Guide

What Is CAPA (Corrective & Preventive Action)?

CAPA — Corrective and Preventive Action — is the part of a quality system that turns a problem into a permanent fix. It is also the single most common source of FDA Form 483 observations and ISO 13485 non-conformities, because most companies run CAPA as a paperwork ritual instead of as a real investigation. This guide explains what CAPA is, where it comes from in the regulations, the eight-step process the good ones run, the failure modes inspectors look for, and how a modern eQMS makes the difference between a CAPA that closes a finding and a CAPA that becomes one. Written for QA leads, ops directors and compliance owners.

Start free trial Free trial, no credit card, onboard in days, not months.

What CAPA is — and isn't

CAPA is a structured investigation that takes a real problem (a deviation, a complaint, an audit finding, an out-of-spec result, a trend) through containment, root cause, corrective action, preventive action, effectiveness check, and closure — with evidence at every step. It is not: a one-line 'retrained operator' entry on a form; a synonym for 'we wrote a memo'; the same thing as a deviation; or a way to close a finding without changing anything in the process. The single biggest mistake is treating CAPA as documentation. CAPA is the change. The document is just the trail.

The regulatory basis

CAPA is required by FDA 21 CFR 820.100 (medical devices), 21 CFR 211.192 (drug cGMP, framed as 'investigation of discrepancies and failures'), 21 CFR 111.140 (dietary supplements), 21 CFR 117 / FSMA (food), and is explicit in ISO 13485 §8.5.2/3, ISO 9001 §10.2, IATF 16949 and most GFSI food standards (BRCGS, SQF, FSSC 22000). The wording differs but the spine is the same: identify the problem, find the root cause, fix it, prevent recurrence, prove the fix worked. EU GMP Annex 15 and PIC/S add formality around the change-control link. The 2018 FDA Case for Quality program flagged 'CAPA effectiveness' as the single highest-leverage indicator of a healthy quality system — inspectors look here first.

The eight-step CAPA process

A defensible CAPA runs eight steps. (1) Identification: the trigger event — deviation, complaint, audit finding, trend — opens a CAPA with a clear problem statement. (2) Evaluation: do we need a CAPA at all, or is this a one-off correction? Document the decision either way. (3) Containment: what immediate action stops more bad product or bad data right now? (4) Investigation: gather the facts — batches, equipment, people, materials, environment, methods. (5) Root cause analysis: 5-Whys, fishbone, fault tree — pick a method and use it; 'human error' is never a root cause. (6) Corrective action: the fix for what already went wrong. (7) Preventive action: the change that stops it happening elsewhere. (8) Effectiveness check: a deliberate, dated verification — usually 30/60/90 days out — that the action actually worked. Skip step 8 and the CAPA becomes a finding next inspection.

Failure modes inspectors see most

Five patterns dominate Form 483s and audit findings. (1) Root cause = 'human error' or 'operator did not follow procedure' with no investigation of *why* — the SOP was unclear, training was thin, the workstation forced the error, etc. (2) Corrective action is 'retrain' with no change to the procedure, layout or system that produced the error. (3) Preventive action is missing entirely. (4) Effectiveness check is missing or scheduled and never done. (5) CAPA closed before the effectiveness check completes. Behind all five is the same thing: CAPA treated as a form-filling exercise rather than a real change. The fastest way to spot a healthy quality system from the outside is to read three closed CAPAs at random; the fastest way to spot a broken one is the same.

Linking CAPA to deviations, complaints and audits

CAPAs don't appear from nowhere. They are triggered by deviations on the floor, by customer complaints, by internal audit findings, by external audit findings, by supplier non-conformances, by trend signals (e.g., the same in-process check failing across 4 batches). The link matters: an inspector pulls a complaint, asks for the CAPA, then asks for the deviation that the same root cause produced six months earlier. If the records aren't linked, the answer is incoherent. The defensible posture is one platform where complaints, deviations, audits, supplier NCRs and trend alerts all open CAPAs by structured link — and the CAPA carries the lineage back to every event it addresses.

How to run CAPA in 2026 without dedicated headcount

Small and mid-size manufacturers don't have a 4-person CAPA team — and they shouldn't need one. The work is reducible to good tooling plus disciplined ownership. Use a system that (a) opens a CAPA from any trigger in one click, (b) forces a real RCA method, (c) names a single owner with a due date, (d) reminds owners before the date and escalates after, (e) blocks closure without an effectiveness check, (f) surfaces overdue and ineffective CAPAs to the management-review dashboard automatically. With that, one QA owner can run 50+ open CAPAs without losing visibility. Without it, three people will lose visibility on 20.

Standards covered in this guide

Each standard, retailer code or assurance scheme referenced above has its own deep-dive page with scope, audit detail and common pitfalls.

CAPA

Structured investigation + fix loop for recurring problems — required by every quality regime.

Where this lives in V5 Ultimate

The clauses above aren't theoretical — every one maps to a shipped module and an industry profile. Jump to the parts of the product that turn this guide into evidence on a Monday morning.

Modules that do the work

Audits & CAPA

Live CAPA workflow with enforced stages, signed transitions, and effectiveness checks.

Structured deviations

Deviations linked to the CAPAs they trigger — full lineage on every record.

QMS

CAPA, document control, training, complaints — one model, one audit trail.

Compliance self-assessment

Score open CAPAs against 820.100, 211.192, ISO 13485 §8.5.2 on demand.

Management review

Overdue and ineffective CAPAs surface to the management-review dashboard automatically.

Industries this hits hardest

Pharmaceutical Medical devices Food & beverage Dietary supplements Cosmetics

Frequently asked

Is every deviation a CAPA?

No. A one-off deviation with a known correction (e.g. a single mis-printed label rejected at QC and re-printed) is closed as a correction. A CAPA is opened when the deviation is repeating, has unclear root cause, has potential systemic impact, or comes from a regulated trigger (complaint, audit, OOS) that requires investigation. The evaluation step (#2 above) is where you document that decision either way — and the document matters; inspectors look for the reasoning, not just the outcome.

What's the difference between corrective and preventive action?

Corrective action fixes the specific problem that already happened — the bad batch, the wrong label, the missed sign-off. Preventive action stops the same root cause producing the same problem on other lines, products, sites or shifts. A CAPA without a preventive action is half a CAPA — and is one of the most common findings inspectors cite.

How long should a CAPA take?

The investigation and action plan should typically close within 30–60 days; the effectiveness check is dated separately, often 60–90 days after the action is implemented. CAPAs that drag past 6 months are a red flag — either the root cause was wrong, the action wasn't owned, or the system has no escalation. Inspectors will pull the oldest open CAPA and ask why.

Can 'retraining' be a corrective action?

Only as part of one — never alone. If the root cause is 'operator didn't know X', that itself is a finding (why didn't the SOP, the workstation or the training program teach X?). Retraining is a useful supporting action, but the corrective action must include a procedural, system or design change that means the next operator can't make the same mistake. CAPAs closed with 'retrained operator' as the only action are the single most-cited weak pattern in modern audits.

See it on your shop floor.

Free trial, no credit card, onboard in days, not months.

Start free trial See pricing →Browse all resources →