Non-Conformity Reports (NCRs) are an inevitable part of halal compliance. Whether raised during an internal audit or a JAKIM inspection, how your organisation manages NCRs determines whether they become learning opportunities or recurring liabilities.

Under MHMS 2020, NCR management is not optional — it is a structural requirement of your Halal Assurance System (HAS). JAKIM auditors will not only review individual NCRs but assess whether your organisation has a functioning system for managing them from detection through to verified closure.

This guide covers the complete NCR lifecycle for halal certification.

What Is an NCR in the Halal Context?

A Non-Conformity Report (NCR) is a formal record of a finding where your operations, documentation, or controls do not meet the requirements of MHMS 2020 or your own Halal Assurance System.

NCRs can be raised by:

Internal auditors during scheduled internal audits
JAKIM auditors during certification or surveillance audits
Your own team when a halal control deviation is detected during operations

An NCR is not a punishment. It is information — a structured signal that something needs to be corrected. The quality of your response to NCRs reveals the maturity of your compliance system.

NCR Classification: Major vs Minor

Not all non-conformities carry the same weight. JAKIM classifies NCRs into categories that determine the required response timeline and escalation level.

Classification	Definition	Examples	Impact
Major NCR	A systemic failure or a direct threat to halal integrity	Expired supplier certificates used in production; no functioning JKHD; HCP monitoring records absent	Certification may be withheld or suspended until resolved
Minor NCR	A lapse in compliance that does not directly compromise halal integrity	Incomplete training record for one employee; unsigned JKHD meeting minutes; minor documentation gap	Must be corrected within a defined timeframe
Observation	An area of concern that is not yet a non-conformity but could become one	Supplier certificate approaching expiry; training schedule slipping; HCP record format inconsistency	Noted for improvement, no formal corrective action required

The distinction matters significantly. A pattern of minor NCRs in the same area — for instance, recurring documentation gaps in supplier management — may be escalated to a major NCR at the next audit cycle.

The NCR Lifecycle: Six Steps

Step 1: Identify and Document

When a non-conformity is detected — whether during audit, monitoring, or routine operations — it must be formally documented. The NCR record should capture:

Date and time of detection
Location (department, production line, storage area)
Description — factual, specific, referencing the MHMS 2020 requirement that is not met
Classification — major, minor, or observation
Evidence — what was observed, measured, or found missing
Raised by — name and role of the person who identified the NCR

Vague descriptions undermine the entire process. "Training records incomplete" is not useful. "Training record for Employee X (receiving operator, HCP-01) missing for halal refresher training due March 2026" gives the corrective action owner what they need.

Step 2: Assign Ownership

Every NCR must have a named owner — the person responsible for investigating and resolving it. This should not default to the Halal Executive for every NCR. Ownership should go to the person with operational authority over the area where the non-conformity was found.

The NCR record should capture: owner name, role, and an agreed deadline for corrective action.

Step 3: Root Cause Analysis

This is where most NCR processes fail. Correcting the symptom without understanding the root cause guarantees recurrence.

For each NCR, ask "why" repeatedly until you reach the systemic cause:

Symptom: Expired supplier certificate found during audit
Why? The certificate was not renewed before expiry
Why? No one tracked the expiry date
Why? The supplier register is maintained in a spreadsheet that has no alert function
Root cause: No automated certificate expiry monitoring system

Effective root cause analysis methods include:

5 Whys — simple, effective for most operational NCRs
Fishbone diagram — useful for complex NCRs with multiple contributing factors
Is/Is Not analysis — helps isolate what specifically failed vs what worked

Step 4: Define Corrective and Preventive Actions

Two types of action are required:

Corrective action (CA): fixes the immediate non-conformity. For the expired certificate example: obtain the renewed certificate from the supplier, verify it, and update the register.

Preventive action (PA): prevents recurrence. For the same example: implement a system that alerts the team 60 and 30 days before any supplier certificate expires.

Both must be documented with specific actions, responsible persons, and deadlines. "We will be more careful" is not a corrective action.

Step 5: Implement and Gather Evidence

Execute the corrective and preventive actions. Collect evidence of implementation:

Updated documents (with version numbers showing the change)
Photos of physical changes
Training records for re-trained staff
System screenshots showing new controls
Supplier correspondence confirming certificate renewal

Evidence must be specific and traceable — not general statements that the issue was addressed.

Step 6: Verify and Close

Before an NCR can be closed, verification is required — ideally by someone other than the NCR owner:

Has the corrective action been fully implemented?
Does the evidence confirm the non-conformity is resolved?
Has the preventive action been put in place to prevent recurrence?
Has the effectiveness been tested (e.g., a follow-up check)?

Only after verification should the NCR be formally closed with a closure date and verifier signature.

Common NCR Categories in JAKIM Audits

Based on what compliance practitioners consistently report, the most frequent NCR categories during JAKIM audits include:

Supplier and raw material management

Expired halal certificates on file
Suppliers not in the approved supplier register
No procedure for verifying new suppliers before first use

Documentation and HAS

HAS manual not version-controlled or outdated
SOPs not matching actual practices on the production floor
Missing or incomplete records

JKHD and organisational structure

JKHD meeting minutes unsigned or unfiled
Halal Executive qualifications not meeting MHMS 2020 requirements
No evidence of management review

Training

Staff at Halal Control Points without documented halal training
No refresher training schedule
Training records not linked to specific competencies

HCP monitoring

Gaps in monitoring records (missing dates, unsigned)
No documented corrective action for detected deviations
HCP register not updated after process changes

For a complete pre-audit preparation guide, see our JAKIM audit checklist.

What Happens If NCRs Are Not Closed?

Unresolved NCRs create compounding risk:

At the next JAKIM audit: unclosed NCRs from the previous cycle are treated as recurring findings. A minor NCR that was not addressed becomes evidence of a systemic issue — and may be escalated to a major NCR.
Certification impact: a pattern of unresolved NCRs can lead to certification suspension or non-renewal of the SPHM.
Operational risk: the underlying halal integrity issues that triggered the NCRs remain unaddressed, increasing the risk of a genuine halal failure.

The most dangerous NCRs are not the ones that were raised and badly managed — they are the ones that were never formally raised at all because the organisation lacked a system to detect and record them.

Tracking NCRs: Spreadsheets vs Systems

Many organisations track NCRs in spreadsheets. This works until it does not — typically when:

NCRs are raised but never assigned an owner
Deadlines pass without follow-up because no alert was triggered
Evidence is gathered but stored separately from the NCR record
Closure requires manual status updates that get forgotten
Management cannot see NCR trends because the data is unstructured

Purpose-built compliance platforms provide a structured NCR workflow where each step — from identification through to verified closure — is tracked, timestamped, and linked to evidence. Dashboards show open NCRs, overdue actions, and trends across audit cycles.

The difference is not sophistication — it is reliability. An NCR management system that depends on someone remembering to update a spreadsheet will eventually fail.

Conclusion

NCR management is not administrative overhead. It is the mechanism that turns audit findings into genuine compliance improvement. Organisations that manage NCRs well — with proper root cause analysis, defined corrective actions, gathered evidence, and verified closure — are the ones whose compliance improves with each audit cycle rather than repeating the same findings.

TAQYID's NCR management module provides a complete workflow from detection to closure — with assignment, root cause documentation, evidence attachment, deadline tracking, and verification — designed to ensure that no non-conformity falls through the cracks.

Explore TAQYID's NCR management →

NCR Management for Halal Certification: From Detection to Closure