All guides
How-to · 3 min read
Building a CAPA process that works
Corrective and preventive action is where quality systems prove they learn. Auditors read CAPA records to see whether problems get fixed for good, or just fixed. Here's a process that holds up, and the records it needs.
Correction, corrective action, preventive action
- Correction fixes the problem in front of you (rework the batch, recalibrate the balance).
- Corrective action removes the cause so it doesn't happen again.
- Preventive action removes the cause of a potential problem before it happens.
Not every deviation needs a CAPA. Decide by risk: a one-off with a known cause may need only a correction; a recurring or serious problem needs an investigation and a CAPA.
The steps
- Identify the problem and its source (deviation, complaint, audit finding, trend, nonconformance).
- Evaluate its risk and decide whether a CAPA is needed.
- Contain it: protect product and customers now.
- Investigate the root cause with a method suited to the problem (5 whys, fishbone, fault tree), with evidence, not opinion.
- Plan actions that address the root cause, each with an owner and a due date.
- Implement them, through change control where they change processes or documents.
- Verify effectiveness after enough time has passed to show it worked, against criteria set in advance.
- Close it with approval, and feed it into management review.
The record auditors look for
- A clear problem statement and where it came from, linked to the source record
- The risk assessment and the decision that a CAPA was (or wasn't) needed
- Containment actions and what happened to affected product
- The investigation and the root cause, with evidence
- Actions with owners, due dates and completion
- The effectiveness check: the criteria, the result, and who decided
- Approval signatures, and the full history of changes
Mistakes that lead to observations
- "Retrain the operator" as the root cause and the action, every time.
- Effectiveness checks that are just "action completed".
- CAPAs open for months with no extensions approved.
- No trending: the same problem opened as new CAPAs again and again.
Requirements for this sit in 21 CFR 211.192 and 211.100 for drugs, ISO 13485 §8.5.2 and §8.5.3 (and so the FDA's QMSR) for devices, and ISO 9001 §10.2 everywhere else.