Back to Hub
Assurance

NCR close-out that sticks: fixing the root cause, not the paperwork

Published 14 July 2026
  • internal audit
  • corrective action
  • audit readiness

If the same non-conformances keep coming back, your close-out process is treating symptoms. Here is how to run root cause analysis that holds up, and how to verify a corrective action actually worked.

NCR close-out sticks when you fix the reason the non-conformance happened, prove the fix works and check it held. It fails when close-out means completing the form: a quick correction, a "toolbox talk held" entry and a signature. If the same NCRs keep resurfacing across projects, the problem is not your people, it is a close-out process that rewards closing tickets instead of removing causes.

Why do the same NCRs keep coming back?

Repeat NCRs are the most reliable symptom of a paperwork-driven close-out culture. The cycle looks like this on almost every site where it happens:

  1. A non-conformance is raised, by a client, an auditor or your own team.
  2. Pressure builds to close it quickly, because open NCRs look bad on the register and clients ask about them.
  3. Someone writes a cause that is really a restatement of the problem ("operator did not follow procedure") and an action that is really a correction plus a reminder ("rework completed, toolbox talk held").
  4. The NCR is signed off. The register looks healthy.
  5. The same condition produces the same non-conformance on the next project, often in front of the same client.

Every step is individually reasonable and the total effect is a system that manufactures repeat findings. The register says the business is learning. The field says otherwise.

The commercial cost compounds quietly: rework hours, client confidence eroding with every repeat, tender scores marked down where clients track contractor NCR performance, and supervisors learning that NCRs are an admin task rather than a signal.

What is root cause analysis for NCRs (and what it is not)?

Root cause analysis is the structured search for the condition that made the non-conformance likely. It is not a form, and it is not the first plausible sentence that lets you close the ticket.

The test of a real root cause is simple: if you removed it, would this class of problem stop happening? "The operator didn't follow the procedure" fails that test, because you cannot remove the operator's capacity for error. "The procedure requires a hold point that the schedule makes impossible to run, so crews routinely skip it" passes, because you can fix a hold point that conflicts with reality.

You do not need elaborate tooling for most NCRs. Five whys, honestly applied, resolves the majority. The honesty is the hard part, because the fifth why usually lands somewhere uncomfortable: a planning decision, a resourcing gap, a procedure written for an office rather than a site, or a verification step everyone quietly abandoned. Root cause analysis that never implicates the system, only the workers, is not analysis. It is blame allocation.

Common counterfeit root causes to ban from your register:

  • "Human error" or "complacency"
  • "Failure to follow procedure" (that is the non-conformance restated)
  • "Lack of attention to detail"
  • "Training gap" with no evidence the person was ever trained differently

Each of these ends the investigation exactly where it should begin.

How do you close out an NCR properly?

A close-out that sticks moves through five distinct stages. Collapsing them into one form-filling session is where most systems fail.

StageQuestion it answersWeak versionStrong version
1. ContainmentIs the immediate problem controlled?Rework done, move onRework done, similar work checked for the same issue, client informed where required
2. Root causeWhy did this happen?Problem restated as causeCondition identified that made the failure likely, evidence attached
3. Corrective actionWhat removes the cause?Toolbox talk, memo, "reminded staff"Process, control, resourcing or design change that removes or guards the cause
4. ImplementationDid we actually do it?Action marked completeAction verified as in place, with the owner named and the change visible in the field
5. Effectiveness checkDid it work?Not doneScheduled follow-up confirms the issue has not recurred and the new control is being used

Two rules make the whole thing work:

Separate the correction from the corrective action. Fixing the defective work is containment. It is necessary and it is not close-out. If your NCR form has one action field, add a second one, because a single field invites a single (corrective-free) answer.

Never close on promised action. An NCR closes when the effectiveness check passes, not when the action is assigned, not when it is reported complete. Build the follow-up date into the close-out itself. Yes, this means NCRs stay open longer. An honest open NCR is worth more than a dishonest closed one.

How do you verify a corrective action actually worked?

Effectiveness verification is the step that separates assurance from administration, and it is the step most systems omit entirely. Three practical methods, in increasing order of strength:

  1. Recurrence check. At a set interval after implementation, confirm the same non-conformance has not reappeared anywhere in the business, not just on the originating project. No recurrence is weak evidence on its own (low volume can mask a live problem) but it is the minimum.
  2. Control observation. Go and watch the new control operate. If the corrective action was a revised hold point, attend one. If it was a changed inspection regime, sample the records and then sample the work behind the records. The question is not "does the new document exist?" but "is the new behaviour happening?"
  3. Stress the control. Ask what would happen if the original conditions recurred: same time pressure, same crew mix, same handover gap. Walk that scenario with the people involved. If the answer is "we'd probably do the same thing", the corrective action changed the paperwork, not the risk.

Whoever verifies effectiveness should not be the person who implemented the action. That is not about trust, it is about the same independence principle that makes any assurance activity credible.

What does good look like on the NCR register?

A healthy register has a particular shape. Fewer NCRs is not the goal, and a suspiciously empty register usually means under-reporting, which is a worse problem than any individual finding. Look instead for:

  • Repeat rate trending down. The same root cause should not appear twice a year apart.
  • Internal finds outnumbering external finds. Your own audits and inspections should catch issues before clients and certifiers do.
  • Root causes that spread across categories. If every root cause is "training", the analysis is shallow. Real causes distribute across process design, planning, resourcing, communication and control gaps.
  • Close-out durations that vary with complexity. Uniform seven-day close-outs across every NCR is a sign the form is being completed rather than the problem being solved.
  • Trend analysis feeding management review. Individual NCRs get fixed; patterns get funded.

Repeat NCRs, audit surprises and evidence gaps are rarely isolated problems. They usually point at how the whole governance and assurance setup is working, or not working. A Governance Health Check gives you an independent read on exactly that: where your controls stand, why issues keep recurring and the priority order for fixing it. Book one and find out what your register has been trying to tell you.

Want plain feedback on your governance?

30 minutes. No pitch.

Jemma Kennedy

Founder, Hillview Business Services. 15+ years inside civil construction, mining and infrastructure businesses.

Frequently asked questions

Find out where you stand.

Free, thirty minutes, no pitch.