CARCorrective Action Request

A Corrective Action Request (CAR) is the formal, controlled request to investigate a nonconformity, deviation, complaint, audit finding, or other quality signal that may require corrective action. It is the upstream gate to the CAPA process — the moment a problem stops being a conversation and becomes an auditable record. Under 21 CFR 820.100(b), the CAPA procedures must include requirements for analysing data sources to identify quality problems; the CAR is the document that captures the resulting decision to investigate one.

CARs are not the same as nonconformance reports (NCRs) or deviations. An NCR records that a specific product or batch did not meet specification — it is a product disposition decision. A deviation records that a process step departed from the documented procedure. A CAR is the systemic response: it asks 'why is this happening, and what do we change so it stops?'. A single CAR may aggregate evidence from multiple NCRs, deviations, complaints, or audit findings into one investigation.

Almost every regulated-manufacturing standard mandates a CAPA system; almost none of them use the word 'CAR' explicitly. The CAR is industry's response to the practical question of 'how do we trigger and document the CAPA workflow?'. The regulations that drive the requirement are 21 CFR 820.100 (medical devices, now QMSR effective Feb 2026), 21 CFR 211.192 (pharmaceutical investigation of discrepancies), 21 CFR 117.150 (preventive controls for food), 21 CFR 111.140 (dietary supplements), ISO 13485 §8.5.2, ISO 9001 §10.2, ICH Q10 §3.2.2, and the GFSI schemes BRCGS, SQF, FSSC 22000 all in their nonconformity and corrective-action clauses.

Inspectors and auditors do not care what the form is called — they care about the audit trail: a documented trigger, a documented investigation, documented root-cause analysis, documented action, documented verification of effectiveness, and a timeline. A CAR is the artefact that opens and closes that audit trail.

A CAR that survives audit contains, at minimum, these fields:

• Unique identifier and date raised — chronological tracking and traceability across the CAPA system.
• Source of the trigger — internal audit, supplier audit, regulatory inspection, customer complaint, NCR aggregation, recurring deviation, management review, trend signal.
• Statement of the problem — factual, specific, scoped. 'Mixing process produces out-of-spec viscosity in 4 of last 12 batches' is a CAR; 'mixing problems' is not.
• Evidence — the data, records, photos, samples that support the problem statement.
• Affected scope — products, batches, processes, sites, time window. Drives quarantine and customer-notification decisions.
• Initial risk classification — typically a severity × likelihood matrix, used to assign owner and due date.
• Containment actions taken at time of raise — stop production, segregate stock, hold shipments, notify customer.
• Proposed CAPA owner and target close date.
• Pre-approval signatures — typically QA and the functional owner.

The defensible workflow has five gates. Gate 1 — Raise: any qualified person can raise a CAR; QA reviews for completeness and triages by risk. Gate 2 — Investigate: the assigned owner runs the root-cause analysis (typically 5 Whys, fishbone, 8D, or fault-tree analysis depending on complexity); QA approves the root cause before action design. Gate 3 — Action: corrective actions (fix the cause of this occurrence) and preventive actions (prevent recurrence) are designed with owners and dates; QA approves before execution. Gate 4 — Implement: actions executed, evidence captured. Gate 5 — Verify effectiveness: defined verification activity (typically a time-bound trend review, a re-audit, or a confirmation batch run) confirms the actions worked.

The most common workflow failure is closing a CAR at Gate 4 without Gate 5. ISO 13485 §8.5.2(f) and 21 CFR 820.100(a)(4) are explicit: corrective actions must be verified to ensure they do not adversely affect the finished device and that they are effective. A CAR closed without effectiveness verification is, in inspection terms, not closed.

Mature CAR systems route automatically based on severity. A common rubric:

The classification must be documented at raise time with the rationale, and revisited by the investigation owner — investigations frequently uncover that a 'minor' is actually a 'major' once the scope is understood. The audit trail must show both the original classification and any reclassification.

Inspectors increasingly evaluate CAPA systems through metrics, not just record samples. The defensible set:

• CARs raised per period, by source. Falling internal-audit CARs alongside rising regulatory CARs is a red flag.
• Time to close, by severity. Critical CARs open >90 days suggest containment is masking the investigation.
• Effectiveness-verification pass rate. <90% suggests root cause is being closed too early.
• Repeat-CAR rate. CARs raised against the same process or cause within 12 months indicate the previous CAPA did not address root cause.
• Overdue rate. >10% overdue across the open CAR population suggests the system is overwhelmed and needs resource or scope re-evaluation.

These are also the metrics that should appear in Management Review under ISO 13485 §5.6.2 and ICH Q10 §3.2.4 — the management oversight that is itself an inspection focus.

• Conflating containment with corrective action. Stopping production and quarantining stock is containment; redesigning the process to prevent recurrence is the corrective action.
• Root cause stated as 'human error' without an underlying systems cause. Inspectors reject this — humans operate inside systems and the system permitted the error.
• Closing CARs at action-implemented stage without scheduled effectiveness verification.
• No link between the CAR investigation and any change to procedures, training, equipment, or the QMS. A CAR with no resulting change is, by definition, ineffective.
• Trend analysis absent. 21 CFR 820.100(a)(1) requires analysis of data sources to identify existing and potential causes — meaning the CAR system itself must be trended.