Your calibration technician just returned a torque wrench from the lab. The certificate says "as-found: out of tolerance."
That single line on a calibration certificate can set off a chain reaction across your quality system. Every measurement that wrench made since its last known good calibration is now suspect. Every product it touched. Every batch it verified.
What you do in the next 48 hours determines whether this becomes a controlled investigation or an audit finding.
Most quality managers have an OOT procedure buried in their QMS somewhere. But when the moment arrives — often at 4pm on a Thursday — the procedure turns out to be vague, the paper trail is scattered across three filing cabinets, and someone is already asking whether production needs to stop.
This playbook gives you a concrete, step-by-step response protocol you can follow the next time an instrument comes back out of tolerance. It's written for quality managers and calibration coordinators at small-to-mid-sized manufacturers, particularly those operating under ISO 9001, ISO 13485, or IATF 16949.
Why OOT Events Demand a Structured Response
An out-of-tolerance finding isn't just a maintenance issue. Under most quality management system standards, it triggers a formal obligation to assess the validity of previous measurements.
ISO 9001:2015, Clause 7.1.5.2 states:
"The organisation shall determine if the validity of previous measurement results has been adversely affected when measuring equipment is found to be unfit for its intended purpose, and shall take appropriate action as necessary."
ISO 13485:2016 goes further in Clause 7.6, requiring you to assess the validity of prior results and record the outcome.
In practice, this means you can't just recalibrate the instrument and move on. You need to trace backwards, assess impact, and document what you found — even if the impact turns out to be negligible.
Auditors know this. An OOT event with no documented investigation is one of the most common nonconformance findings in ISO 13485 and IATF 16949 audits.
The OOT Response Protocol: Step by Step
Step 1: Quarantine the Instrument (Immediately)
The moment an instrument is identified as out of tolerance, remove it from service. Label it clearly — a physical tag or sticker reading "DO NOT USE — Under Investigation" is sufficient.
What to record:
- Instrument ID, serial number, and location
- Date the OOT condition was discovered
- Who discovered it (technician, lab, vendor)
- The as-found readings vs. tolerance limits
- How far out of tolerance (magnitude matters)
This seems obvious, but it's frequently missed when calibration certificates arrive by email and get filed without anyone flagging the as-found status.
Step 2: Determine the Suspect Period
The suspect period is the window between the last known good calibration and the date the OOT condition was discovered.
If the instrument was last calibrated on 1 March and found out of tolerance on 1 September, every measurement taken between those dates is potentially affected.
Key questions:
- When was the instrument last calibrated and found within tolerance?
- Was it used continuously throughout the period, or was it in storage for part of it?
- Were there any intermediate checks or verifications?
If your organisation performs intermediate checks (and you should), these can narrow the suspect window significantly. An instrument verified as within tolerance on 1 June reduces your suspect period from six months to three.
Step 3: Identify Affected Products and Processes
This is the step most organisations find hardest — because it requires traceability between instruments and the products they measured.
What you need to trace:
- Which products, batches, or lots were measured using this instrument during the suspect period?
- Which process steps or inspection points used this instrument?
- Were any of those measurements critical-to-quality (CTQ) characteristics?
In a well-organised system, this should be straightforward. Your calibration records link instruments to workstations or production areas. Your batch records or inspection reports link measurements to product lots.
In a spreadsheet-based system, this often means cross-referencing multiple documents manually — calibration schedules, production logs, inspection reports — which is where the 8-hour audit scramble begins.
How Scopax handles this: Scopax's OOT workflow automatically links instruments to their calibration history with timestamped records. When an OOT event is flagged, the system identifies the suspect period based on certificate dates and surfaces the instrument's full usage context, so you're not reconstructing timelines from scratch.
Step 4: Assess the Impact
Not every OOT finding has the same severity. A torque wrench reading 0.5% high on a non-critical fastener is different from a CMM probe drifting 50 microns on a medical implant dimension.
Assessment criteria:
- Magnitude of deviation: How far out of tolerance was the instrument? Was it marginal or significant?
- Direction of deviation: Was the instrument reading high or low? Does the direction of error make affected products more likely to be out-of-spec, or does it add margin?
- Measurement criticality: Were the affected measurements on safety-critical, regulatory, or customer-critical characteristics?
- Product disposition: Were the affected products already shipped, in stock, or still in process?
Decision outcomes:
- No impact: The deviation is within the measurement uncertainty or affects non-critical dimensions. Document the rationale and close.
- Potential impact, no recall: Re-inspect affected product using a known-good instrument. If product is within specification, document and close.
- Confirmed impact: Affected product is out of specification. Initiate your nonconforming product procedure (NCR) and assess whether customer notification or recall is required.
Step 5: Link to Your NCR/CAPA System
If the impact assessment identifies nonconforming product, the OOT investigation should feed directly into your existing NCR and CAPA processes.
Document the link:
- OOT investigation reference number
- NCR reference number(s)
- CAPA reference (if root cause analysis triggers a corrective action)
- Disposition decisions for affected product (use as-is, rework, scrap, recall)
This linkage is critical for auditors. They want to see that your OOT procedure doesn't exist in isolation — it connects to your broader quality system.
How Scopax handles this: Each OOT event in Scopax can be linked to NCR references and include disposition records. The investigation record captures the full chain — from the OOT finding through impact assessment to the NCR linkage — in a single, auditable trail.
Step 6: Determine Root Cause
Why did the instrument go out of tolerance? Common causes include:
- Wear and degradation: Normal ageing, particularly for mechanical instruments
- Physical damage: Dropped, overtightened, exposure to extreme conditions
- Environmental factors: Temperature or humidity outside operating range
- Calibration interval too long: The instrument drifts faster than the calibration cycle accounts for
- User error: Improper use, storage, or handling
Understanding the root cause informs whether you need to adjust calibration intervals, improve handling procedures, or replace the instrument entirely.
Step 7: Take Corrective Action and Close
Based on your root cause analysis:
- Recalibrate or replace the instrument
- Adjust calibration intervals if drift is a recurring pattern
- Update handling procedures if damage or user error is the cause
- Re-inspect affected product if impact was identified
- Train personnel if procedural gaps contributed
Close the investigation with a summary that includes:
- What was found
- What was affected
- What was done about it
- What was changed to prevent recurrence
The OOT Decision Flowchart
Here's the full response flow as a decision tree:
OOT Finding Discovered
|
|-> Quarantine instrument immediately
|
|-> Determine suspect period
| (last good cal -> OOT discovery date)
|
|-> Identify affected products/processes
| |-> Can you trace which products were measured?
| |- YES -> Proceed to impact assessment
| |- NO -> Treat all products in period as suspect
|
|-> Assess impact
| |-> Magnitude: marginal or significant?
| |-> Direction: does error add or remove margin?
| |-> Criticality: safety/regulatory dimensions?
| |
| |- NO IMPACT -> Document rationale, close
| |- POTENTIAL -> Re-inspect with known-good instrument
| | |- Product OK -> Document, close
| | |- Product NOT OK -> Raise NCR
| |- CONFIRMED IMPACT -> Raise NCR + assess recall
|
|-> Root cause analysis
| (wear / damage / environment / interval / user error)
|
|-> Corrective action and closure
(recalibrate, adjust interval, retrain, update procedures)
Common Mistakes to Avoid
Recalibrating without investigating. Sending the instrument straight back to the lab without assessing the impact of the OOT finding. This is the single most common audit finding.
Assuming "close enough" is fine. If the instrument was marginally out of tolerance, it's tempting to dismiss it. But "marginal" still means out of tolerance. Document your rationale for why the impact is negligible — don't just skip the assessment.
No traceability to product. If you can't trace which products were measured with which instruments, every OOT event becomes a worst-case scenario. Build this traceability before you need it, not during the investigation.
Investigating in email. OOT investigations conducted over email threads are difficult to audit, easy to lose, and impossible to report on. Use a structured record — whether that's a form, a database entry, or a system like Scopax that captures the full investigation in one place.
Forgetting to close the loop. The investigation identified a root cause. A corrective action was proposed. But three months later, nobody verified that the corrective action was implemented. Auditors check for this.
Building OOT Readiness Before It Happens
The best time to establish your OOT response capability is before you need it. A few investments that pay off:
-
Instrument-to-product traceability. Know which instruments are used at which stations, and ensure batch records capture instrument IDs.
-
Intermediate checks. Periodic verification between calibrations narrows the suspect window when an OOT event occurs.
-
As-found / as-left recording. Ensure your calibration certificates always include as-found data, not just as-left. Without as-found readings, you can't even identify an OOT event.
-
A documented OOT procedure. Write it, approve it, and make sure your team knows where to find it. The time to figure out your response process is not during the response.
-
Digital records. When an OOT event triggers an investigation, your ability to respond quickly depends entirely on how fast you can find the relevant calibration history. If that history is in a filing cabinet or a spreadsheet with 47 tabs, you're starting behind.
Why This Fails in Audits
In AS9100, ISO 13485, and FDA 21 CFR 820 environments, auditors do not just check that you recalibrated an instrument. They check whether you can prove a complete retrospective impact assessment, including the suspect period, affected records, disposition logic, and closure evidence. Missing one link in that chain is usually enough for a major finding.
How Scopax Enforces This Workflow
Scopax turns the OOT response into a required workflow: quarantine record, suspect period, blast-radius review, NCR linkage, and closure notes in one trail. That removes the common failure mode where teams complete the technical correction but cannot prove the decision chain during the audit.