4.5 Clause 8.6–8.7 — Release of Products/Services & Control of Nonconforming Outputs

8.6 Release of Products and Services

Clause 8.6 requires the organization to implement planned arrangements, at appropriate stages, to verify that product and service requirements have been met. This links directly back to the acceptance criteria set during planning under 8.1 - release is not a separate, ad hoc decision made at the end of the process; it is the execution of a plan made much earlier.

The release of products and services to the customer must not proceed until the planned arrangements have been satisfactorily completed, unless otherwise approved by a relevant authority and, as applicable, by the customer. This is the clause's core control: shipping or delivering before verification is complete is only acceptable when there is a documented, authorized exception - a concessional release, or a "ship-to-line" arrangement made with a customer's written agreement - not as routine practice driven by schedule pressure.

The organization must retain documented information on the release of products and services, and that documented information must include traceability to the person or persons authorizing the release.

Auditor evidence for 8.6: final inspection or test records, a certificate of conformance, a release stamp or electronic sign-off tied to a named individual, and - critically - evidence of who held the authority to release under a concession, together with proof that this authority was actually exercised whenever release preceded completed verification.

8.7 Control of Nonconforming Outputs

The organization must ensure that outputs which do not conform to their requirements are identified and controlled to prevent their unintended use or delivery. This obligation extends beyond the shop floor: it explicitly applies to nonconforming products and services detected after delivery, and during or after the provision of services, not only to output caught before it leaves the organization.

The organization must take action based on the nature of the nonconformity and its effect on the conformity of products and services. This principle - that the response should be proportionate to the nature and consequence of the nonconformity - mirrors the judgment a lead auditor exercises when later grading a finding as major or minor; here in 8.7 it is the organization's own internal disposition decision, made about its own nonconforming output, not an external auditor's classification of a management-system gap.

The standard lists the permitted ways of dealing with nonconforming output:

Where nonconforming output is corrected, the organization must verify conformity to the requirements - a correction is not complete until it has been re-checked against the original acceptance criteria; simply reworking the item is not, by itself, sufficient closure.

Required Documented Information

The organization must retain documented information that describes the nonconformity; describes the actions taken; describes any concessions obtained; and identifies the authority deciding the action taken in respect of the nonconformity.

What the Auditor Looks For

A weak 8.7 system shows up as nonconforming material sitting on the shop floor without a hold tag or status field, a "concession" that was never actually authorized by anyone holding delegated authority, or a nonconforming-output log with no closure date and no re-verification record after correction. A strong system shows a clearly identified quarantine or hold area with visible status marking, a disposition decision traceable to a named authority, and - for anything that reached the customer - documented evidence that the customer was informed as required. When auditors later write nonconformity statements against 8.7 itself, the most common citation is a missing or incomplete record of who authorized a concession, because that single element of 8.7's documented-information requirement is the one most often skipped under production or delivery-schedule pressure.

Connecting 8.6 and 8.7 for the Auditor

These two sub-clauses are closely linked in practice: 8.6 is the gate that should catch nonconforming output before release, and 8.7 is the containment and disposition process that governs what happens when something gets through the gate anyway - or is found to have already gotten through after delivery. An effective audit trail tests both: does the release record show verification was genuinely completed before shipment, and if a nonconformity is ever found in released product, does the 8.7 process correctly identify it, contain it, and inform the customer where required, with the authority for every decision clearly on record.