Did they call out a specific section for the non conformance? Would 8.4.2 Note 2 come into play here?
"NOTE 2: Verification activities can include:
− review of objective evidence of the conformity of the processes, products, and services from the external provider (e.g., accompanying documentation, certificate of conformity, test documentation, statistical documentation, process control documentation, results of production process verification and assessment of changes to the production process thereafter);"
Edit:
The last part of Note 2 lets us know there is a little more to it btw:
"When the organization delegates verification activities to the external provider, the scope and requirements for delegation shall be defined and a register of delegations shall be maintained. The organization shall periodically monitor the external provider’s delegated verification activities.
When external provider test reports are utilized to verify externally provided products, the organization shall implement a process to evaluate the data in the test reports to confirm that the product meets requirements. When a customer or organization has identified raw material as a significant operational risk (e.g., critical items), the organization shall implement a process to validate the accuracy of test reports."