Manufacturing
Manufacturing quality records retention: NCRs, CAPAs and inspection data
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
Quality records retention in manufacturing is set record type by record type, by the strictest of four drivers: your quality standard, customer and quality agreements, sector regulation and product liability exposure. ISO 9001 leaves the period to you, so write a period and trigger event for each record type and keep retained records readable and linked.
Key takeaways
- ISO 9001 expects you to define and control retention of quality records but does not prescribe a single period for everyone.
- Customer quality agreements and sector rules in automotive, aerospace and medical devices often set longer floors than internal policy.
- Product liability exposure can justify keeping final inspection and traceability records for as long as the product may be in use.
- A retained NCR is only useful if it stays linked to its part, lot, photos and disposition approval.
- Customer-owned drawings and specifications follow the customer's terms, so they need their own line in the schedule.
What decides how long quality records are kept?#
How long quality records are kept is decided by the strictest of several drivers that apply to each record type. The quality standard you are certified to, the agreements you signed with customers, regulation in your sector and your product liability exposure each impose a minimum, and the longest minimum wins.
ISO 9001 expects an organization to determine retention and disposition for the documented information it keeps as evidence, rather than setting one period for everyone. That flexibility is why two certified plants can run very different schedules, and why a written rule per record type matters more than copying another plant's numbers.
Retention drivers by quality record type#
Retention drivers differ by record type because each record proves something different. Map them before you set periods, then confirm the periods with your quality, legal and customer-facing teams.
| Record type | What it proves | Main retention drivers | Keep with it |
|---|---|---|---|
| Nonconformance reports (NCRs) | What failed, how it was dispositioned and who approved | Customer quality agreements, product liability, ISO 9001 | Photos, use-as-is or repair approvals, linked lot numbers |
| CAPAs and 8D reports | Root cause and whether the fix worked | Customer agreements, certification audits, ISO 9001 | Effectiveness checks and the NCRs that triggered them |
| Incoming and in-process inspection | Material and parts conformed at each step | Customer agreements, sector rules, traceability commitments | Lot, heat or serial numbers and inspector sign-off |
| Final inspection and certificates of conformance | Shipped product met requirements | Customer contracts, product liability | Shipment and serial or lot references |
| CMM reports and SPC data | Measured capability on key characteristics | Customer agreements, PPAP and first article requirements | Program revision and gauge used |
| Calibration records | Measuring equipment was fit for use | ISO 9001, customer agreements | Gauge IDs so measurements can be defended |
| Customer complaints and returns | Field performance and the response | Warranty terms, product liability | Linked NCRs and CAPAs; end-user details handled separately |
| Supplier corrective actions | Supplier problems and fixes | Supplier agreements, customer flow-down terms | Supplier responses and verification evidence |
How customer agreements and sector rules extend retention#
Customer agreements and sector rules are the drivers most likely to push retention beyond your own policy. Quality agreements and purchase order terms can require suppliers to keep inspection and traceability records for a stated period after the last shipment of a part, and can require you to flow the same obligation down to your own suppliers.
Regulated sectors add another layer. Automotive suppliers working to IATF 16949, aerospace suppliers working to AS9100 and medical device makers subject to FDA quality management system requirements each face record requirements tied to their programs and customers, and automotive customer-specific requirements often add their own retention terms for PPAP and production records. Read the current text of each requirement and your customer-specific requirements rather than relying on a summary, including this one.
How does product liability affect quality records retention?#
Product liability exposure is the driver that most often justifies keeping quality records beyond contract minimums, because a claim can arise long after a product ships. Records showing that a product met its specification when it left the plant, and that problems found along the way were handled, can be central to a defense.
State statutes of limitations, and in some states statutes of repose, may limit how long claims can be brought, and they vary by state and product. Ask counsel to set a liability overlay for each product line, especially for products with long service lives, and attach that overlay to the schedule so it is not lost when people change roles.
How do you keep retained quality records usable?#
Retained NCRs, CAPAs and inspection records only protect you if they can be found and understood years later. A closed NCR whose photo sat in a deleted network folder proves little, and a CAPA without its effectiveness check proves less.
- Write a retention period and a trigger event for each record type, such as closure date, last shipment or end of warranty.
- Keep NCRs, CAPAs and inspection results linked to part, lot, job and serial numbers so one search returns the full story.
- Store attachments with their record: photos, 8D reports, CMM output and signed dispositions.
- Keep a mapping table whenever defect or disposition codes change.
- Export closed records and attachments before any QMS or ERP migration, not after.
- Apply legal holds before routine disposal runs, and log disposals when periods end.
Customer-owned designs need their own line#
Customer-owned designs need their own line in the retention schedule because the customer's terms, not your policy, decide how they are kept, returned or destroyed. Drawings, 3D models, specifications and customer-supplied inspection plans often carry return or destruction clauses at the end of a program.
Mark records that embed customer property, such as an inspection report printed on a customer's drawing, so you know which retained records you control and which you hold for the customer. That distinction also decides what could ever be reused. Retained quality history can interest AI developers building inspection and quality models, but only the parts the manufacturer controls, with customer identities and designs removed, are candidates for licensing.
Illustrative: an extrusion company rewrites its schedule#
Illustrative: a fictional aluminum extrusion and fabrication company supplies trailer builders and building products firms. Its retention schedule had a single line for quality records with no trigger event, and closed NCRs from a retired QMS sat in a database nobody could open.
The quality director rebuilt the schedule by record type. Final inspection records and certificates were tied to the longest customer requirement and the liability overlay set by counsel. Calibration records were tied to the measurements they support. Customer drawings moved to their own line with each customer's return terms. The retired QMS was exported to a readable archive with photos attached, which also left the company with a clean record set it could assess later for licensing.
How SourceX looks at retained quality records#
SourceX treats retention and licensing as separate decisions: a record kept for compliance is not automatically licensable, and nothing leaves a retention archive without the company's approval. A metadata-only fit check asks which quality record types exist, how many years are readable and which belong to customers.
Any record set that goes further runs through the SourceX five-step transaction. Customer names, personal details and customer-owned designs are removed or excluded during Preparation, and the SourceX Evidence Packet documents what was licensed, under which rights and for which permitted uses.
Frequently asked questions
Can we destroy quality records once the retention period ends?
Usually, if no legal hold, open claim, customer request or regulatory inquiry applies and the schedule confirms the period has ended. Document what was destroyed, when and under which rule. Consider keeping an index after disposal so you can show the record existed and was handled under policy.
Do electronic quality records have to stay in their original system?
Not usually. What matters is that the record stays complete, readable and protected from unauthorized change. Exporting to an archive with attachments and an audit trail is a common approach. Regulated sectors can have specific electronic records rules, so check those before retiring a validated system.
How should we handle quality records that name employees?
Inspectors, approvers and technicians appear in NCRs, CAPAs and calibration records, and their names often serve as approval evidence, so keep them for compliance. If records are ever shared outside the company, names and other personal details are removed or replaced first, and employee notices are reviewed.
Who should own the quality records retention schedule?
The quality director usually owns the record types, with legal setting the liability overlay and finance aligning it with the wider records policy. IT owns the systems and the export path. Revisit the schedule when you sign a new customer quality agreement, enter a regulated sector or replace a QMS.
Are old quality records worth anything beyond compliance?
They can be. Linked NCRs, CAPAs and inspection data document real defects and real decisions, which developers of quality and inspection models may want to license. Value depends on linkage, depth of history, rights and how much customer content must come out, so a metadata-only review is the sensible first step.
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.