A CAPA (Corrective and Preventive Action) control procedure is a documented, systematic process for identifying and eliminating the root causes of nonconformities to prevent recurrence (corrective action) and to prevent potential issues from occurring in the first place (preventive action). In practice, the procedure defines who does what, when, and how—from identifying a problem to verifying that the fix actually works.
What CAPA Stands For and Why It Exists
CAPA is a core requirement of quality management systems (QMS) used in regulated industries like medical devices, pharmaceuticals, and food production. Regulatory bodies such as the FDA and ISO standards (e.g., ISO 9001, ISO 13485) require organizations to have a documented CAPA procedure. The goal is not just to fix a single defect but to improve the overall system so that the same problem does not happen again.
The concept has two distinct parts:
- Corrective Action: Eliminates the root cause of an existing nonconformity to prevent recurrence.
- Preventive Action: Eliminates the cause of a potential nonconformity to prevent occurrence.
While some companies merge these into one procedure, others keep them separate because the triggers and timelines differ.
Key Steps in a CAPA Control Procedure
Most CAPA procedures follow a similar lifecycle, though the number of steps can vary. A typical sequence includes:
- Identification: A problem is reported via a nonconformance, customer complaint, audit finding, or other source.
- Evaluation: The issue is assessed to determine whether it requires a full CAPA or can be resolved with a simple fix.
- Investigation: The root cause is determined using tools like the 5 Whys, fishbone diagrams, or fault tree analysis.
- Action Plan: A plan is developed, including what actions will be taken, who is responsible, and when it will be completed.
- Implementation: The actions are executed.
- Verification: The effectiveness of the actions is checked—did the problem actually go away?
- Closure: The CAPA is formally closed and documented.
Each step should have defined inputs, outputs, and responsibilities. For example, the investigation step should produce a documented root cause analysis, not just a guess.
How to Write a CAPA Control Procedure
When drafting a CAPA procedure, start with a clear purpose and scope. Then define the roles: who can initiate a CAPA, who approves it, and who verifies effectiveness. Include a flow diagram if possible. The procedure should also specify record-keeping requirements, as auditors will look for evidence that the process was followed.
A common mistake is writing a procedure that is too vague. For instance, saying “investigate the root cause” is not enough. Instead, specify which root cause analysis tools are preferred, how many levels of “why” to ask, and what to do if the root cause is not found.
Also, define the escalation path. If a CAPA is not completed on time, what happens? Many procedures include a review board that meets monthly to track open CAPAs.
CAPA vs. Nonconformance vs. Preventive Action
People often confuse these terms. A nonconformance is the event or finding—the problem itself. A corrective action is the response to that problem. Preventive action is a separate, proactive effort. For example, if a batch of product fails testing, the nonconformance is the failed batch. The corrective action might be recalibrating the test equipment. A preventive action could be instituting a monthly calibration check to avoid future failures.
Some modern QMS standards have moved away from the term “preventive action” as a separate category, but the concept remains. In ISO 9001:2015, risk-based thinking is the framework, but CAPA is still widely used in practice.
Common CAPA Problems and How to Avoid Them
Even with a documented procedure, CAPA systems often fail. Common issues include:
- Superficial root cause analysis: Stopping at “operator error” instead of digging into why the operator made the error.
- Ineffective actions: Choosing training as the fix when the real issue is a flawed process or equipment.
- No verification: Closing the CAPA as soon as the action is taken, without checking if the problem is actually gone.
- Poor documentation: Missing signatures, dates, or evidence.
To avoid these, build in checkpoints. For example, require that the root cause analysis be reviewed by someone not involved in the original investigation. Also, set a verification period—say, three months of production data—before closing the CAPA.
CAPA Procedure Template
| CAPA ID | Date Initiated | Initiated By | Source (Complaint, Audit, etc.) |
|---|---|---|---|
Problem Description: _________________________________________
Root Cause Analysis (attach report): _________________________________________
Corrective Action(s): _________________________________________
Preventive Action(s): _________________________________________
Responsible Person: ______________ Due Date: __________
Effectiveness Verification: _________________________________________
Closure Approved By: ______________ Date: __________
Sample (fictional): CAPA ID 2025-014, initiated by J. Smith on 2025-03-01, source: customer complaint. Problem: “Bottle caps leaking.” Root cause: “Torque setting drifted due to lack of calibration.” Corrective action: “Recalibrate capper.” Preventive action: “Add weekly torque check.” Verified: “No leaks in 30-day production.”
CAPA in Different Industries
CAPA is most formal in medical devices and pharmaceuticals, where regulators require strict adherence. In software development, CAPA is less common but can be applied to bug tracking and process improvement. In food safety, CAPA is part of HACCP plans. The core logic is the same, but the documentation and rigor vary.
For small companies, a CAPA procedure can be as simple as a spreadsheet. For large enterprises, it may be integrated into an electronic QMS. The key is that the procedure matches the size and risk of the organization.
Frequently Asked Questions
What is the difference between corrective and preventive action?
Corrective action addresses an existing problem to stop it from happening again. Preventive action addresses a potential problem to stop it from ever happening. Both are part of CAPA, but they are triggered differently.
How long should a CAPA stay open?
There is no fixed rule, but a CAPA should remain open until the effectiveness of the action is verified. That could be weeks or months. Many companies set a target of 30–90 days for initial actions, but verification may extend that.
Do we need a CAPA procedure if we are not regulated?
Even if not required, a CAPA procedure is good practice. It helps you learn from mistakes and improve quality. Many customers and partners expect it.
Who is responsible for CAPA?
Typically, a quality manager or a CAPA coordinator oversees the process. However, anyone in the organization can initiate a CAPA. Responsibility for implementing actions lies with the assigned person from the relevant department.
What if we cannot find the root cause?
If the root cause is not found, document the investigation and implement a containment action. You may also use a more structured tool like a failure mode and effects analysis (FMEA). In some cases, you may need to escalate to a cross-functional team.