NCR Management for Halal Certification: From Detection to Closure

Every Halal Executive who has been through a JAKIM surveillance audit knows the moment: the auditor closes their notebook, looks up, and says "we have a few findings." What happens in the days that follow determines whether those findings become closed evidence of a mature compliance system — or the opening clause of a certification suspension notice.

Non-Conformity Reports (NCRs) are not audit failures. They are information. The quality of your organisation's response to NCRs is a more accurate signal of your compliance maturity than the number of NCRs raised in the first place. JAKIM auditors are not counting how many NCRs you have. They are evaluating whether your system for managing them actually works.

Under MHMS 2020, NCR management is a structural requirement of your Halal Assurance System (HAS) — not an optional administrative process. Auditors assess whether your organisation operates a functioning system from detection through to verified closure, with evidence at every stage. Since 2025, all NCR responses to external JAKIM findings must be submitted through the MYeHALAL portal in structured digital format — which raises the evidence documentation bar further.

This guide covers the complete NCR lifecycle: what triggers an NCR, how to classify it, how to investigate root causes properly, how to close it with evidence that satisfies a JAKIM auditor, and how to identify the systemic patterns that prevent recurrence across audit cycles.

---

What Is an NCR in the Halal Context?

A Non-Conformity Report (NCR) — or Laporan Ketidakakuran in Malay — is a formal record of a finding where your operations, documentation, or controls do not meet the requirements of MHMS 2020 or your own Halal Assurance System.

NCRs can be raised by:

• Internal auditors during scheduled internal audits under your HAS programme
• JAKIM auditors during certification, surveillance, or unannounced audits under MPPHM 2020
• Your operations team when a halal control deviation is detected during routine monitoring
• Your Halal Executive when reviewing records and identifying a documentation gap

An NCR is not a punishment. It is a structured signal that something needs correcting. The organisations that treat NCRs as failures to hide are the ones whose compliance systems deteriorate across audit cycles. The organisations that treat them as data improve.

---

NCR Classification Under MHMS 2020

Not all non-conformities carry the same weight. JAKIM classifies NCRs into three categories that determine the required response timeline and the potential impact on certification status.

The classification distinction matters beyond the immediate response. A pattern of minor NCRs in the same functional area — recurring documentation gaps in supplier management across two consecutive audit cycles — is treated as evidence of a systemic control failure. The auditor may escalate the classification from minor to major at the next cycle. The finding is no longer "incomplete record." It becomes "management has been aware of this gap since the last audit and has not implemented an effective control."

This escalation logic is why individual NCR closure is necessary but not sufficient. What matters for long-term certification health is whether your system prevents the same NCR category from recurring.

---

The NCR Lifecycle: Six Stages From Detection to Verified Closure

A robust NCR process typically includes identification, ownership assignment, root cause investigation, corrective/preventive action, evidence collection, and verified closure — while MHMS 2020 does not itself prescribe a numbered lifecycle, it does require documented, JKHD-verified corrective action (Section 5(5)). Most compliance failures do not happen because organisations skip stages — they happen because stages are executed superficially. Each stage has specific quality requirements that determine whether the closure will withstand auditor scrutiny.

Recommended NCR Management Workflow

1

Identify & Document

Record the non-conformity using exact wording. Log it in the NCR register immediately — never leave it in an email thread.

2

Root Cause Analysis

Identify the system failure behind the finding — not just the surface symptom. Assign to a named owner with a deadline.

3

Define Corrective & Preventive Action

Document both the corrective action (fix the finding) and the preventive action (prevent recurrence). Assign responsibility.

4

Implement & Gather Evidence

Execute the action. Collect proof: updated SOPs, re-training records, process photos, management sign-offs.

5

Verify Effectiveness

An independent reviewer confirms the root cause is resolved — not just the observable symptom. This step is mandatory before closure.

6

Close NCR

NCR formally closed with documented confirmation. Submit through MYeHALAL if externally raised by JAKIM.

Stage 1: Identify and Document

When a non-conformity is detected — during audit, monitoring, or routine operations — it must be formally documented before any corrective action begins. The act of documenting comes first because it establishes the baseline from which improvement is measured.

The NCR record at this stage must capture:

• Date and time of detection
• Location (department, production line, storage area, warehouse zone)
• Description — factual, specific, referencing the MHMS 2020 requirement or HAS procedure not being met
• Classification — KECIL (minor), BESAR (major), or SERIUS
• Evidence — what was observed, measured, or found missing; attach photos, records, or screenshots
• Raised by — name and role of the person who identified the NCR

The quality of the description at this stage determines the quality of everything that follows. "Training records incomplete" is not a usable finding. "Training record for Employee A (receiving operator, HCP-01) missing for halal refresher training due March 2026 — employee has been operating at HCP-01 without refresher for 14 months" gives the corrective action owner what they need. Specificity is not bureaucratic — it is functional.

Stage 2: Assign Ownership

Every NCR must have a named owner — the person with operational authority over the area where the non-conformity was found. This should not default to the Halal Executive for every NCR. Ownership should go to the functional manager responsible for the area where the finding occurred.

The NCR record must capture: owner name, role, and agreed deadline for corrective action. The deadline should align with JAKIM's requirement — correction immediately or within 14 days, or another period deemed reasonable by the authority, with immediate SPHM suspension for BESAR (Major) non-conformities. For NCRs raised externally by JAKIM, the deadline is stated in the audit report and is non-negotiable.

Stage 3: Root Cause Analysis

This is where the majority of NCR processes fail. Correcting the symptom without identifying the root cause guarantees recurrence — precisely the escalation scenario described above.

The practical standard is the 5 Whys method — ask "why" repeatedly until you reach a systemic cause that, if addressed, would prevent recurrence:

Example — Expired supplier certificate found during JAKIM audit:

• Why was an expired certificate used? — The certificate was not renewed before expiry
• Why was it not renewed? — No one monitored the expiry date proactively
• Why was no one monitoring? — The supplier register is a spreadsheet with no alert function
• Why does no alert function exist? — The register was built for storage, not active monitoring
• Root cause: No automated certificate expiry monitoring system with proactive alerts

The corrective action for "expired certificate" is to obtain a renewed certificate. But that corrective action alone does not prevent the same finding at the next audit. The preventive action — which addresses the root cause — is to implement a monitoring system that alerts the team 60 and 30 days before any supplier certificate expires.

For complex NCRs with multiple contributing factors, a fishbone (Ishikawa) diagram can map all contributing causes before identifying the primary root. For process-related NCRs, an Is/Is Not analysis isolates exactly what failed versus what worked correctly.

Stage 4: Define Corrective and Preventive Actions

Two distinct actions are required:

Corrective action (CA) addresses the immediate non-conformity. For the expired certificate: obtain the renewed certificate, verify it against the issuing body's registry, update the supplier record, and assess whether products manufactured during the gap period require re-evaluation.

Preventive action (PA) addresses the root cause and prevents recurrence. For the same finding: implement a monitoring system with automated alerts at 60, 30, and 7 days before any supplier certificate expiry, and define the escalation pathway if a supplier does not respond within 21 days.

Both actions must be documented with specific steps, responsible persons, and deadlines. "We will improve our monitoring" is not a corrective action. The documented action must describe the specific control being implemented or changed.

Stage 5: Implement and Collect Evidence

Execute the corrective and preventive actions within the agreed timeline. For NCRs raised by JAKIM and requiring MYeHALAL submission, evidence must be structured for digital upload — not paper records photographed at low resolution.

Evidence types vary by finding:

• Updated documents with version numbers showing the change from the previous version
• Photos of physical changes (segregation barriers, labelling updates, storage reorganisation)
• Training records for re-trained staff, including attendance signatures and assessment results
• System screenshots showing new controls or workflow changes
• Supplier correspondence confirming certificate renewal with the renewed certificate attached
• Meeting minutes confirming the JKHD was briefed on the NCR and its resolution

Evidence must be specific and traceable. A general statement that "the issue was resolved" is not evidence. A certificate dated after the NCR date, linked to the NCR record, is evidence.

Stage 6: Verify and Close

Verification before closure is what distinguishes a genuine NCR resolution from a paper exercise. Verification should ideally be conducted by someone other than the NCR owner — in practice, the Halal Executive or a second internal auditor.

Verification requires confirming:

• The corrective action has been fully implemented — not planned or in progress
• The evidence is specific, dated, and directly linked to the finding
• The preventive action is in place and operational — not merely documented
• The effectiveness can be tested (spot-check the process that generated the NCR)

Only after verification is complete should the NCR be formally closed, with a closure date and verifier signature recorded. For externally raised NCRs, the response must be submitted in writing, formally, addressing the corrective action taken directly and specifically, with supporting documents (schedules, receipts, halal certificates, invoices) and photographic evidence, through MYeHALAL. Responses that fail to specifically and directly address the corrective action taken are frequently rejected and returned for revision.

---

NCR Patterns JAKIM Auditors Track Across Cycles

Individual NCRs are assessed in isolation. Patterns of NCRs are assessed as signals about your compliance system's architecture.

JAKIM auditors who conduct multiple audit cycles at the same facility are trained to identify recurrence. A supplier certificate finding that appeared in 2023, was "closed," and reappears in 2025 is not treated as a coincidence. Under MHMS 2020, it is treated as evidence that the corrective action in 2023 addressed the symptom rather than the cause — which is itself a non-conformity under the corrective action effectiveness requirements.

The practical implication: your NCR management system should track findings by category and root cause across cycles, not just by individual NCR closure status. The question to answer before every JAKIM audit is not "are all previous NCRs closed?" It is "are the same NCR categories recurring, and what does that pattern reveal about which system controls are not functioning?"

---

How MPPHM 2020 Surveillance Audits Change NCR Risk in 2026

The MPPHM 2020 framework allows JAKIM to conduct post-certification surveillance audits — including unannounced or short-notice inspections — independently of the scheduled renewal cycle. Findings raised during these surveillance audits become NCRs subject to the same lifecycle requirements as renewal-audit NCRs.

The NCR implication is significant: manufacturers who are managing compliance manually and reactively face a higher risk of receiving surveillance NCRs at a time when they have not prepared documentation, gathered evidence, or reviewed recent records. A manual compliance system that "works" in a scheduled audit context generates unpredictable risk when the audit window is no longer predictable. A compliance system that generates clean, structured, timestamped records every day reads as evidence of a functioning HAS, not as gaps to investigate.

---

Common NCR Categories in JAKIM Audits

Based on what halal compliance practitioners consistently report across Malaysian industries, these are the highest-frequency NCR categories during JAKIM audits.

Supplier and raw material management — the highest-frequency major NCR category

• Expired halal certificates on file for raw materials currently in use
• Suppliers present in production records but absent from the approved supplier register
• No documented procedure for verifying new suppliers before first use

HAS documentation and system integrity

• HAS manual version not current — procedures describe a process that no longer exists in practice
• SOPs that do not match actual production floor practice
• Missing records for required HAS activities

JKHD governance and organisational structure

• JKHD meeting minutes unsigned, unformatted, or unfiled
• Halal Executive qualifications not meeting MHMS 2020 competency requirements
• No documented evidence of management review of HAS performance

Staff training and competency at HCPs

• Staff operating at Halal Control Points without documented halal training records
• No scheduled refresher training programme, or schedule not followed
• Training records not linked to specific HCP roles

HCP monitoring and deviation management

• Gaps in monitoring records — missing dates, unsigned entries
• No documented corrective action for detected monitoring deviations
• HCP register not updated following process changes

For a comprehensive pre-audit preparation framework aligned to all MHMS 2020 pillars, see our JAKIM audit checklist.

---

What Happens If NCRs Are Not Closed

Unresolved NCRs create compounding risk across three dimensions:

Audit escalation at the next cycle. Unclosed NCRs from a previous cycle are treated as recurring findings. A minor NCR that was documented but not substantively resolved becomes evidence of systemic failure. Classification changes — what was manageable becomes material.

Certification status impact. A pattern of unresolved NCRs in high-integrity areas can lead to SPHM renewal being withheld or, in serious cases, certification suspension. The commercial impact — lost export contracts, breached customer qualification requirements — typically far exceeds the cost of the compliance investment that would have prevented it.

The operational integrity risk that is never formally raised. The most dangerous NCRs are not the ones that were raised and managed poorly. They are the ones that were never formally raised because the organisation lacked the system to detect and document them. A halal control that fails without being recorded is not a managed risk — it is an unknown liability.

---

Tracking NCRs: Why Spreadsheets Break at Scale

Many organisations track NCRs in spreadsheets. For a small operation with infrequent findings, this can work. The system breaks predictably when deadlines pass without alert, evidence is scattered across email threads, the Halal Executive who understood the spreadsheet leaves, or management needs NCR trend data that cannot be extracted from unstructured rows.

Purpose-built compliance platforms provide a structured NCR workflow where each stage — identification, ownership, root cause, action, evidence, verification — is tracked, timestamped, and linked in a single traceable record. For NCRs requiring MYeHALAL submission, records are structured for digital export without a manual reformatting step. Dashboards show open NCRs, overdue actions, and trend patterns across cycles without manual compilation.

The difference is not sophistication. It is reliability under the operational pressures — staff changes, production demands, concurrent certifications — that cause manual systems to fail exactly when they are most needed.

---

How TAQYID Supports the Full NCR Lifecycle

TAQYID's NCR management module was designed specifically around MHMS 2020 corrective action requirements. Each NCR moves through a structured workflow mirroring the six stages above: identification with evidence attachment, ownership assignment with deadline setting, root cause documentation with 5 Whys prompts, corrective and preventive action definition, evidence collection, and independent verification before closure. Every stage is timestamped.

Open NCR dashboards give your Halal Executive and JKHD real-time visibility of all active findings, approaching deadlines, and overdue actions — without manual compilation before each meeting. NCR history and trend analysis across audit cycles is available at any point. When JAKIM requests your full NCR record, the complete structured history is exportable in MYeHALAL-compatible format.

Explore TAQYID's NCR Management

---

Expert Insight: The NCR System That Measures the Wrong Thing

The standard measure of NCR system performance is closure rate — what percentage of raised NCRs are formally closed on time. This metric is necessary but insufficient as a measure of compliance maturity.

The meaningful metric is recurrence rate: how often does the same finding category appear across consecutive audit cycles? A compliance system that closes 100% of NCRs on time but routinely generates the same finding categories in the same functional areas is a system with functioning administration and failing root cause analysis.

JAKIM auditors who conduct multiple cycles at the same facility are trained to recognise recurrence patterns. The supplier certificate finding that appeared in 2023, was closed, and reappears in 2025 tells the auditor that the 2023 corrective action addressed the symptom — not the cause. That conclusion is itself a finding.

The highest-performing compliance teams track not just whether NCRs were closed, but whether the same finding category has recurred — and what that pattern implies about which system controls need structural improvement. This is the standard that separates compliance administration from compliance governance.

---

Conclusion

NCR management is not a documentation exercise. It is the mechanism that converts audit findings into durable compliance improvement — or, when done poorly, into a cycle of recurring findings that erodes certification health and auditor confidence.

Key takeaways:

• Classification matters: BESAR (Major) non-conformities trigger immediate SPHM suspension and correction immediately or within 14 days; a pattern of unresolved KECIL (Minor) NCRs in the same area can trigger escalation to BESAR
• A structured lifecycle — identify, assign, root cause, action, implement with evidence, verify and close — is a recommended best-practice structure for any NCR; MHMS 2020 requires documented, JKHD-verified corrective action (Section 5(5)) without prescribing a numbered lifecycle
• Since 2025, all externally raised NCR responses must be submitted through MYeHALAL in structured digital format — evidence must be prepared accordingly
• MPPHM 2020 surveillance audits mean unannounced inspections can generate NCRs at any time — continuous compliance readiness is no longer optional
• The meaningful performance metric is recurrence rate, not closure rate — whether the same NCR categories keep reappearing is the true signal of system maturity

Explore TAQYID's NCR Management

---

Frequently Asked Questions

What is a major NCR in a JAKIM halal audit?

A BESAR (Major) non-conformity is a finding representing a systemic failure or direct threat to halal integrity — for example, a raw material or ingredient of doubtful halal status added without approval, an expired own SPHM certificate still displayed, or high-risk GMP contamination. Under MPPHM 2020, a BESAR non-conformity triggers immediate SPHM suspension, with correction required immediately or within 14 days (or another period deemed reasonable by the authority). Unresolved non-conformities can result in halal certification being withheld or suspended pending full closure.

How long does a manufacturer have to close NCRs after a JAKIM audit?

The timeline is generally the same regardless of classification: correction immediately or within 14 days, or another period deemed reasonable by the authority — with the key difference that a BESAR (Major) non-conformity triggers immediate SPHM suspension while a KECIL (Minor) one does not. The specific deadline is stated in the JAKIM audit report — follow that date. All responses to externally raised NCRs must be submitted through the MYeHALAL portal with supporting evidence documentation.

What happens if the same NCR appears in two consecutive JAKIM audits?

Recurrence of the same finding across consecutive cycles is treated as evidence of systemic non-compliance — specifically, a failure of corrective action effectiveness. A finding that was minor in the previous cycle may be classified as major upon recurrence, and the auditor may require a comprehensive review of the functional area. Recurrence patterns are one of the strongest indicators JAKIM uses to assess overall HAS maturity.

Can NCRs be raised by internal auditors, or only by JAKIM?

NCRs can and should be raised internally — by internal auditors during scheduled audit cycles, by the Halal Executive during routine compliance monitoring, or by any staff member who detects a halal control deviation. Internal NCRs raised and resolved before a JAKIM audit both correct genuine compliance gaps and provide documented evidence that the organisation is actively self-monitoring. A functioning internal NCR system is one of the strongest indicators of HAS maturity that JAKIM assesses.

How should NCR responses be submitted to JAKIM after an external audit?

All NCR responses for externally raised findings must be submitted through the MYeHALAL portal. The response must be documented in writing, specific and direct about the corrective action taken, and include supporting documents (schedules, receipts, halal certificates, invoices) and photographic evidence. Responses that fail to specifically and directly address the corrective action taken are frequently rejected or escalated.