Nobody Stops the Operator Who Runs It at Forty-Five Per Cent

A recipe specifies seventy per cent virgin material, twenty-eight per cent regrind and two per cent masterbatch, and the part is food-grade. The line runs it at forty-five per cent regrind because that is what was in the hopper and the order was late. The specification is written, correct and approved. Nothing stopped the deviation, and nothing recorded it — so the batch is indistinguishable from a compliant one in every system the company owns.

That is a quality system that documents rather than one that controls, and the distinction is the whole subject. A non-conformance nobody raised is not an exception the system handled; it is an exception the system never saw. A specification becomes a control only when three things are true: the deviation is prevented or refused at the point of the act; if it is permitted, it is permitted by somebody with the authority to permit it, and recorded as a decision; and the resulting material is identifiable afterwards, so that a question asked in six months has an answer. Everything else is a document that will be produced to an auditor and that had no effect on what was made.

What a hold has to do to stock, why the disposition is the part that decays, and the certificate question that reveals whether any of it was ever real.

Prevent, refuse, or record — but choose deliberately

Not every deviation can be prevented, and a system that tries to prevent everything gets bypassed within a month. The useful design assigns each specification to one of three treatments, deliberately:

Refused. The system will not accept the declaration. Right for the small number of parameters where a deviation is a safety, legal or certification failure — a food-contact ratio, a material substitution on a certified product, a step in a validated process. There should be few of these and everyone should know which they are.

Permitted with authority. The deviation is accepted, but only by a named role, with a reason captured, and the affected material flagged. This is the correct treatment for most real deviations, because the honest reality is that concessions happen and pretending otherwise just moves them off the system.

Recorded only. Captured as data for later analysis, with no gate. Right for parameters where the tolerance is advisory and the volume of events would otherwise make the first two unworkable.

The failure in most factories is that everything is in the third category by default and the first two were never configured. The failure in most failed quality projects is the opposite — everything in the first, followed by a rapid reversion to paper. The judgement about which parameter goes where is engineering work, it takes an afternoon per product family, and it is worth more than the software.

One structural point: a guard that stops a person and not an automated path is a guard with a hole in it. Automated declarations, imports, back-office corrections and integration messages all write production data, and if the rule is enforced on one screen rather than on the write, then the exception is available to anyone who finds the other route. That is the general lesson in why a control has to live where the action happens.

A hold must not move the stock

When material is suspect, the instinct is to move it to a quarantine area. It is the wrong instinct and it destroys the thing you will want most.

Moving stock to quarantine discards the location history — where the material actually was — which is precisely the evidence needed to work out what else was affected. It also breaks expiry-based picking around it, and it creates a second inventory whose reconciliation becomes somebody's monthly problem.

A hold should instead suppress availability in place. The material stays where it is, keeps its history, and simply cannot be allocated. The hold can be applied at the level the problem actually has — a lot, a handling unit, a bin, or all stock belonging to one owner — and lifting it is an event with a name and a reason on it.

This matters as much for the containment question as for the accounting one. When a problem is found, the immediate question is what else shares the cause: the same lot, the same shift, the same machine, the same incoming material. Answering that quickly is the same capability relied on in tracing forward and backward inside two days — and a quarantine move made in the first hour is how a factory loses the ability to answer it.

The disposition is where quality systems decay

Raising a non-conformance is easy and most factories do it. Closing one honestly is the part that rots.

A disposition is a decision: use as is, rework, downgrade, return to supplier, scrap. Four properties separate a real one from a formality.

It names a decision-maker with the authority for that decision. Use-as-is on a certified product is not the same authority as scrap on a low-value part, and a single "QA approves" role collapses that distinction.

It carries a reason that is not the disposition restated. "Use as is — acceptable" is not a reason. It should be possible to read a year of use-as-is decisions and see a pattern, and that is impossible if the reasons are ceremonial.

It drives what happens to the material, automatically. A rework disposition creates the rework work and consumes the cost against the order that caused it; a downgrade moves the material to the second-quality item; a scrap disposition writes it off with the right reason code, which feeds back into the split between the four kinds of loss. If the disposition is a field somebody fills in and the material is dealt with separately by hand, the two will diverge.

It has an age. Open non-conformances that are three months old are the single most reliable indicator that a quality system has become paperwork. One number, published weekly.

The certificate question

Here is the test that reveals whether any of the above is real. Ask for the routine test certificate for a specific drum, batch or serial from eighteen months ago, and time it.

In a lot of factories the honest answer is two days, because the certificate is a scanned document in a folder structure organised by the person who left. Two days is not a filing inconvenience — it is evidence that the certificate is not joined to the thing it certifies, which means that in the one situation that matters, a customer complaint or a recall, the factory cannot assemble its own case at the speed the situation demands.

The fix is that the test result is a record attached to the lot, produced by the inspection step that generated it, and that the certificate is rendered from those records rather than filed alongside them. Then the answer is a query, and the same query answers the harder version — give me every batch made from the same incoming lot, with their results.

What to do first

Classify the parameters for one product family into refused, permitted-with-authority, and recorded. An afternoon with production and quality engineering.

Implement holds in place and stop using a quarantine location for anything except physical segregation that is genuinely needed for safety.

Fix the disposition list, including who may decide what, and publish the open-NCR age weekly.

Join the test results to the lot, and then run the certificate test above and see whether the number moved.

None of it is expensive, and all of it is the part of a manufacturing implementation most likely to be deferred, because quality is the module nobody is chasing at go-live — the sequencing trap set out in what a manufacturing system has to establish, and in what order. Where the requirement is external — a customer scheme, a certification, a regulated market — deciding what the system must hold before choosing it is cheaper than discovering it during an audit, and that is what the scoping stage of the scoping stage of the work is for.