What Is CAPA (Corrective & Preventive Action)?
A CAPA is finished when the evidence shows the problem stopped, not when the form is closed. Here is how to get there without a large team.
In Short
- Correction fixes this lot; corrective action removes the cause.
- Decide the effectiveness check before you act, not after.
- Retraining alone rarely fixes a system cause.
Quality Management Buyer Guide
For quality, regulatory and operations teams choosing quality management software. Use it with or without V5.
- Map every issue from raised to human closure.
- Set CAPA effectiveness criteria before you act.
- Separate regulation, configured workflow and lab features.
We ask for your name and email so we can handle this request. The full guide then opens on this site, ready to translate, print or save. Privacy policy. Practical orientation, not legal advice; your quality unit decides which rules apply.
UltimateFree guide
Quality Management Buyer Guide
For quality, regulatory and operations teams choosing quality management software. Use it with or without V5.
Corrective and preventive action (CAPA) is how a quality system turns a problem into a lasting fix. It is also a frequent source of inspection findings, usually because investigations stop at the symptom or nobody checks whether the fix worked. This guide explains what CAPA is, where the requirement comes from for devices, drugs and other regulated products, a practical process, the findings inspectors commonly raise and how CAPA links to deviations, complaints and audits.
What CAPA is, and what it is not
A correction fixes the immediate problem, such as reworking or rejecting a lot. A corrective action removes the cause so it does not happen again.
More on what CAPA is, and what it is not
A preventive action removes the cause of a potential problem before it occurs. CAPA is not a form to close; it is an investigation, a decision about action, and evidence that the action worked. Not every deviation needs a CAPA. Your procedure should say how significance and risk decide when one is opened.
Where the requirement comes from
For medical devices sold in the US, the Quality Management System Regulation (21 CFR Part 820, effective 2 February 2026) incorporates ISO 13485:2016 by reference; corrective action is clause 8.5.2 and preventive action 8.5.3. For US drugs, 21 CFR 211.192 requires thorough investigation of unexplained discrepancies and failures, extended to other batches that may be affected.
More on where the requirement comes from
ICH Q10 describes CAPA as a pharmaceutical quality system element. ISO 9001:2015 clause 10.2 covers nonconformity and corrective action. Food plants meet a similar expectation through corrective actions in 21 CFR 117.150.
A Practical CAPA Process
1. Describe the problem with facts: what, where, when, how many.
Worked Example: One CAPA from Trigger to Closure
- Day 0Deviation DV-318: three labels with the wrong lot code found at packingLine lead
- Day 0Correction: affected cases held and relabelledSupervisor
- Day 3Root cause: lot code typed by hand after a printer template changeQA investigator
- Day 10Action: template locked to the job record; change control CC-77Engineering
- Day 40Effectiveness: no lot-code errors in 30 production days, as defined on Day 3QA
- Day 41QA manager reviews evidence and closes CAPA-112QA manager
More on a Practical CAPA Process
2. Assess risk and decide containment, such as holding affected stock. 3. Investigate the root cause with evidence, using a method that fits, such as 5 Whys, a fishbone diagram or fault tree. 4. Plan actions that address the cause, with owners and dates. 5. Implement, including any document, training or equipment changes through change control. 6. Verify the action was done. 7. Check effectiveness against a measure set in advance, after enough time or volume to judge. 8. Close, with a person's signed decision, and feed the result into management review.
Findings Inspectors Commonly Raise
Root cause recorded as human error with no further analysis. Retraining as the only action for a system problem.
Is this root cause good enough?
- Ask why the error was possible and likely.
- Look at the procedure, task design, equipment and training.
More on findings Inspectors Commonly Raise
Effectiveness checks missing, or defined after the fact. CAPAs open long past their dates with no documented reason. Similar problems handled as separate events with no trend review. Actions closed without evidence attached. Each is avoided by a procedure that asks for evidence at every step and a periodic trend review.
Linking CAPA to deviations, complaints and audits
CAPA is usually triggered from somewhere else: a deviation during production, a customer complaint, an audit finding, an out-of-specification result, a supplier issue or a trend. Keep the link in both directions so a reviewer can see the source events and the resulting actions together, and so a trend review can group related events.
More on linking CAPA to deviations, complaints and audits
Changes made by the CAPA should go through change control and update the controlled documents and training they affect.
Running CAPA without a large team
Use risk to decide depth: a short, documented investigation for low-risk events and a full one for high-risk events. Set realistic dates and record the reason when they move.
More on running CAPA without a large team
Review open CAPAs and trends at a fixed meeting. Where software drafts a summary or suggests a likely cause, a person still reviews the evidence, decides the root cause and approves the actions.
Questions
Is every deviation a CAPA?
No. Many deviations are corrected and closed with a documented assessment. Your procedure should define when risk, recurrence or significance requires a CAPA.
What is the difference between corrective and preventive action?
Corrective action removes the cause of a problem that has happened. Preventive action removes the cause of a potential problem that has not happened yet.
How long should a CAPA take?
Regulations do not set a fixed number of days. Set target dates by risk in your procedure, track them, and document the reason when a date is extended.
Can retraining be a corrective action?
It can be part of one, but on its own it rarely fixes a system cause. Check whether the procedure, design of the task or equipment made the error likely.
Practical orientation, not legal advice. Rules differ by jurisdiction; your quality and compliance team decides what applies.
