The moment has a recognisable shape: the auditor closes their notebook, looks up, and says "we have a few findings." What happens in the days that follow determines whether those findings become closed evidence of a mature compliance system — or the opening clause of a certification suspension notice.
Non-Conformance Reports (NCRs) are not audit failures. They are information. The quality of your organisation's response to NCRs is a more accurate signal of your compliance maturity than the number of NCRs raised in the first place. JAKIM auditors are not counting how many NCRs you have. They are evaluating whether your system for managing them actually works.
Under MHMS 2020, NCR management is a structural requirement of your Halal Assurance System (HAS) — not an optional administrative process. Auditors assess whether your organisation operates a functioning system from detection through to verified closure, with evidence at every stage. NCR responses to external JAKIM findings are submitted to the inspecting officer within the prescribed timeframe, documented in writing, with supporting documents and photographic evidence.
This guide covers the complete NCR lifecycle: what triggers an NCR, how to classify it, how to investigate root causes properly, how to close it with evidence that satisfies a JAKIM auditor, and how to identify the systemic patterns that prevent recurrence across audit cycles.
What does NCR mean in an audit?
NCR means Non-Conformance Report (laporan ketidakakuran): the report the certification authority issues, during an audit or a monitoring visit, when your organisation fails to meet a requirement of Malaysian halal certification. MPPHM 2020 (Pindaan 2026) sorts non-conformances into three categories — KECIL, BESAR and SERIUS — and requires a written answer to each NCR within the period set.
What Is an NCR in the Halal Context?
A Non-Conformance Report (NCR) — or Laporan Ketidakakuran in Malay — is a formal record of a finding where your operations, documentation, or controls do not meet the requirements of MHMS 2020 or your own Halal Assurance System.
NCRs can be raised by:
- Internal auditors during scheduled internal audits under your HAS programme
- JAKIM auditors during certification, surveillance, or unannounced audits under MPPHM 2020
- Your operations team when a halal control deviation is detected during routine monitoring
- Your Halal Executive when reviewing records and identifying a documentation gap
An NCR is not a punishment. It is a structured signal that something needs correcting. The organisations that treat NCRs as failures to hide are the ones whose compliance systems deteriorate across audit cycles. The organisations that treat them as data improve.
NCR Classification Under MPPHM 2020 (Pindaan 2026)
Not all non-conformances carry the same weight. JAKIM classifies NCRs into three categories that determine the required response timeline and the potential impact on certification status.
MPPHM 2020 (Pindaan 2026) does not define these categories by a criterion. For each one, it lists the non-conformances that fall under it: technical non-conformances for KECIL and BESAR, Shariah-related and technical ones for SERIUS. The examples below are drawn from those lists.
| Classification | Examples from the manual | Certification Impact |
|---|---|---|
| KECIL (Minor) | An employee who has not attended halal training; missing raw material purchase receipts | Correction required immediately or within 14 days, or another period deemed reasonable by the authority |
| BESAR (Major) | A supplier of raw materials or ingredients of doubtful halal status added; expired own SPHM certificate still displayed; high-risk GMP contamination; non-compliant Halal Executive or Muslim staffing | SPHM suspended immediately; correction required immediately or within 14 days, or another period deemed reasonable |
| SERIUS (Serious) | Confirmed non-halal status; mixing with non-halal matter; non-compliant slaughter; expired Tauliah Penyembelih | Immediate withdrawal of the SPHM |
The classification distinction matters beyond the immediate response. A pattern of minor NCRs in the same functional area — recurring documentation gaps in supplier management across two consecutive audit cycles — is treated as evidence of a systemic control failure. The auditor may escalate the classification from minor to major at the next cycle. The finding is no longer "incomplete record." It becomes "management has been aware of this gap since the last audit and has not implemented an effective control."
This escalation logic is why individual NCR closure is necessary but not sufficient. What matters for long-term certification health is whether your system prevents the same NCR category from recurring.
The NCR Lifecycle: Six Stages From Detection to Verified Closure
A robust NCR process typically includes identification, ownership assignment, root cause investigation, corrective/preventive action, evidence collection, and verified closure — while MHMS 2020 does not itself prescribe a numbered lifecycle, it does require documented, JKHD-verified corrective action (Section 5(5)). Most compliance failures do not happen because organisations skip stages — they happen because stages are executed superficially. Each stage has specific quality requirements that determine whether the closure will withstand auditor scrutiny.
Recommended NCR Management Workflow
1
Identify & Document
Record the non-conformance using exact wording. Log it in the NCR register immediately — never leave it in an email thread.
2
Root Cause Analysis
Identify the system failure behind the finding — not just the surface symptom. Assign to a named owner with a deadline.
3
Define Corrective & Preventive Action
Document both the corrective action (fix the finding) and the preventive action (prevent recurrence). Assign responsibility.
4
Implement & Gather Evidence
Execute the action. Collect proof: updated SOPs, re-training records, process photos, management sign-offs.
5
Verify Effectiveness
An independent reviewer confirms the root cause is resolved — not just the observable symptom. This step is mandatory before closure.
6
Close NCR
NCR formally closed with documented confirmation. Send the answer to the inspecting officer if externally raised by JAKIM.
Stage 1: Identify and Document
When a non-conformance is detected — during audit, monitoring, or routine operations — it must be formally documented before any corrective action begins. The act of documenting comes first because it establishes the baseline from which improvement is measured.
The NCR record at this stage must capture:
- Date and time of detection
- Location (department, production line, storage area, warehouse zone)
- Description — factual, specific, referencing the MHMS 2020 requirement or HAS procedure not being met
- Classification — KECIL (minor), BESAR (major), or SERIUS
- Evidence — what was observed, measured, or found missing; attach photos, records, or screenshots
- Raised by — name and role of the person who identified the NCR
The quality of the description at this stage determines the quality of everything that follows. "Training records incomplete" is not a usable finding. "Training record for Employee A (receiving operator, HCP-01) missing for halal refresher training due March 2026 — employee has been operating at HCP-01 without refresher for 14 months" gives the corrective action owner what they need. Specificity is not bureaucratic — it is functional.
Stage 2: Assign Ownership
Every NCR must have a named owner — the person with operational authority over the area where the non-conformance was found. This should not default to the Halal Executive for every NCR. Ownership should go to the functional manager responsible for the area where the finding occurred.
The NCR record must capture: owner name, role, and agreed deadline for corrective action. The deadline should align with JAKIM's requirement — correction immediately or within 14 days, or another period deemed reasonable by the authority, with immediate SPHM suspension for BESAR (Major) non-conformances. For NCRs raised externally by JAKIM, the deadline is stated in the audit report and is non-negotiable.
Stage 3: Root Cause Analysis
This is where the majority of NCR processes fail. Correcting the symptom without identifying the root cause guarantees recurrence — precisely the escalation scenario described above.
The practical standard is the 5 Whys method — ask "why" repeatedly until you reach a systemic cause that, if addressed, would prevent recurrence:
Example — Expired supplier certificate found during JAKIM audit:
- Why was an expired certificate used? — The certificate was not renewed before expiry
- Why was it not renewed? — No one monitored the expiry date proactively
- Why was no one monitoring? — The supplier register is a spreadsheet with no alert function
- Why does no alert function exist? — The register was built for storage, not active monitoring
- Root cause: No automated certificate expiry monitoring system with proactive alerts
The corrective action for "expired certificate" is to obtain a renewed certificate. But that corrective action alone does not prevent the same finding at the next audit. The preventive action — which addresses the root cause — is to implement a monitoring system that alerts the team 60 and 30 days before any supplier certificate expires.
For complex NCRs with multiple contributing factors, a fishbone (Ishikawa) diagram can map all contributing causes before identifying the primary root. For process-related NCRs, an Is/Is Not analysis isolates exactly what failed versus what worked correctly.
Stage 4: Define Corrective and Preventive Actions
Two distinct actions are required:
Corrective action (CA) addresses the immediate non-conformance. For the expired certificate: obtain the renewed certificate, verify it against the issuing body's registry, update the supplier record, and assess whether products manufactured during the gap period require re-evaluation.
Preventive action (PA) addresses the root cause and prevents recurrence. For the same finding: implement a monitoring system with automated alerts at 60, 30, and 7 days before any supplier certificate expiry, and define the escalation pathway if a supplier does not respond within 21 days.
Both actions must be documented with specific steps, responsible persons, and deadlines. "We will improve our monitoring" is not a corrective action. The documented action must describe the specific control being implemented or changed.
Stage 5: Implement and Collect Evidence
Execute the corrective and preventive actions within the agreed timeline. For NCRs raised by JAKIM, evidence must be well structured and clearly legible — not paper records photographed at low resolution.
Evidence types vary by finding:
- Updated documents with version numbers showing the change from the previous version
- Photos of physical changes (segregation barriers, labelling updates, storage reorganisation)
- Training records for re-trained staff, including attendance signatures and assessment results
- System screenshots showing new controls or workflow changes
- Supplier correspondence confirming certificate renewal with the renewed certificate attached
- Meeting minutes confirming the JKHD was briefed on the NCR and its resolution
Evidence must be specific and traceable. A general statement that "the issue was resolved" is not evidence. A certificate dated after the NCR date, linked to the NCR record, is evidence.
Stage 6: Verify and Close
Verification before closure is what distinguishes a genuine NCR resolution from a paper exercise. Verification should ideally be conducted by someone other than the NCR owner — in practice, the Halal Executive or a second internal auditor.
Verification requires confirming:
- The corrective action has been fully implemented — not planned or in progress
- The evidence is specific, dated, and directly linked to the finding
- The preventive action is in place and operational — not merely documented
- The effectiveness can be tested (spot-check the process that generated the NCR)
Only after verification is complete should the NCR be formally closed, with a closure date and verifier signature recorded. For externally raised NCRs, the response must be submitted to the inspecting officer in writing, formally, addressing the corrective action taken directly and specifically, with supporting documents (schedules, receipts, halal certificates, invoices) and photographic evidence. A response that does not specifically and directly address the corrective action taken has not met the requirement, and comes back for revision.
NCR Patterns JAKIM Auditors Track Across Cycles
Individual NCRs are assessed in isolation. Patterns of NCRs are assessed as signals about your compliance system's architecture.
JAKIM auditors who conduct multiple audit cycles at the same facility are trained to identify recurrence. A supplier certificate finding that appeared in 2023, was "closed," and reappears in 2025 is not treated as a coincidence. Under MHMS 2020, it is treated as evidence that the corrective action in 2023 addressed the symptom rather than the cause — which is itself a non-conformance under the corrective action effectiveness requirements.
The practical implication: your NCR management system should track findings by category and root cause across cycles, not just by individual NCR closure status. The question to answer before every JAKIM audit is not "are all previous NCRs closed?" It is "are the same NCR categories recurring, and what does that pattern reveal about which system controls are not functioning?"
How MPPHM 2020 Surveillance Audits Change NCR Risk in 2026
The MPPHM 2020 framework allows JAKIM to conduct post-certification surveillance audits — including unannounced or short-notice inspections — independently of the scheduled renewal cycle. Findings raised during these surveillance audits become NCRs subject to the same lifecycle requirements as renewal-audit NCRs.
The NCR implication is significant: manufacturers who are managing compliance manually and reactively face a higher risk of receiving surveillance NCRs at a time when they have not prepared documentation, gathered evidence, or reviewed recent records. A manual compliance system that "works" in a scheduled audit context generates unpredictable risk when the audit window is no longer predictable. A compliance system that generates clean, structured, timestamped records every day reads as evidence of a functioning HAS, not as gaps to investigate.
Common NCR Categories in JAKIM Audits
The categories below are grouped by the MHMS 2020 area they fall under, with the record a JAKIM audit asks to see.
Supplier and raw material management — graded Ketidakakuran BESAR under MPPHM 2020 when the finding falls outside the Minor and Serious categories
- Expired halal certificates on file for raw materials currently in use
- Suppliers present in production records but absent from the approved supplier register
- No documented procedure for verifying new suppliers before first use
HAS documentation and system integrity
- HAS manual version not current — procedures describe a process that no longer exists in practice
- SOPs that do not match actual production floor practice
- Missing records for required HAS activities
JKHD governance and organisational structure
- JKHD meeting minutes unsigned, unformatted, or unfiled
- Halal Executive qualifications not meeting MHMS 2020 competency requirements
- No documented evidence of management review of HAS performance
Staff training and competency at HCPs
- Staff operating at Halal Control Points without documented halal training records
- No scheduled refresher training programme, or schedule not followed
- Training records not linked to specific HCP roles
HCP monitoring and deviation management
- Gaps in monitoring records — missing dates, unsigned entries
- No documented corrective action for detected monitoring deviations
- HCP register not updated following process changes
For a comprehensive pre-audit preparation framework aligned to all thirteen MHMS 2020 general requirements, see our JAKIM audit checklist.
What Happens If NCRs Are Not Closed
Unresolved NCRs create compounding risk across three dimensions:
Audit escalation at the next cycle. Unclosed NCRs from a previous cycle are treated as recurring findings. A minor NCR that was documented but not substantively resolved becomes evidence of systemic failure. Classification changes — what was manageable becomes material.
Certification status impact. Under MPPHM 2020 (Pindaan 2026), a holder who does not carry out the corrective action for a KECIL non-conformance within the period directed is issued a notice of suspension or withdrawal of the SPHM. The inspecting officer may also recommend to the Halal Certification Panel (Panel Pengesahan Halal Malaysia) that the SPHM be withdrawn when a holder does not answer an NCR within the period set. The commercial impact — lost export contracts, breached customer qualification requirements — is what the compliance investment is designed to prevent.
The operational integrity risk that is never formally raised. The most dangerous NCRs are not the ones that were raised and managed poorly. They are the ones that were never formally raised because the organisation lacked the system to detect and document them. A halal control that fails without being recorded is not a managed risk — it is an unknown liability.
Tracking NCRs: Why Spreadsheets Break at Scale
Many organisations track NCRs in spreadsheets. For a small operation with infrequent findings, this can work. The system breaks predictably when deadlines pass without alert, evidence is scattered across email threads, the Halal Executive who understood the spreadsheet leaves, or management needs NCR trend data that cannot be extracted from unstructured rows.
Purpose-built compliance platforms provide a structured NCR workflow where each stage — identification, ownership, root cause, action, evidence, verification — is tracked, timestamped, and linked in a single traceable record. For NCRs raised by JAKIM, records are structured for clean digital export without a manual reformatting step. Dashboards show open NCRs, overdue actions, and trend patterns across cycles without manual compilation.
The difference is not sophistication. It is reliability under the operational pressures — staff changes, production demands, concurrent certifications — that cause manual systems to fail exactly when they are most needed.
How TAQYID Supports the Full NCR Lifecycle
TAQYID's NCR management module was designed specifically around MHMS 2020 corrective action requirements. Each NCR moves through a structured workflow mirroring the six stages above: identification with evidence attachment, ownership assignment with deadline setting, root cause documentation with 5 Whys prompts, corrective and preventive action definition, evidence collection, and independent verification before closure. Every stage is timestamped.
Open NCR dashboards give your Halal Executive and JKHD real-time visibility of all active findings, approaching deadlines, and overdue actions — without manual compilation before each meeting. NCR history and trend analysis across audit cycles is available at any point. When JAKIM requests your full NCR record, the complete structured history exports as a formatted NCR register within a ready-to-submit JAKIM audit dossier — no manual reformatting step.
Explore TAQYID's NCR Management →
Expert Insight: The NCR System That Measures the Wrong Thing
The standard measure of NCR system performance is closure rate — what percentage of raised NCRs are formally closed on time. This metric is necessary but insufficient as a measure of compliance maturity.
The meaningful metric is recurrence rate: how often does the same finding category appear across consecutive audit cycles? A compliance system that closes 100% of NCRs on time but routinely generates the same finding categories in the same functional areas is a system with functioning administration and failing root cause analysis.
JAKIM auditors who conduct multiple cycles at the same facility are trained to recognise recurrence patterns. The supplier certificate finding that appeared in 2023, was closed, and reappears in 2025 tells the auditor that the 2023 corrective action addressed the symptom — not the cause. That conclusion is itself a finding.
The highest-performing compliance teams track not just whether NCRs were closed, but whether the same finding category has recurred — and what that pattern implies about which system controls need structural improvement. This is the standard that separates compliance administration from compliance governance.
Conclusion
NCR management is not a documentation exercise. It is the mechanism that converts audit findings into durable compliance improvement — or, when done poorly, into a cycle of recurring findings that erodes certification health and auditor confidence.
Key takeaways:
- Classification matters: BESAR (Major) non-conformances trigger immediate SPHM suspension and correction immediately or within 14 days; a pattern of unresolved KECIL (Minor) NCRs in the same area can trigger escalation to BESAR
- A structured lifecycle — identify, assign, root cause, action, implement with evidence, verify and close — is a recommended best-practice structure for any NCR; MHMS 2020 requires documented, JKHD-verified corrective action (Section 5(5)) without prescribing a numbered lifecycle
- Externally raised NCR responses are submitted to the inspecting officer within the prescribed timeframe, in writing, with supporting documents and photographic evidence
- MPPHM 2020 surveillance audits mean unannounced inspections can generate NCRs at any time — continuous compliance readiness is no longer optional
- The meaningful performance metric is recurrence rate, not closure rate — whether the same NCR categories keep reappearing is the true signal of system maturity
Explore TAQYID's NCR Management →
Frequently Asked Questions
What is an NCR in a halal audit?
An NCR is a Non-Conformance Report — in Malay, a laporan ketidakakuran. MHMS 2020 refers to it as the report the competent authority raises during auditing and monitoring. It records a point on which your organisation does not meet a requirement of Malaysian halal certification.
What does NCR stand for?
NCR stands for Non-Conformance Report. MHMS 2020 and MPPHM 2020 (Pindaan 2026) both list the abbreviation with that meaning, and the Malay term is laporan ketidakakuran.
How many NCR categories does MPPHM 2020 (Pindaan 2026) set?
Three: KECIL, BESAR and SERIUS. The manual does not define them by a criterion. For each category it lists the non-conformances that fall under it — technical non-conformances for KECIL and BESAR, Shariah-related and technical ones for SERIUS.
How long do you have to correct an NCR?
For a KECIL non-conformance, MPPHM 2020 (Pindaan 2026) provides a warning to correct it immediately, within 14 days, or within any other period deemed reasonable. A BESAR non-conformance carries the same periods, and the SPHM is suspended immediately. A SERIUS non-conformance leads to the immediate withdrawal of the SPHM.
What is a major NCR in a JAKIM halal audit?
A BESAR (Major) non-conformance is one of the technical non-conformances that MPPHM 2020 (Pindaan 2026) lists under that category — for example, a supplier of raw materials or ingredients of doubtful halal status added, an expired own SPHM certificate still displayed, or high-risk GMP contamination. Under MPPHM 2020, a BESAR non-conformance triggers immediate SPHM suspension, with correction required immediately or within 14 days (or another period deemed reasonable by the authority).
How long does a manufacturer have to close NCRs after a JAKIM audit?
The timeline is generally the same regardless of classification: correction immediately or within 14 days, or another period deemed reasonable by the authority — with the key difference that a BESAR (Major) non-conformance triggers immediate SPHM suspension while a KECIL (Minor) one does not. The specific deadline is stated in the JAKIM audit report — follow that date. Responses to externally raised NCRs are submitted to the inspecting officer, documented in writing, with supporting documents and photographic evidence.
What happens if the same NCR appears in two consecutive JAKIM audits?
Recurrence of the same finding across consecutive cycles is treated as evidence of systemic non-compliance — specifically, a failure of corrective action effectiveness. A finding that was minor in the previous cycle may be classified as major upon recurrence, and the auditor may require a comprehensive review of the functional area. Recurrence patterns are among the clearest signals that a Halal Assurance System is not functioning effectively.
Can NCRs be raised by internal auditors, or only by JAKIM?
NCRs can and should be raised internally — by internal auditors during scheduled audit cycles, by the Halal Executive during routine compliance monitoring, or by any staff member who detects a halal control deviation. Internal NCRs raised and resolved before a JAKIM audit both correct genuine compliance gaps and provide documented evidence that the organisation is actively self-monitoring. A functioning internal NCR system is one of the clearest signs that a Halal Assurance System is working as intended.
How should NCR responses be submitted to JAKIM after an external audit?
NCR responses for externally raised findings are submitted to the inspecting officer within the prescribed timeframe. The response must be documented in writing, specific and direct about the corrective action taken, and include supporting documents (schedules, receipts, halal certificates, invoices) and photographic evidence. A response that does not specifically and directly address the corrective action taken has not met the requirement, and the NCR stays open until one does.
