematically.

Clause 10.2 and OOT Findings: Where They Connect

For organisations managing calibration compliance, clause 10.2 and clause 7.1.5 are closely linked. An out-of-tolerance finding is a nonconformity in the measurement system — it triggers both the OOT impact assessment required under clause 7.1.5.2 and the corrective action process required under clause 10.2. The OOT impact assessment addresses the immediate consequence (what was measured while the gauge was non-conforming); the corrective action addresses the cause and prevention.

Assessors will expect to see an unbroken documentary chain: the OOT finding in the calibration record, the impact assessment showing which products were affected and what action was taken, and the corrective action record addressing why the instrument went out of tolerance and what systemic change was made. An OOT event that has a complete impact assessment but no corrective action record — or a corrective action record that says only "recalibrated" — will attract a major non-conformance.

How Calibration Management Software Supports Clause 10.2

The most time-consuming part of clause 10.2 compliance for calibration nonconformities is assembling the evidence. Calibration management software supports this by:

• Automatically prompting an OOT impact assessment when a gauge fails calibration, ensuring the first step of clause 10.2.1 is captured at the point of detection
• Linking the OOT finding to the corrective action record, so assessors can navigate from the initial non-conformance to the closure evidence in a single audit trail
• Storing the full calibration history for each instrument, providing the factual basis for root-cause analysis (drift rate over time, frequency of OOT findings, interval adequacy)
• Tracking corrective actions through to effectiveness review, with due-date alerts ensuring open actions do not stall
• Generating audit-ready corrective action reports that contain all elements required by clause 10.2.2, reducing preparation time before surveillance audits

Frequently Asked Questions

Is a corrective action required for every nonconformity?

Not necessarily. Clause 10.2.1 requires the organisation to evaluate the need for corrective action — the decision can be that no corrective action is required, provided that decision is documented with a rationale. Minor, isolated, one-off deviations may not warrant a full root-cause investigation. However, repeated minor nonconformities of the same type are a signal that a systemic cause exists and should trigger a corrective action.

What is the difference between a correction and a corrective action?

A correction is the immediate fix — replacing a defective part, re-inspecting a batch, recalibrating a gauge. A corrective action addresses the cause and prevents recurrence. ISO 9001:2015 requires both, but distinguishes between them. Closing a nonconformity with a correction only — without a root-cause investigation and a preventive step — is one of the most common audit findings in UK manufacturing.

How long should corrective action records be retained?

ISO 9001:2015 does not specify a minimum retention period for corrective action records, but most certification bodies expect records to be available for at least the current and preceding certification cycles (typically three years). In aerospace and defence supply chains, contractual requirements frequently extend this to seven or ten years. Retain corrective action records for at least as long as the records of the nonconformity they address.

Does clause 10.2 apply to supplier nonconformities?

Yes. If a supplier delivers non-conforming material or services, the nonconformity falls within the scope of clause 10.2. The organisation should raise an NCR, conduct an impact assessment of affected product, and — for significant or repeat supplier failures — require the supplier to provide a corrective action response. Supplier corrective action requests (SCARs) are a recognised tool for this and are expected in AS9100 Rev D and IATF 16949 supply chains.

References

• ISO 9001:2015 Quality management systems — Requirements, clauses 7.1.5, 10.2, and 6.1, International Organization for Standardization
• AS9100 Rev D Quality Management Systems — Requirements for Aviation, Space, and Defense Organizations, SAE International
• IATF 16949:2016 Quality management system requirements for automotive production and relevant service parts organizations
• ISO 9000:2015 Quality management systems — Fundamentals and vocabulary, definition of nonconformity, International Organization for Standardization
• UKAS, United Kingdom Accreditation Service — ukas.com

What is an Out-of-Tolerance (OOT) Finding?

An out-of-tolerance finding occurs when a measuring instrument is calibrated and the readings returned fall outside the defined tolerance band — meaning the instrument was not measuring accurately within the limits that quality decisions depended upon. This is distinct from an overdue calibration (where the instrument simply has not been recalibrated within the required interval): an OOT finding is a confirmed technical failure.

Common causes of OOT findings include: physical damage such as dropping or impact; wear from repeated use; environmental factors such as temperature cycling, contamination, or corrosion; improper storage; and gradual drift over time beyond what the calibration interval was designed to contain. Some instruments drift slowly and predictably; others can fail suddenly. The calibration record tells you the current state — it cannot, by itself, tell you when the failure occurred.

The significance of an OOT finding is not limited to the moment of discovery. Every measurement taken with that instrument since the last successful calibration is now of uncertain validity. This is what makes the impact assessment a mandatory part of the response, not an optional investigation.

Why ISO 9001:2015 Requires an Impact Assessment

Clause 7.1.5.2 of ISO 9001:2015 states that when measuring equipment is found to be unfit for its intended purpose, the organisation shall "determine if the validity of previous measurement results has been adversely affected, and shall take appropriate action as necessary." This is an unconditional requirement — there is no exception for small exceedances, low-risk instruments, or cases where products have already been shipped.

The reasoning is straightforward: if a gauge that was used to make quality decisions was not performing within its specified limits, the quality decisions made with it may have been wrong. Products that were accepted may be non-conforming. Products that were rejected may have been unnecessarily scrapped. The assessment determines which of these scenarios applies and what — if anything — needs to be done.

For UK manufacturers working under AS9100 Rev D, the requirement is restated with additional emphasis on traceability and corrective action. Customer flow-downs in aerospace, defence, and medical device supply chains typically make an explicit OOT investigation a contractual obligation, not just a standard requirement. In these sectors, an undocumented OOT event discovered during a customer or third-party audit can trigger not just a non-conformance but a stop-ship or product recall notice.

What an OOT Impact Assessment Must Contain

ISO 9001:2015 does not prescribe a specific format, but auditors and certification bodies consistently expect an OOT impact assessment to address four questions. The record should be explicit on all four:

1. What was the nature and magnitude of the out-of-tolerance condition? — Record the measured values returned at calibration, the tolerance limits, and the degree of exceedance. A gauge that returned 0.02 mm outside a ±0.05 mm tolerance is a very different risk from one that returned 0.15 mm outside the same limit. The exceedance magnitude informs both the risk assessment and the decision on corrective action.
2. What was the affected measurement window? — Identify the period during which the instrument was potentially out of tolerance. This is covered in detail in the section below, as it is frequently the most technically challenging part of the assessment.
3. What was measured with the instrument during that window? — Identify the products, batches, part numbers, or processes for which the gauge was used to make quality decisions during the affected period. This may require consulting production records, inspection logs, job cards, or calibration booking records.
4. What is the risk, and what action was taken? — Based on the exceedance magnitude and what was measured, determine whether any products may have been incorrectly accepted or rejected, and what action is appropriate. Document the decision and the outcome.

How to Determine the Affected Measurement Window

The affected measurement window — the period during which the instrument may have been out of tolerance — runs from the date of the last known-good calibration to the date the OOT condition was discovered. This is the conservative, defensible position: because calibration cannot tell you when during the interval the drift occurred, the entire interval since the last pass is treated as potentially affected.

In practice, the window is bounded by:

• Start date: The date of the most recent calibration that the instrument passed — not the date it was last used, or the date it was sent for calibration, but the date the previous calibration was performed and the result was confirmed as within tolerance.
• End date: The date the OOT condition was discovered — typically the date the calibration report was received showing the failure.

Some organisations attempt to narrow the window using intermediate checks, operator observations, or production data (for example, if a dimensional gauge is cross-checked against a reference part at the start of each shift, a shift-level log may allow the window to be tightened). These approaches are legitimate if the intermediate checks are themselves documented and traceable, but they require careful justification and should not be used informally to make the problem appear smaller than it is.

Risk Assessment: What Action Is Appropriate?

Once the affected window and the scope of measurements are established, the impact assessment must determine the risk and the proportionate response. This is not a pass/fail decision — it is a risk judgement that should be informed by the following factors:

• Magnitude of exceedance relative to product tolerance: An instrument that drifted by 5% of its tolerance range in a process where the product tolerance is ten times the instrument tolerance may present negligible product risk. An instrument that drifted by 50% of its tolerance range in a tight-tolerance application presents a significant one.
• Nature of the affected measurements: Were the measurements used for acceptance of finished goods released to customers? Were they intermediate in-process checks where subsequent operations would have caught a non-conformance? Were they dimensional, pressure, torque, or temperature — and does the exceedance direction (high or low) matter for the product function?
• Traceability of affected product: Can the specific batches, serial numbers, or part numbers measured with the instrument during the affected window be identified? If they can, the assessment can be targeted. If not, the assessment must be broader and the risk statement must reflect that uncertainty.
• Current location of affected product: Product still in your facility can be quarantined and re-inspected. Product in your customer's stock or already in service presents a different and more complex risk profile requiring customer notification.

Proportionate actions range from a documented decision that the risk is negligible and no product action is required (with the reasoning stated clearly), through targeted re-inspection of specific batches, to a broader product recall or customer notification in the most serious cases. The action taken must be recorded, and the record must make clear that a considered decision was made — not that the assessment was skipped.

Closing the Corrective Action

An OOT event is not closed when the gauge is recalibrated. It is closed when three things are complete:

1. The immediate containment action is resolved — The affected product has been assessed and appropriate action taken (re-inspection, customer notification, or a documented no-action decision with rationale).
2. The root cause has been identified and addressed — Why did the instrument go out of tolerance? Was the interval too long? Was the instrument damaged? Was it stored incorrectly? The corrective action should address the cause, not just the symptom. An OOT finding closed with "recalibrated and returned to service" and no root-cause analysis will attract an auditor's attention.
3. Systemic prevention has been considered — Is the same type of failure likely to occur on other instruments? Does the interval for this gauge or similar gauges need to be shortened? Does the handling or storage procedure need to change? ISO 9001:2015 clause 10.2 requires that corrective action considers whether similar non-conformances could exist or potentially occur elsewhere.

The corrective action record should link the OOT assessment to the root cause, the preventive action, and the evidence of effectiveness. For organisations managing calibration under AS9100 Rev D, this linkage is particularly important — assessors will follow the chain from OOT event to closure during surveillance audits.

How Calibration Management Software Supports OOT Assessments

The most time-consuming part of an OOT assessment is assembling the evidence: identifying the affected window, tracing which production records reference the instrument during that period, and building a defensible documentary trail. Calibration management software addresses this directly by:

• Maintaining a complete calibration history for each instrument, making the last-pass date immediately retrievable without searching paper records
• Logging each calibration event with date, result, and reference standard — establishing the factual basis for the affected window
• Providing a structured OOT assessment form that captures all four required elements (exceedance, window, affected measurements, and action taken) in a single, audit-ready record
• Linking the OOT record to the corrective action, so assessors can navigate from the OOT finding to the closure evidence in one step
• Automatically prompting an interval review when an OOT finding is recorded, ensuring that root-cause consideration is built into the process rather than left to individual memory

Frequently Asked Questions

Is an OOT impact assessment required for every failed calibration?

Yes. ISO 9001:2015 clause 7.1.5.2 requires that the organisation determines whether previous measurement results have been adversely affected whenever measuring equipment is found to be unfit for its intended purpose. There is no de minimis threshold — the requirement applies to all OOT findings, regardless of how small the exceedance. The proportionality is in the action taken, not in whether the assessment is done.

What if no products were measured with the gauge during the affected window?

This is a valid and legitimate outcome of the assessment — but it must be documented. If records show that the gauge was in storage, awaiting repair, or was only used for a purpose unrelated to product acceptance during the affected window, the assessment should state this explicitly with reference to the supporting records. A conclusion of "no product impact" is acceptable; an absent assessment is not.

Do we need to notify customers if affected product has been shipped?

This depends on the risk assessment outcome, your contractual obligations, and any applicable regulatory requirements. ISO 9001:2015 does not mandate customer notification in all cases — it requires appropriate action. In practice, many customer contracts and sector standards (AS9100, ISO 13485, IATF 16949) impose explicit notification obligations. When in doubt, consult your legal counsel and your customer's quality team.

How long should OOT assessment records be retained?

ISO 9001:2015 does not specify a minimum retention period for calibration records, but most organisations apply a minimum of three years (aligned with the surveillance audit cycle) or the product liability period, whichever is longer. In aerospace, defence, and medical device sectors, retention periods of 10 years or more are common and may be contractually mandated. OOT assessment records should be retained for at least as long as the calibration records they relate to.

References

• ISO 9001:2015 Quality management systems — Requirements, clauses 7.1.5 and 10.2, International Organization for Standardization
• AS9100 Rev D Quality Management Systems — Requirements for Aviation, Space, and Defense Organizations, SAE International
• ILAC-G24 / OIML D 10:2007 Guidelines for the determination of calibration intervals of measuring instruments, International Laboratory Accreditation Cooperation
• UKAS, United Kingdom Accreditation Service — ukas.com
• NPL, National Physical Laboratory — npl.co.uk

What Does ISO 9001:2015 Clause 7.1.5 Actually Require?

Clause 7.1.5 has two sub-clauses:

• 7.1.5.1 General — The organisation must determine what resources are needed to ensure valid and reliable monitoring and measurement results, and must ensure those resources are maintained fit for purpose.
• 7.1.5.2 Measurement traceability — Where traceability is a requirement, instruments must be calibrated or verified at specified intervals against national or international measurement standards. If no such standard exists, the basis for calibration must be documented. The organisation must take appropriate action when equipment is found to be out of specification.

ISO 9001:2015 is held by over 1.09 million organisations in 178 countries, according to the ISO Survey 2023. For UK aerospace and defence manufacturers, the equivalent requirements appear in AS9100 Rev D clause 7.1.5, which extends the ISO 9001 baseline with additional traceability and record-keeping obligations.

What Evidence Do ISO Auditors Look For?

When an assessor arrives at your facility and opens clause 7.1.5, they will typically ask to see:

1. A gauge register — A complete list of every measuring instrument used to make quality decisions, including make, model, serial number, location, and calibration interval.
2. Calibration records for each instrument — The date calibrated, the standard used, the result, and who performed the calibration. External calibrations should be supported by a UKAS-accredited certificate where traceability is required.
3. Evidence of traceability — A chain linking each instrument through its reference standards back to a national or international measurement standard (typically NPL in the UK via UKAS-accredited bodies).
4. Due-date control — How the organisation ensures instruments are recalled and recalibrated before their intervals expire. Assessors commonly ask: "What happens if a gauge goes overdue?"
5. Out-of-tolerance records — If a gauge has ever failed calibration, there must be a documented assessment of whether the products measured while that gauge was out of tolerance were affected. This is called an OOT (out-of-tolerance) impact assessment.

How to Build a UKAS-Traceable Calibration Record

UKAS (the United Kingdom Accreditation Service) accredits over 2,400 organisations to perform calibration, testing, inspection, and certification. A UKAS-traceable calibration record demonstrates that your instrument's calibration was performed against a reference standard that is itself traceable — through an unbroken chain — to national measurement standards maintained by the National Physical Laboratory (NPL).

A complete traceability chain looks like this:

Each link in that chain must be documented. For external calibrations, the UKAS certificate number and laboratory details form the record. For internal calibrations performed against in-house reference standards, you must document what that reference standard is and when it was last calibrated against a UKAS-traceable source.

Common Calibration Non-Conformances Found in ISO 9001 Audits

The following non-conformances appear regularly in audit reports for UK manufacturers:

• Missing instruments — The gauge register is incomplete. Instruments on the shop floor that are used to make quality decisions are not listed and have no calibration records.
• Overdue calibrations — Instruments past their due date are still in use. This is a major non-conformance because it means quality decisions were potentially made with an unverified instrument.
• No OOT assessment — A gauge failed calibration and was simply sent for recalibration, with no investigation into what was measured while it was out of tolerance.
• Broken traceability chain — External calibration certificates are present, but the in-house reference standard used for internal calibrations has not itself been calibrated by a UKAS-accredited body.
• Spreadsheet not updated — The paper or spreadsheet register does not reflect what is actually on the floor. Instruments have been added, moved, or scrapped without the records being updated.
• No calibration interval defined — Instruments are calibrated "when we remember" with no defined recall period.

Internal vs. External Calibration: Which Instruments Need Which?

ISO 9001:2015 does not require every instrument to be calibrated by an external UKAS-accredited laboratory. Internal calibration is acceptable where:

• The organisation has a reference standard that is itself UKAS-traceable
• The calibration method is documented
• The person performing the calibration is competent to do so
• The calibration record captures the result, the standard used, and the tolerance judgement

As a practical guide: high-precision instruments (CMMs, optical comparators, force gauges used for critical measurements) are typically sent externally. Day-to-day working gauges (callipers, micrometers, torque wrenches) are frequently calibrated internally against a reference standard that has been externally certified.

How Calibration Management Software Helps

Managing calibration compliance in a spreadsheet works for a handful of instruments but breaks down quickly as the gauge population grows. The most common failure mode is a due date missed because the spreadsheet was not checked. The second most common is an overdue instrument discovered during an audit.

A purpose-built calibration management system addresses this by:

• Maintaining a live gauge register where every instrument has a calibration interval and a calculated due date
• Flagging instruments as due or overdue automatically — without anyone having to check a spreadsheet
• Recording internal calibration readings against configurable tolerance bands, with automatic pass/fail judgement
• Capturing OOT impact assessments when a gauge fails, creating the documentary trail assessors require
• Generating one-click compliance snapshots and PDF calibration certificates for audit evidence
• Linking each calibration event to the reference standard used, building the traceability chain automatically

Frequently Asked Questions

Does every instrument need to be UKAS-calibrated?

No. UKAS calibration is required for reference standards and for instruments where external accreditation is a contractual or regulatory requirement. Working gauges used for internal quality decisions can be calibrated internally, provided your internal reference standard is itself UKAS-traceable and the calibration method and result are documented.

How often do instruments need to be calibrated?

ISO 9001:2015 requires calibration "at specified intervals" but does not mandate a specific frequency. Intervals are set based on instrument type, usage intensity, manufacturer recommendation, and the consequences of a failure. Common intervals range from 6 months for frequently used precision instruments to 2 years for less critical equipment. Intervals should be reviewed and adjusted if instruments are regularly found to be out of tolerance.

What must an OOT impact assessment include?

An OOT impact assessment must identify: (1) the period during which the instrument was potentially out of tolerance (from the last known good calibration to the date the failure was discovered), (2) what was measured with the instrument during that period, (3) what risk that presents to product quality, and (4) what corrective action was taken. The assessment should be formally recorded and retained.

Can we use a spreadsheet to manage calibration?

A spreadsheet can satisfy the record-keeping requirements of ISO 9001:2015 clause 7.1.5 if it contains the necessary information and is kept up to date. In practice, the risk is that due dates are missed because no one checks the spreadsheet, or that records are not updated when instruments change status. Many organisations find spreadsheet management acceptable during initial certification but switch to dedicated software as the gauge population grows and audit frequency increases.

What happens if an instrument is found out of tolerance at audit?

If an auditor discovers an overdue or out-of-tolerance instrument that has been in use, this is typically a major non-conformance under clause 7.1.5. The corrective action required will include: withdrawing the instrument from service, performing an OOT impact assessment on any products measured with it, and demonstrating that the systemic failure (why was the due date missed?) has been addressed. A major non-conformance may result in a follow-up audit before continued certification is confirmed.

References

• ISO 9001:2015 Quality management systems — Requirements, International Organization for Standardization
• AS9100 Rev D Quality Management Systems — Requirements for Aviation, Space, and Defense Organizations, SAE International
• ISO Survey 2023, International Organization for Standardization
• UKAS, United Kingdom Accreditation Service — ukas.com
• NPL, National Physical Laboratory — UK's National Measurement Institute — npl.co.uk

What is UKAS?

UKAS stands for the United Kingdom Accreditation Service. It is the sole national accreditation body for the United Kingdom, appointed by the government under the European Regulation on Accreditation (EC 765/2008) — retained in UK law after Brexit. UKAS operates under a Memorandum of Understanding with the government and is a non-profit company.

UKAS accredits organisations across four main activities:

• Calibration laboratories — Accredited to ISO/IEC 17025, the international standard for testing and calibration laboratory competence
• Testing laboratories — Environmental, mechanical, chemical, and other testing
• Inspection bodies — Accredited to ISO/IEC 17020
• Certification bodies — Including those that issue ISO 9001 certificates to manufacturers

As of 2024, UKAS accredits over 2,400 organisations across the UK. For calibration specifically, UKAS-accredited laboratories are assessed against ISO/IEC 17025:2017, which covers both the management requirements and the technical competence requirements a laboratory must demonstrate before it can issue accredited calibration certificates.

What is the National Physical Laboratory (NPL) and How Does it Relate to UKAS?

The National Physical Laboratory (NPL), based in Teddington, is the UK's national measurement institute. NPL maintains the UK's primary measurement standards — the most fundamental references for quantities including length, mass, time, temperature, electrical current, and more. These primary standards are the ultimate reference point for all traceable measurement in the UK.

The relationship between NPL and UKAS works like this: UKAS-accredited calibration laboratories calibrate their own reference standards against NPL's national standards. This creates a formal, documented link — called a traceability chain — that connects any instrument calibrated by a UKAS-accredited lab all the way back to the national standard. That unbroken chain is what "UKAS-traceable calibration" means in practice.

Why Does UKAS Accreditation Matter for ISO 9001?

ISO 9001:2015 clause 7.1.5.2 requires that where measurement traceability is a requirement, measuring instruments must be calibrated against national or international measurement standards. The standard goes on to state that calibration records must document the reference standard used.

UKAS accreditation is the mechanism that provides this traceability in the UK. When your external calibration certificate comes from a UKAS-accredited laboratory, the certificate carries a reference to the accreditation body (UKAS) and the scope of accreditation, giving auditors confidence that:

1. The laboratory performing the calibration has been independently assessed as technically competent
2. The reference standards used by the laboratory are themselves traceable to national standards (NPL)
3. The calibration methodology, uncertainty calculations, and record-keeping meet ISO/IEC 17025 requirements
4. The calibration certificate is a reliable documentary record that an ISO assessor can accept as evidence of traceability

In practice, most ISO 9001 auditors will look at your external calibration certificates and check whether the issuing laboratory is UKAS-accredited. A certificate from a non-accredited laboratory does not, on its own, provide the traceability that clause 7.1.5.2 requires.

The Difference Between UKAS-Accredited and Non-Accredited Calibration

This distinction trips up many organisations. There are two common misunderstandings:

Misunderstanding 1: "We have a calibration certificate, so we're traceable"

Not all calibration certificates are equal. Any organisation can issue a document labelled "calibration certificate." What matters is whether the issuing laboratory is UKAS-accredited for the type of calibration performed. A certificate issued by a non-accredited laboratory does not provide formal traceability to national standards, because the competence of the issuing lab has not been independently verified and its own reference standards may not be NPL-traceable.

Misunderstanding 2: "UKAS-accredited means the laboratory is better"

UKAS accreditation is not a quality ranking — it is a formal confirmation of competence. A non-accredited laboratory may perform excellent work. However, from an ISO 9001 audit perspective, only UKAS-accredited certificates provide the documented traceability chain that clause 7.1.5.2 requires. For most UK manufacturers, using UKAS-accredited calibration for external instruments is the simplest way to satisfy this requirement.

The key differences in summary:

How to Verify That a Calibration Laboratory is UKAS-Accredited

UKAS publishes a searchable directory of all accredited organisations at ukas.com/find-an-organisation. Before sending instruments to an external calibration house, you can verify accreditation status in three ways:

1. Search the UKAS directory — Search by organisation name, location, or accreditation number. The directory shows the accreditation scope, which lists the specific measurement parameters the laboratory is accredited to calibrate. This is important: a laboratory may be UKAS-accredited for dimensional calibration but not for pressure measurement.
2. Check the UKAS schedule on the certificate — A valid UKAS-accredited calibration certificate will carry the UKAS logo and a unique accreditation number. The certificate will also reference the schedule of accreditation (the formal list of what the lab is accredited to do) and the scope under which the specific calibration was performed.
3. Verify the accreditation number directly — UKAS accreditation numbers follow a standard format (e.g. 0000 for laboratories). You can cross-reference the number on a certificate against the UKAS directory to confirm it is current and covers the relevant measurement type.

A common audit finding is that an organisation holds calibration certificates from a laboratory that is UKAS-accredited, but the specific calibration type (e.g. torque, pressure) is outside the laboratory's accreditation scope. Always check the scope, not just the presence of the UKAS logo.

When Do You Need UKAS-Accredited Calibration?

ISO 9001:2015 does not require every instrument to be sent to a UKAS-accredited laboratory. The standard requires traceability where traceability is a stated requirement — which leaves room for interpretation. In practice, the following situations almost always call for UKAS-accredited calibration:

• Reference standards used for internal calibration — If you perform internal calibration of working gauges against in-house reference standards, those reference standards must themselves be calibrated by a UKAS-accredited laboratory. This is the foundation of your traceability chain.
• High-value or critical measurements — Instruments whose readings directly determine product acceptance or rejection for safety-critical applications (aerospace, medical, defence) are nearly always sent externally to UKAS-accredited labs.
• Contractual or customer requirements — Many tier-1 customers and OEMs mandate UKAS-accredited calibration for instruments used on their supply chain. This is common in aerospace (AS9100), automotive, and nuclear sectors.
• Where measurement uncertainty matters — UKAS-accredited certificates must state measurement uncertainty. If your process requires knowledge of measurement uncertainty to judge conformance, a UKAS certificate is the reliable source of that information.

UKAS Accreditation and Internal Calibration

Many organisations calibrate their day-to-day working gauges internally — using in-house calibration technicians and reference standards — rather than sending every instrument to an external laboratory. This is entirely acceptable under ISO 9001:2015, provided:

• The in-house reference standards are themselves calibrated by a UKAS-accredited laboratory
• The internal calibration method is documented
• The calibration technician is competent (trained, qualified, and recorded as such)
• The calibration result — including the readings taken and the pass/fail judgement — is formally recorded

The UKAS-accredited certificate for the reference standard is the anchor point for your entire internal calibration programme. It is the document that an auditor will trace back to when verifying the traceability of your working gauges.

How to Record UKAS Traceability in Your Calibration Management System

For each instrument in your gauge register, you should be able to trace its calibration to a UKAS-accredited source. The records required depend on whether calibration is performed internally or externally:

• External UKAS calibration: Retain the original UKAS-accredited certificate. Record the certificate reference number, the accredited laboratory name and UKAS number, the date of calibration, the result, and the next due date.
• Internal calibration: Record the date calibrated, the reference standard used (including its UKAS certificate reference and due date), the calibration method followed, the readings taken at each test point, the pass/fail result, and the technician who performed the calibration.

This level of documentation is what assessors mean when they ask for "evidence of traceability." A calibration sticker on the instrument alone is not sufficient — the underlying record must exist and must be retrievable.

Frequently Asked Questions

Is UKAS the same as ISO 9001 certification?

No. ISO 9001 certification is a quality management standard that organisations achieve by having their quality system assessed by a certification body. UKAS accreditation is a separate process that confirms a laboratory's technical competence to perform calibration, testing, or inspection. The two are related but distinct: UKAS accredits the certification bodies that issue ISO 9001 certificates, and ISO 9001 requires calibration traceability that UKAS-accredited laboratories provide.

Can a non-UK laboratory provide traceable calibration?

Yes. UKAS is a member of ILAC (the International Laboratory Accreditation Cooperation) and EA (European Accreditation). Calibration certificates from laboratories accredited by other ILAC-member bodies — such as DAKKS (Germany), COFRAC (France), or A2LA (USA) — carry equivalent traceability status and are generally accepted by UK ISO 9001 auditors. Check that the foreign accreditation body is an ILAC signatory.

How do I know if my calibration certificate is genuinely UKAS-accredited?

Look for the UKAS crown logo and an accreditation number on the certificate. Then verify the number and scope at ukas.com/find-an-organisation. Ensure the specific measurement type (e.g. dimensional, torque, pressure) is within the laboratory's accreditation scope and that the accreditation was current on the date of calibration.

What happens if I use a non-accredited laboratory?

Using a non-accredited laboratory for instruments that require traceable calibration is a risk at ISO 9001 audit. An assessor may raise a non-conformance under clause 7.1.5.2 on the basis that traceability has not been demonstrated. The corrective action would typically require recalibrating affected instruments through a UKAS-accredited laboratory and assessing any impact on products measured in the interim.

Do UKAS-accredited certificates expire?

The certificate itself does not expire, but the calibration it documents relates to a specific point in time. Your calibration management system should record the next due date for each instrument and recall it for recalibration before that date passes. The UKAS accreditation of the issuing laboratory is also subject to ongoing surveillance audits; if a laboratory loses its accreditation after issuing a certificate, certificates already issued remain valid as historical records.

References

• UKAS, United Kingdom Accreditation Service — ukas.com
• ISO/IEC 17025:2017 General requirements for the competence of testing and calibration laboratories, International Organization for Standardization
• ISO 9001:2015 Quality management systems — Requirements, International Organization for Standardization
• NPL, National Physical Laboratory — npl.co.uk
• ILAC, International Laboratory Accreditation Cooperation — ilac.org

What ISO 9001 Actually Requires on Calibration Intervals

Clause 7.1.5.2 states that where measurement traceability is required, measuring instruments shall be calibrated or verified at specified intervals, or prior to use, against measurement standards traceable to international or national measurement standards. The standard imposes two requirements on intervals:

1. The interval must be specified — "calibrated when we remember" or "when it looks off" does not satisfy clause 7.1.5.2. A defined, documented interval must exist for every instrument used to make a quality decision.
2. The interval must be appropriate — While ISO 9001 does not mandate specific numbers, auditors will challenge intervals that appear arbitrary or that are not supported by any rationale. An interval of "10 years" for a precision calliper in daily shop-floor use, for example, would attract scrutiny.

ILAC-G24 / OIML D 10 (the international guidance document on calibration intervals) provides the industry-accepted framework for how intervals should be set and reviewed. UK quality managers working under AS9100 Rev D will find that the aerospace standard places additional emphasis on documented interval justification.

The Six Factors That Determine the Right Calibration Interval

1. Manufacturer's Recommendation

The starting point for any new instrument is the manufacturer's recommended calibration interval. Manufacturers typically specify this in the product manual based on the instrument's designed measurement uncertainty, typical drift rate, and expected operating conditions. Common manufacturer recommendations range from 6 months to 2 years.

The manufacturer's recommendation is a sensible default but should not be treated as immutable. It is based on typical use conditions and does not account for your specific environment, usage intensity, or the consequences of an out-of-tolerance finding in your process.

2. Usage Frequency and Intensity

An instrument used 50 times a day in a production environment will accumulate wear, potential damage, and drift at a far higher rate than the same instrument used twice a week for incoming goods inspection. High-frequency usage is one of the strongest arguments for a shorter interval than the manufacturer recommends.

Practical considerations include: is the instrument handled by multiple operators? Is it transported between locations? Is it used near vibration sources or at temperature extremes? Each of these factors accelerates drift and increases the probability that an instrument is out of tolerance at any given point.

3. Environmental Conditions

Measurement equipment is sensitive to its environment. Temperature fluctuations, humidity, vibration, and contamination all affect calibration stability. An instrument stored and used in a temperature-controlled metrology room will hold calibration far longer than an identical instrument used on a hot, vibration-intensive press shop floor.

ISO/IEC 17025 recognises this explicitly — calibration laboratories control their environmental conditions precisely because environment affects measurement reliability. For instruments used in harsh conditions, shorter intervals are the appropriate response.

4. Historical Calibration Performance

The most reliable predictor of future out-of-tolerance findings is past out-of-tolerance findings. If your calibration records show that an instrument consistently returns within tolerance with a comfortable margin at each calibration, the data supports a longer interval. If the same instrument frequently returns near or outside its tolerance limits, the data supports a shorter interval.

This is the foundation of the ILAC-G24 approach to interval adjustment: use the accumulated evidence from past calibrations to make data-driven decisions about future intervals. Reviewing this evidence is also a demonstrable act of continual improvement — the kind of behaviour ISO 9001 auditors look for.

5. Consequences of an Out-of-Tolerance Finding

Risk is a key input to interval setting. For a gauge used to measure a non-critical dimension on an internal component with a wide tolerance, an out-of-tolerance finding may have limited product impact. For a torque wrench used to tighten safety-critical fasteners, an out-of-tolerance finding could require a full product recall.

Instruments with high consequences of failure should have shorter calibration intervals, regardless of how well they have performed historically. This is the risk-based thinking that ISO 9001:2015 calls for throughout the standard.

6. Regulatory and Contractual Requirements

Some sectors mandate maximum calibration intervals for specific instrument types. AS9100 Rev D customer requirements, ATEX certification, medical device regulations (ISO 13485), and sector-specific customer flow-downs may all impose interval limits that override your internal judgement. Always check whether any external requirement constrains the interval before setting it.

How to Document the Interval Rationale

ISO 9001:2015 requires that calibration decisions can be evidenced. While the standard does not mandate a specific format for interval documentation, auditors will expect you to be able to explain why a given interval was chosen. Best practice is to record the following for each instrument or instrument type:

• Manufacturer recommended interval (from the product manual)
• Justification for any deviation from the manufacturer's recommendation — either shorter (due to usage intensity, environment, or risk) or longer (if calibration history supports it and the instrument is low-risk)
• Date the interval was set or last reviewed
• Who approved the interval (e.g. Quality Manager)
• Any external requirements that constrain the interval (customer flow-downs, regulatory requirements)

This documentation does not need to be lengthy. A single row in a calibration management system or a one-paragraph note on an instrument record is sufficient, provided it records the reasoning and the reviewer. What is not acceptable is an interval with no documented basis.

When to Shorten Intervals: The OOT Trigger

An out-of-tolerance (OOT) finding is a clear signal that the current interval may be too long. When a gauge returns from calibration having drifted outside its tolerance band, the calibration management process should include an automatic review of the interval — not just recalibration at the same frequency.

The interval review after an OOT finding should consider:

1. How far out of tolerance was the instrument? — A minor exceedance close to the tolerance limit may be a one-off event; a significant exceedance suggests systematic drift that the current interval is not catching.
2. Has this instrument failed before? — A single OOT finding may not justify shortening the interval. Two consecutive failures almost certainly do.
3. What was the likely mid-point of the exceedance period? — The instrument was last calibrated X months ago and is now out of tolerance. Was it probably drifting continuously, or is the failure more likely recent? This affects both the interval decision and the OOT impact assessment scope.
4. What was the product impact? — A high-consequence OOT finding (parts measured, released to customers) strengthens the case for immediate interval shortening.

The interval adjustment should be formally recorded — not just implemented silently. Auditors reviewing an OOT corrective action will look for evidence that the root cause was addressed, and "interval too long" is a common root cause.

When to Lengthen Intervals: Using Calibration History

Interval optimisation works in both directions. If calibration records consistently show that an instrument returns well within tolerance — with significant margin remaining — there is a data-supported case for extending the interval. Lengthening intervals for well-performing instruments frees up laboratory capacity and reduces cost, while maintaining the same level of measurement assurance.

ILAC-G24 recommends a structured approach to interval extension:

• Review a minimum of three consecutive calibration results before considering an extension
• The instrument should have returned within tolerance on all three occasions, with a comfortable margin
• The extension should be modest (e.g. adding 20–30% to the existing interval) rather than a large step change
• The decision and the supporting calibration history should be recorded
• The extended interval should be reviewed again after the next calibration under the new schedule

Common Calibration Interval Mistakes and How to Avoid Them

• Setting the same interval for every instrument — Applying a blanket 12-month interval to all gauges regardless of type, usage, or risk is a common shortcut that does not reflect the actual characteristics of the gauge population. Auditors will notice.
• Never reviewing intervals — Setting an interval once and never revisiting it, even after OOT findings or changes in usage, is inconsistent with the continual improvement requirements of ISO 9001:2015.
• Interval not recorded anywhere — If the calibration interval for a gauge exists only in someone's memory or on a label that cannot be related back to a documented decision, there is no basis for the auditor to verify it.
• Ignoring manufacturer guidance entirely — While manufacturer recommendations are not mandatory starting points, completely ignoring them without documentation invites audit questions about the basis for the chosen interval.
• Treating the interval as the due date — The interval is the maximum time between calibrations. Instruments that are heavily used or operating in adverse conditions may benefit from calibration before the interval expires.

How Calibration Management Software Supports Interval Management

Managing calibration intervals manually — across dozens or hundreds of instruments with different intervals, different last-calibration dates, and different risk levels — is one of the most error-prone tasks in a calibration programme. The most common failure mode is a due date missed because no one checked the spreadsheet.

A purpose-built calibration management system helps by:

• Storing the calibration interval and last-calibration date for each instrument, and calculating the next due date automatically
• Flagging instruments as approaching due, due, or overdue — without requiring anyone to manually check a list
• Maintaining a calibration history for each instrument, making it straightforward to review past results when deciding whether to extend or shorten an interval
• Recording the interval rationale alongside the instrument record, so the basis for the decision is always retrievable
• Triggering an interval review prompt automatically when an OOT finding is recorded
• Generating compliance reports that show every instrument's interval, due date, and last-calibration result in a single view

Frequently Asked Questions

Is there a minimum calibration interval required by ISO 9001?

No. ISO 9001:2015 does not specify any minimum or maximum calibration interval. The requirement is that an interval is specified, documented, and appropriate for the instrument and its use. What "appropriate" means in practice is determined by the six factors covered in this guide: manufacturer recommendation, usage frequency, environment, historical performance, consequence of failure, and any external requirements.

Can different instruments of the same type have different intervals?

Yes, and this is often the correct approach. Two identical micrometers, one used in a temperature-controlled laboratory and one on a busy production line, may appropriately have different calibration intervals. The documented rationale for each should reflect the actual conditions of use.

What is the most common calibration interval for callipers and micrometers?

For typical manufacturing environments, 6 to 12 months is the most common interval for handheld dimensional gauges such as callipers and micrometers. Instruments in light use or stored in controlled conditions may be calibrated annually or biannually. Instruments in intensive shop-floor use may be calibrated every 3 to 6 months. The right answer depends on the specific conditions of use and the calibration history.

Must we shorten an interval every time an instrument fails calibration?

Not necessarily, but a documented review is required. A single OOT finding may be attributable to a specific event (a known drop or misuse) rather than systematic drift. If the cause is known and isolated, the interval may not need to change. If the cause is unknown or the failure is a repeat, shortening the interval is the appropriate response. The review and decision must be recorded.

How do we handle instruments that are used only occasionally?

For instruments in infrequent use, time-based intervals may not be the most appropriate approach. Some organisations calibrate rarely-used instruments "before use" rather than on a fixed calendar schedule. This is acceptable under ISO 9001:2015 (the standard permits calibration "at specified intervals, or prior to use") provided the decision is documented and the instrument is stored appropriately to prevent condition changes between uses.

References

• ISO 9001:2015 Quality management systems — Requirements, clause 7.1.5, International Organization for Standardization
• ILAC-G24 / OIML D 10:2007 Guidelines for the determination of calibration intervals of measuring instruments, International Laboratory Accreditation Cooperation
• AS9100 Rev D Quality Management Systems — Requirements for Aviation, Space, and Defense Organizations, SAE International
• UKAS, United Kingdom Accreditation Service — ukas.com
• NPL, National Physical Laboratory — npl.co.uk

What AS9100 Rev D Clause 7.1.5 Adds to ISO 9001

AS9100 Rev D clause 7.1.5 opens with: "The organisation shall retain documented information as evidence of fitness for purpose of the monitoring and measurement resources." It then adds several aerospace-specific notes and requirements that do not appear in the ISO 9001:2015 text:

1. Documented calibration or verification records must include the identification of the measurement standard used, the environmental conditions (where relevant), the calibration results before and after any adjustment, and the next calibration due date.
2. Calibration status identification — All measurement and test equipment shall have a label, tag, or other identification indicating calibration status, including the date of the last calibration, and either the due date or the interval.
3. Recall system — A method for recalling measurement and test equipment due for calibration or verification must be established.
4. Safeguarding from adjustment — Equipment must be protected from adjustments, damage, and deterioration that would invalidate the calibration status. This includes appropriate storage, handling, and maintenance procedures.
5. Documented OOT response process — The standard explicitly requires a documented procedure for handling out-of-tolerance findings, including notification to the customer where the measurement results may have affected deliverable product.

The AS9100 Calibration Record: What Must It Contain?

Where ISO 9001:2015 refers broadly to "documented information as evidence of fitness for purpose," AS9100 Rev D specifies the content of calibration records more explicitly. A compliant AS9100 calibration record must include:

The "as-found" and "as-left" reading requirement is the one that surprises ISO 9001-only organisations most often. An instrument may be adjusted during calibration to bring it back into specification. AS9100 requires both states to be recorded — the condition when the instrument arrived at calibration (as-found) and its condition after any adjustment (as-left). The as-found reading is the critical one for OOT assessment: it tells you the state of the instrument during the period it was in service since the previous calibration.

The AS9100 Recall System Requirement

AS9100 Rev D requires a documented recall system for measurement and test equipment approaching its calibration due date. A recall system is any reliable mechanism that ensures instruments are identified, retrieved from service, and submitted for calibration before the due date passes — without relying on individuals to remember.

In practice, a compliant recall system typically includes:

• A central gauge register with each instrument's calibration due date
• A defined process (manual or automated) for generating a recall list at a defined lead time before the due date — commonly 4 to 6 weeks
• A defined responsibility for acting on the recall list and withdrawing instruments from service if they are not submitted in time
• Evidence that the recall process has been followed — typically a log of recalls issued and closed

AS9100 auditors commonly test the recall system by picking a sample of instruments and asking to see the recall history. They want to see that the process is documented, that recalls were issued, and that instruments were not in service past their due dates. A spreadsheet that requires manual checking is technically compliant if checked consistently, but the audit finding rate for missed due dates is higher with manual systems.

Calibration Status Labelling Under AS9100 Rev D

Every measuring and test instrument must carry visible calibration status identification. The AS9100 Rev D requirement is that the label or tag shows at minimum:

• The date of the last calibration
• Either the next due date or the calibration interval
• A unique instrument identifier that links the label back to the calibration record

Status labelling serves two purposes. First, it allows anyone on the shop floor to immediately determine whether an instrument is within its calibration period without having to consult a register. Second, it prevents an out-of-date instrument from being used in error — if there is no label or the label shows a past due date, the instrument should be removed from service immediately.

AS9100 auditors will commonly pick up an instrument from the floor and check whether its label is current. Missing or illegible labels are a consistent finding. If instruments are used in environments where paper labels degrade (oils, solvents, temperature extremes), electronic tracking or durable metallic tags should be considered.

The OOT Response Process: AS9100's Most Demanding Calibration Requirement

Out-of-tolerance (OOT) findings require a formal response under AS9100 Rev D. The standard requires that the organisation:

1. Assess the validity of previous measurement results — Determine whether products measured with the out-of-tolerance instrument during the affected period may be non-conforming
2. Take appropriate action on affected products — Which may include quarantine, rework, re-inspection, or customer notification
3. Notify the customer where deliverable product is affected — This is the most operationally significant AS9100 addition. If a gauge used to verify product shipped to a customer is found to be out of tolerance, the customer must be notified

The customer notification obligation is what sets AS9100 OOT response apart from ISO 9001. Under ISO 9001, the OOT response is essentially internal. Under AS9100, if product has been shipped, the OOT event may trigger a formal supplier notification obligation under the customer's quality flow-down — which can include specific timescales, specific documentation, and specific customer approval before corrective action is closed.

Common AS9100 Calibration Non-Conformances

• No as-found data recorded — Instruments sent for external calibration and returned with a certificate that shows only as-left readings. The as-found condition — the state that determines OOT impact — is missing from the record.
• Recall system not documented — An informal arrangement ("we check the spreadsheet every month") with no written procedure, no defined ownership, and no evidence of past recalls.
• OOT events not triggering customer notifications — A gauge used on a customer contract failed calibration, but no customer notification was sent. Common where the OOT procedure exists for internal product but does not address the customer notification obligation.
• Calibration labels not maintained — Labels missing from instruments in active use, or labels with past due dates on instruments still on the shop floor.
• Environmental conditions not recorded — For precision measurements (CMMs, optical instruments, force measurement) where temperature and humidity affect accuracy, the calibration record does not include environmental conditions at the time of calibration.

Frequently Asked Questions

Does AS9100 require all instruments to be externally calibrated?

No. AS9100 Rev D, like ISO 9001:2015, permits internal calibration where the organisation has UKAS-traceable reference standards, documented calibration methods, and competent calibration personnel. The additional AS9100 requirements — as-found/as-left records, environmental conditions, formal recall system, and OOT response process — apply equally to internal and external calibration.

What is the customer notification timescale for an OOT finding?

AS9100 Rev D does not specify a timescale. The obligation is to notify the customer; the specific timescale is typically defined in the customer's purchase order terms, quality flow-down document, or supplier quality requirements manual. Some major aerospace OEMs require notification within 24 to 72 hours of an OOT finding on product shipped within a defined look-back period. Check your customer contracts before an event occurs, not during one.

Do we need to record environmental conditions for all internal calibrations?

AS9100 Rev D says "where relevant." Environmental conditions are relevant where temperature, humidity, or other factors would materially affect the measurement result. This is typically the case for dimensional measurements to tight tolerances, force and torque measurements, and electrical measurements. For a simple go/no-go gauge check with wide tolerances, environmental recording may not be necessary — but the decision not to record should be documented.

We hold ISO 9001 certification already. What do we need to add for AS9100?

For clause 7.1.5 specifically: document and implement as-found/as-left recording on all calibration records; establish a documented recall system with a defined lead time and ownership; review and update your OOT response procedure to include customer notification; ensure all instruments carry compliant status labels; and add environmental condition recording where relevant. Review your calibration management system to confirm it can capture and store all these additional data points.

References

• AS9100 Rev D Quality Management Systems — Requirements for Aviation, Space, and Defense Organizations, SAE International / IAQG
• ISO 9001:2015 Quality management systems — Requirements, International Organization for Standardization
• ISO/IEC 17025:2017 General requirements for the competence of testing and calibration laboratories, International Organization for Standardization
• UKAS, United Kingdom Accreditation Service — ukas.com
• IAQG, International Aerospace Quality Group — iaqg.org

What Is an Out-of-Tolerance Finding?

An out-of-tolerance (OOT) finding occurs when a measuring or test instrument is calibrated and the calibration reveals that its readings deviate from the true value by more than the instrument's specified tolerance. This means that at some point between its last calibration and the current one, the instrument was not performing within its specified accuracy — and quality decisions made using it during that period may have been based on incorrect measurements.

The "as-found" reading — the measurement of the instrument's condition before any adjustment is made — is the critical data point. AS9100 Rev D explicitly requires as-found readings to be recorded. Under ISO 9001:2015 the requirement is less explicit, but the obligation to assess the validity of previous measurement results applies regardless.

The Four Steps of an OOT Assessment

Step 1: Establish the Look-Back Period

The look-back period is the window of time during which the instrument may have been out of tolerance. The conservative approach — and the one auditors expect — is to treat the look-back period as running from the date of the last calibration at which the instrument was found in tolerance to the date of the current OOT finding.

In practice, you may be able to narrow this window if you have corroborating evidence. For example:

• If the instrument was checked against a reference standard at a known intermediate date and was found in tolerance at that point, the look-back period may start from that check rather than the previous formal calibration.
• If there is a known event (a drop, a known impact, an environmental excursion) that could explain the out-of-tolerance condition and the event date is documented, this evidence may support a shorter look-back period — but only if the evidence is reliable and recorded.

Without corroborating evidence, the conservative approach applies: the instrument was potentially out of tolerance for the full interval since its last calibration. If that interval was 12 months, the look-back period is 12 months.

Step 2: Identify Affected Measurements

Within the look-back period, identify every measurement made with the instrument that was used to make a quality decision. This typically involves:

1. Checking production records — Which jobs, batches, part numbers, or inspection reports reference this instrument (by instrument ID) as the tool used for the measurement?
2. Reviewing inspection reports — Identify every inspection or calibration result that was recorded using this gauge during the look-back period.
3. Checking gauge sign-out logs — If the instrument was issued from a tool store or calibration lab on a loan basis, the sign-out log may help identify which jobs it was used on.

The practical difficulty here is directly related to the quality of your instrument usage records. Organisations that record the instrument ID against every measurement result (either on paper travellers or in a quality management system) can trace affected measurements quickly. Organisations that have no instrument usage records face a much wider look-back scope: every measurement of the relevant type made during the look-back period must be considered potentially affected.

Step 3: Assess the Product Risk

Identifying affected measurements is not the same as identifying non-conforming product. The OOT assessment must judge whether the gauge's out-of-tolerance condition was likely to have resulted in incorrect accept/reject decisions. This judgement depends on several factors:

• Magnitude of the deviation — How far outside tolerance was the instrument? A gauge that drifted 0.5% outside a ±5% tolerance band presents very different product risk than one that drifted 15% outside a ±2% band.
• Direction of the deviation — Was the gauge reading high or low? If it was reading high (measuring larger than actual), it would have rejected conforming parts and accepted non-conforming ones in one direction. The direction of bias determines which accept/reject decisions are affected.
• Product tolerance vs. gauge deviation — Compare the product's dimensional or measurement tolerance to the gauge's out-of-tolerance magnitude. If the product tolerance is much wider than the gauge's deviation, the OOT condition may not have affected the conformance decision for any parts.
• Nature of the measurement — Was the measurement used to accept parts that were shipped? Or was it used for an internal check that was subsequently verified by another means? A final inspection measurement carries more risk than an in-process check that was followed by final inspection with a different instrument.

The outcome of the risk assessment must be recorded with reasoning. The conclusion may be: (a) the OOT condition was unlikely to have resulted in non-conforming product being accepted; (b) the OOT condition may have affected a defined set of measurements that should be reviewed; or (c) the OOT condition likely resulted in non-conforming product being accepted, requiring containment action.

Step 4: Take and Record Corrective Action

The appropriate corrective action depends on the outcome of the risk assessment:

Under AS9100 Rev D, where any deliverable product is included in the affected scope, customer notification is a requirement — not a discretionary choice. The method and timescale for notification is typically defined in the customer's supplier quality requirements or purchase order terms.

What the OOT Assessment Record Must Contain

For ISO 9001 and AS9100 compliance, the OOT assessment record should include:

1. Instrument identification — ID, description, serial number, and last calibration certificate reference
2. As-found calibration result — The specific readings that demonstrated the out-of-tolerance condition, and the tolerance that was exceeded
3. Look-back period — Start and end dates, and the basis for the start date (previous calibration, verified intermediate check, or known event)
4. List of affected measurements or products — Specific jobs, batches, part numbers, or inspection reports identified as potentially affected. If no specific records can be linked, document why and state the scope of the uncertainty.
5. Risk assessment reasoning — The judgement on whether the OOT condition is likely to have resulted in non-conforming product being accepted, with the basis for that judgement (deviation magnitude, direction, product tolerance)
6. Corrective actions taken — Re-inspection scope, disposition of affected product, customer notification (if applicable), gauge recalibration, interval review
7. Assessment completed by and date — Authorship and date for traceability
8. Authorisation — Approval by the Quality Manager or equivalent

The Interval Review After an OOT Finding

An OOT finding is a signal that the current calibration interval may be too long. The calibration management process should prompt a formal interval review whenever an OOT finding is recorded. The review should consider:

• How significantly out of tolerance was the instrument at the point of discovery?
• Has this instrument failed calibration before? If so, is there a pattern?
• Has the instrument's usage or environment changed since the interval was last set?
• What is the appropriate interval reduction to reduce the probability of a future OOT period extending to the same length?

The interval review decision and its rationale should be recorded alongside the OOT assessment. An audit finding that an OOT event occurred with no subsequent interval review is a significant gap.

How Calibration Management Software Supports OOT Response

The OOT assessment process is time-sensitive and document-intensive. A purpose-built calibration management system should:

• Record the as-found calibration result against the instrument's calibration history, making the OOT condition immediately visible
• Calculate the look-back period automatically from the last pass date
• Link the OOT finding to the instrument's usage history and the jobs it was assigned to during the look-back period
• Provide a structured OOT assessment form that captures all required elements and records authorship and approval
• Trigger an interval review prompt automatically when an OOT finding is recorded
• Retain the completed assessment as an auditable record linked to the calibration event

Frequently Asked Questions

Does every OOT finding require a full product quarantine?

No. The response is proportionate to the risk. If the magnitude of the OOT deviation is small relative to the product tolerance, and the products can be demonstrated to be conforming on the balance of evidence, a documented risk assessment explaining why quarantine is not warranted is sufficient. Quarantine and re-inspection are required where there is a genuine risk that the OOT condition resulted in non-conforming product being accepted.

What if we can't identify which products were measured with the out-of-tolerance gauge?

If instrument usage records are not maintained at the level that allows specific products to be traced to a specific instrument, the assessment must cover the full population of products that could have been measured with it during the look-back period. This typically means re-inspecting all products of the relevant type that were accepted during the look-back period — which can be a significant burden. Maintaining instrument usage records (recording the gauge ID on inspection travellers or reports) is the most effective way to limit OOT assessment scope.

We recalibrated the gauge immediately — is an OOT assessment still required?

Yes. Recalibrating the gauge returns it to service in a known condition, but it does not address the question of what happened to product measured while it was out of tolerance. The OOT assessment is about product risk, not gauge status. It is required regardless of whether the gauge has been recalibrated or replaced.

Under AS9100, when must we notify the customer?

AS9100 Rev D requires customer notification when deliverable product may have been affected by an OOT condition. "Deliverable product" means product that has been or is about to be shipped to the customer. The timing of notification is defined by the customer's supplier quality requirements — check your purchase order or quality flow-down document. When in doubt, notify promptly: a delayed notification after the customer discovers the issue themselves is a much more serious supplier relationship event than a proactive disclosure.

References

• ISO 9001:2015 Quality management systems — Requirements, clause 7.1.5, International Organization for Standardization
• AS9100 Rev D Quality Management Systems — Requirements for Aviation, Space, and Defense Organizations, clause 7.1.5, SAE International / IAQG
• ILAC-G24 / OIML D 10:2007 Guidelines for the determination of calibration intervals of measuring instruments
• UKAS, United Kingdom Accreditation Service — ukas.com
• NPL, National Physical Laboratory — npl.co.uk

What Is a Gauge Register?

A gauge register is a controlled document or database record that inventories every measuring and test instrument the organisation uses to verify product or process conformity. "Gauge" in this context is used broadly — it covers dimensional instruments (callipers, micrometers, gauging), force and torque instruments, pressure and temperature gauges, electrical test equipment, optical instruments, and any other device used to make a measurement on which a quality decision is based.

The scope of the gauge register is important: it must cover every instrument used to make a quality decision, not just instruments that the quality team own or manage. An instrument in the maintenance department used to verify torque on a production line fastener is within scope. An instrument in the toolroom used to verify cutting tool geometry is within scope. A test rig in engineering used to verify a prototype to customer specification is within scope.

What a Compliant Gauge Register Must Contain

ISO 9001:2015 does not prescribe the format of a gauge register, but the information needed to demonstrate compliance with clause 7.1.5 — and to manage calibration effectively — requires at minimum the following fields for each instrument:

• Unique instrument ID — A reference number that uniquely identifies the instrument in all calibration records, inspection reports, and OOT assessments. Without a unique ID, you cannot trace a calibration event to a specific instrument or link an OOT finding to the products it measured.
• Description and type — Make, model, and instrument type (e.g. "Mitutoyo 500-series digital calliper, 150mm range")
• Serial number — The manufacturer's serial number, which distinguishes this specific instrument from other instruments of the same model
• Location — Where the instrument is normally stationed or issued from. For portable instruments used across multiple areas, record the home location or issuing store.
• Calibration interval — The defined period between calibrations, expressed as a number of months or a date-based cycle
• Date of last calibration — The date of the most recent calibration or verification
• Next due date — Calculated from the last calibration date and the interval. This is the field that drives the recall process.
• Calibration method — Whether calibration is performed internally or externally, and the method or procedure reference used
• Reference standard used — For internal calibrations, the ID of the reference standard the instrument is calibrated against. For external calibrations, the name and UKAS accreditation number of the calibrating laboratory.
• Current calibration status — In calibration / due / overdue / out of service / under review

For AS9100 Rev D compliance, two additional fields are needed:

• Calibration status label confirmation — Evidence that the instrument carries a current status label showing calibration date and due date
• OOT history — A link or reference to any OOT events recorded for this instrument

How to Identify All Instruments That Belong in the Register

A complete gauge register requires a systematic process for identifying instruments in scope. The most reliable approach is a physical walkdown — walking every area where manufacturing, inspection, testing, or measurement takes place and listing every instrument present. This should be supplemented by:

• Reviewing existing inspection and test procedures for references to specific instruments or instrument types
• Checking tool stores, calibration labs, and incoming goods inspection areas
• Asking department managers and quality engineers: "Is there any measuring equipment in your area that you use to make a decision about whether a product is acceptable?"
• Reviewing equipment asset registers from Finance or Facilities — instruments purchased as assets may appear there even if not known to the Quality team

The key question for each instrument found is: Is this instrument ever used to make a quality decision? If yes, it belongs in the gauge register. If the instrument is used only for reference, estimation, or setting purposes and its reading is not used to accept or reject product or verify a process parameter, it may fall outside scope — but this exclusion should be documented.

Managing the Register as a Living Document

A gauge register that is accurate on the day it is created but not maintained will quickly become a liability. Instruments are added to the shop floor, retired, transferred between departments, lost, or damaged — and every change must be reflected in the register. Best practices for maintaining register accuracy include:

• A defined process for adding new instruments — Any new measuring instrument must be logged in the register, assigned an ID, and have its calibration interval set before it is put into service. This process should be documented and known to purchasing, stores, and department managers.
• A defined process for retiring instruments — Instruments that are withdrawn from service, scrapped, or transferred away must be updated in the register. Retired instruments should be marked clearly (e.g. "out of service — do not use") and stored separately from calibrated instruments in service.
• Periodic reconciliation — At least annually, perform a physical count and compare against the register. Any unregistered instruments found in service should be added and assessed for OOT risk. Any registered instruments that cannot be located should be investigated.
• Change notification process — A simple form or process for department managers to notify the Quality team when a new instrument arrives, an existing one is retired, or an instrument changes location.

Common Gauge Register Gaps Found in ISO 9001 Audits

• Instruments in use but not in the register — The most serious finding. Auditors routinely walk the production floor and find instruments in active use that do not appear in the register and have no calibration history.
• No unique IDs — Instruments identified only by make and model, with no unique number. Where multiple instruments of the same model exist, there is no way to link calibration records to specific instruments.
• Due dates not calculated correctly — Spreadsheets where the due date has not been updated after the most recent calibration, or where the formula has been overridden, resulting in incorrect due date fields.
• Location fields outdated — Instruments shown at a location where they no longer operate. In an OOT investigation, an incorrect location makes it harder to identify which jobs the instrument may have been used on.
• No interval documented — Instruments in the register with no calibration interval defined. Without a defined interval, there is no basis for the due date and no framework for the recall process.
• Register not controlled — The gauge register exists as an uncontrolled spreadsheet, with no version history, no access controls, and no record of who made changes and when. For ISO 9001, documented information must be controlled — changes to the register should be traceable.

Gauge Register vs. Calibration Records: Understanding the Difference

The gauge register and calibration records are distinct but complementary:

• The gauge register is the current-state inventory — it tells you what instruments exist, where they are, what their interval is, and when they are next due. It is a live document.
• Calibration records are the historical record of each calibration event for each instrument — the date, the method, the reference standard, the readings, and the pass/fail result. They accumulate over time and are never deleted.

Both are required by ISO 9001:2015. Both are examined in audit. The gauge register answers "are all your instruments known and in calibration?" The calibration records answer "what was the result of each calibration and who did it?"

Frequently Asked Questions

Should we include reference standards in the gauge register?

Yes. Reference standards are measuring instruments in their own right and must be calibrated by UKAS-accredited laboratories to form the traceability anchor for your internal calibration programme. They should be in the gauge register with their own IDs, intervals, and calibration records — and typically subject to more rigorous control than working instruments.

What about instruments used only for monitoring (not quality decisions)?

Instruments used only for monitoring purposes — where the reading informs an operator but is not used to accept or reject product — may be excluded from the formal calibration programme. The exclusion should be documented (a note in the gauge register or a separate controlled list of excluded instruments with the exclusion rationale). An auditor may ask about excluded instruments, and an undocumented exclusion is a gap.

Can we manage the gauge register in a spreadsheet?

Yes, a spreadsheet can satisfy the gauge register requirements of ISO 9001:2015 provided it contains the required information, is controlled (versioned, with access management), and is kept up to date. The practical risk with spreadsheets is that due dates are missed when the spreadsheet is not checked, and changes are made without a record of who changed what. Purpose-built calibration management software eliminates these risks by automating due-date calculation, flagging overdue instruments, and maintaining an audit trail of all changes.

How often should we reconcile the register against the physical gauge population?

At minimum annually, as part of the quality management system's internal audit programme. High-velocity production environments where instruments are regularly added, moved, and retired benefit from quarterly reconciliations. Any physical walkdown that reveals unregistered instruments should trigger an immediate OOT risk review for any products those instruments may have measured.

References

• ISO 9001:2015 Quality management systems — Requirements, clause 7.1.5, International Organization for Standardization
• AS9100 Rev D Quality Management Systems — Requirements for Aviation, Space, and Defense Organizations, clause 7.1.5, SAE International / IAQG
• ISO/IEC 17025:2017 General requirements for the competence of testing and calibration laboratories, International Organization for Standardization
• UKAS, United Kingdom Accreditation Service — ukas.com

Why Certificate Quality Matters Beyond Paperwork

ISO 9001:2015 clause 7.1.5.2 and ISO/IEC 17025:2017 both place specific requirements on what a calibration record must contain and how measurement traceability must be demonstrated. Auditors are trained to spot certificates that look complete but omit the substance — a stamp and a pass/fail statement with no supporting data. A weak certificate does not just risk an audit finding against the calibration provider; it risks a finding against your organisation for accepting inadequate evidence of traceability.

There is also a practical dimension. If a product is later found to be defective and the root cause traces back to a measurement made with a given gauge, the calibration certificate is the record that determines whether that gauge was within tolerance at the time. A certificate that cannot be interpreted months or years later is of limited value in an investigation.

The Fields Every Calibration Certificate Should Contain

1. Unique certificate identification — A certificate number that appears on every page, allowing the certificate to be referenced unambiguously in your gauge register and audit trail.
2. Identification of the item calibrated — Manufacturer, model, serial number, and your internal asset number if supplied. This is the field most often mismatched against internal records, particularly when instruments are sent to third parties who do not use your internal asset numbering.
3. Calibration date and, where relevant, the environmental conditions — Temperature and humidity at the time of calibration, particularly for instruments sensitive to environmental drift (e.g. dimensional gauges, torque wrenches).
4. Traceability statement — A statement that the measurements are traceable to national or international standards (in the UK, via the National Physical Laboratory), including reference to the standards or reference equipment used and their own calibration status.
5. As-found and as-left readings — The results measured before any adjustment (as-found) and after any adjustment was made (as-left). As-found data is what allows an out-of-tolerance impact assessment to be performed correctly — without it, you cannot determine how far out of tolerance the instrument may have been before this calibration, or for how long.
6. Measurement uncertainty — A statement of the uncertainty of measurement associated with the calibration, typically expressed at a 95% confidence level (k=2). Uncertainty is not the same as tolerance. It expresses how confident the lab is in its own reported values, and it should be a small fraction of your tolerance band — the CMC (Calibration and Measurement Capability) uncertainty of a UKAS-accredited lab must typically be no more than a third to a quarter of the tolerance you are calibrating to.
7. Pass/fail statement against a stated tolerance — The certificate should state explicitly which tolerance the instrument was assessed against, and whether it passed. A certificate with numeric readings but no pass/fail conclusion pushes the compliance decision back onto you, without giving you the accreditation body's own conformity assessment methodology.
8. Accreditation mark and scope, where applicable — If the certificate carries a UKAS accreditation mark, verify that the specific parameter and range calibrated actually falls within that lab's accredited scope. Not every measurement a UKAS-accredited lab performs is itself accredited — labs can and do issue non-accredited certificates for services outside their scope.
9. Signatory and approval — The name and signature (or approved electronic equivalent) of the person who authorised the certificate, establishing accountability for the results reported.

Common Certificate Problems That Cause Audit Findings

• No as-found data. A certificate that only shows as-left readings after adjustment gives no way to assess whether product made using that instrument since its last calibration might be affected. This is the single most common gap that blocks a proper OOT assessment.
• Uncertainty stated without context. A number labelled "uncertainty" with no confidence level or coverage factor (k) cannot be interpreted or compared against your tolerance.
• Accreditation mark used outside scope. Some labs display their UKAS logo on every certificate they issue, even for calibrations that fall outside their accredited scope. Cross-check the parameter and range against the lab's published schedule of accreditation on the UKAS website.
• Asset mismatch. Serial numbers or descriptions on the certificate that do not match your internal gauge register create ambiguity about which physical item was actually calibrated — a frequent finding when multiple similar gauges are sent for calibration in the same batch.
• Illegible or missing signatory. A certificate with no clear approval signature, or an illegible scan, undermines the chain of accountability an auditor is trying to verify.

What to Do When You Receive a Certificate

Build a short checklist into your goods-in or calibration-return process: confirm the asset identification matches your register, confirm a pass/fail result is stated against a named tolerance, confirm as-found data is present if the instrument is subject to OOT assessment, and confirm the certificate number is recorded against the gauge before it is returned to service. This takes under a minute per certificate and catches the majority of the problems above before they become audit findings months later.

A calibration management system that stores the certificate number, uncertainty, and as-found/as-left status as structured fields against each calibration event — rather than as an attached PDF nobody reopens — turns this check into something your software can flag automatically, and turns "find the certificate for gauge X from 2023" into a search rather than an archive dig.

Frequently Asked Questions

Does every calibration certificate need to be UKAS-accredited?

No. UKAS accreditation is not a legal requirement, and many perfectly valid calibrations are performed by non-accredited (but still traceable) providers, particularly for lower-risk or lower-criticality equipment. However, most quality management systems require a documented justification for the level of traceability chosen for each category of gauge, and UKAS accreditation is the recognised way to demonstrate the highest level of confidence without independently auditing the calibration lab yourself.

What is the difference between tolerance and uncertainty?

Tolerance is the acceptable range of values for the thing being measured — it is set by your process or product requirement. Uncertainty is a statement of how much confidence there is in the measured value itself, arising from the measuring equipment, the environment, and the method. A calibration result can be well within tolerance and still be reported with significant uncertainty if the uncertainty is not managed appropriately relative to that tolerance.

How long should calibration certificates be retained?

Retention should match or exceed the retention period for the product or process records the instrument supported, since the certificate may be needed to support an investigation long after the calibration itself. Three years is a common minimum under ISO 9001 certification schemes; aerospace and defence contracts frequently require seven to ten years or the life of the product.

References

• ISO/IEC 17025:2017 General requirements for the competence of testing and calibration laboratories, International Organization for Standardization
• ISO 9001:2015 Quality management systems — Requirements, clause 7.1.5.2, International Organization for Standardization
• UKAS, United Kingdom Accreditation Service — ukas.com
• JCGM 100:2008 Evaluation of measurement data — Guide to the expression of uncertainty in measurement (GUM), Joint Committee for Guides in Metrology