Three things people call CAPA
Getting these straight resolves most CAPA confusion.
| Term | What it is | Example |
|---|---|---|
| Correction | Fixing the immediate problem | Scrap the defective batch |
| Corrective action | Eliminating the cause so it does not recur | Fix the process that produced the defect |
| Preventive action | Eliminating the cause of a potential problem | Fix the same weakness on a line that has not failed yet |
A correction recorded as a corrective action is the most common CAPA failure. Scrapping the batch fixes today. It does nothing about the cause, and an auditor reading a CAPA record whose action is "product scrapped" will ask what changed so it does not happen again.
What the process must include
Clause 8.5 requires a documented procedure covering: reviewing nonconformities including complaints, determining causes, evaluating the need for action, determining and implementing action, recording results, and reviewing the effectiveness of what was done.
Inputs come from complaints, nonconforming product, internal and external audit findings, service reports, process monitoring, supplier issues and post-market surveillance — and a CAPA system fed only by internal audit findings is visibly under-fed.
Why CAPA systems fail audits
1. Root cause is not a root cause. "Operator error" is where an investigation stops, not where it concludes. Why was the error possible? Why did the process allow it? Why did nothing catch it? Auditors push exactly here.
2. No effectiveness check. The action was implemented and the CAPA closed. Clause 8.5 requires review of effectiveness — evidence that the problem actually stopped, after enough time to tell.
3. The backlog. Twenty open CAPAs, half of them over a year old. Individually explainable, collectively a statement that the system does not close things. Auditors read the ageing profile before they read any individual record.
4. Everything becomes a CAPA. The opposite failure. Routing every minor deviation into formal CAPA produces a backlog that buries the ones that matter. Have a documented threshold.
5. No link to risk. A CAPA on a safety-relevant issue should trigger review of the risk management file. Systems that never reference risk are treating quality and safety as separate, which they are not.
What good looks like
A documented threshold for what enters CAPA. Root cause analysis using an actual method rather than a narrative. Actions with named owners and dates. Effectiveness checks scheduled with enough elapsed time to be meaningful. An ageing profile that shows things closing. Trend analysis across CAPAs that feeds management review. And linkage into the risk management file where safety is implicated.
None of it is exotic. What makes CAPA hard is doing it consistently for three years between audits — see internal audit, which is what catches the drift.
FAQs
What is CAPA in ISO 13485?
Corrective and Preventive Action, required by clause 8.5. Corrective action eliminates the cause of an existing nonconformity so it does not recur; preventive action eliminates the cause of a potential one. Both are distinct from a correction, which fixes only the immediate problem.
What is the difference between correction and corrective action?
A correction fixes the immediate problem — scrapping a defective batch. Corrective action eliminates the cause so it does not recur — fixing the process that produced the defect. Recording a correction as a corrective action is the most common CAPA failure in medical device quality systems.
Why do CAPA systems fail audits?
Root causes that stop at operator error rather than asking why the error was possible; missing effectiveness checks, which clause 8.5 requires; a backlog of long-open CAPAs that shows the system does not close things; routing every minor deviation into formal CAPA so real issues get buried; and no linkage to the risk management file.
What is a CAPA effectiveness check?
Evidence, gathered after enough time has passed to be meaningful, that the implemented action actually stopped the problem recurring. Clause 8.5 requires reviewing effectiveness, and closing a CAPA at implementation without that review is a frequently cited finding.
What should feed into a CAPA system?
Complaints, nonconforming product, internal and external audit findings, service reports, process monitoring data, supplier issues and post-market surveillance. A CAPA system fed only by internal audit findings is visibly under-fed and auditors notice the absence of complaint-driven records.
Where to go next
See ISO 13485 consulting, internal audit, or design controls.