The Seven Steps of CAPA

Throughout my extensive consultation work with pharmaceutical and medical device companies, I have frequently observed cases where CAPA (Corrective and Preventive Action) procedures have evolved into company-specific, non-standardized approaches that deviate from regulatory expectations.

An effective and fully compliant corrective and preventive action program must be systematic and can be divided into the following seven-step process:

1. Identification – Identifying the problem
2. Evaluation – Estimating severity and impact
3. Investigation – Planning the investigation of the problem
4. Analysis – Conducting thorough evaluation
5. Action Plan – Creating a list of necessary tasks
6. Implementation – Executing the action plan
7. Follow-Up – Verifying effectiveness and conducting evaluation

Each step must be fully documented in accordance with current Good Manufacturing Practice (cGMP) requirements, ISO 13485:2016 standards for medical devices, and ICH Q10 Pharmaceutical Quality System guidelines.

1. Identification (Problem Identification)

The first step in the CAPA process is to clearly define the problem or potential problem (i.e., risk). A detailed description of the problem and documentation of substantial evidence that the problem exists are required.

Ideally, anyone in the organization should be able to initiate a CAPA. If the person who discovers a nonconformity (or receives a report of one) cannot easily initiate a CAPA, quality improvement will progress very slowly. This aligns with the principles of quality culture emphasized in recent FDA guidance documents and ICH Q10.

Voluntary CAPAs (for example: in-process nonconformities, rework, special approvals, trends identified through statistical methods, etc.) are desirable and demonstrate a proactive quality culture.

Reactive CAPAs driven by external forces (for example: complaints, audit findings from internal audits, external audits, supplier audits, third-party audits, FDA observations, warning letters, etc.) are necessary and important, but represent a reactive response where the organization is addressing issues after they have escalated.

If CAPAs cannot be initiated voluntarily, the organization lacks self-correcting capability, and a reduction in nonconformity rates cannot be expected. This principle is fundamental to modern quality risk management approaches outlined in ICH Q9.

It is necessary to clearly specify in each procedure the criteria (conditions) for initiating a CAPA. These criteria should be risk-based and aligned with the organization’s quality objectives.

2. Evaluation (Assessment)

Assess the severity and estimate the impact. Evaluate the potential impact of the problem and the risk to the company and its customers.

Also determine the immediate actions and corrective actions that will be needed before implementing CAPA. It is important to distinguish between:

• Immediate actions: Quick containment measures to prevent further issues
• Corrections: Actions to eliminate detected nonconformity
• Corrective actions: Actions to eliminate the root cause and prevent recurrence
• Preventive actions: Actions to eliminate potential nonconformities before they occur

Evaluate the severity of the problem based on the impact assessment results. This evaluation should consider factors such as patient safety, product quality, regulatory compliance, and business impact.

Based on severity, determine the priority order for implementing response measures. Many organizations use a risk-scoring matrix that considers both the severity of the potential impact and the probability of occurrence, consistent with ISO 14971 (medical device risk management) and ICH Q9 (pharmaceutical quality risk management).

3. Investigation (Root Cause Investigation)

Create an investigation plan to conduct the problem investigation and ensure that the investigation is complete and nothing is overlooked.

The “Investigation Plan” should include:

Investigation Objectives

The objective is a statement of the expected results for the corrective or preventive action. The investigation is complete when all aspects of the objective have been met and verified.

Investigation Strategy

This includes the methodologies to be employed, such as:

• Why-Why Analysis (5 Whys technique)
• Fishbone Diagram (Ishikawa Diagram)
• Fault Tree Analysis
• Failure Mode and Effects Analysis (FMEA)
• Kepner-Tregoe Problem Solving

Assignment of Responsibilities and Required Resources

Clearly identify the responsible person(s) and team members, including their qualifications and authority to conduct the investigation.

4. Analysis (Detailed Analysis)

Conduct a thorough evaluation according to the “Investigation Plan.”

In the analysis, estimate all possible causes (i.e., formulate hypotheses) and determine whether they are actual causes by collecting appropriate data.

Organize and document the collected data. In some cases, reproduction experiments may be necessary to confirm the root cause.

The goal of root cause investigation is to identify the root cause. If the root cause cannot be identified, corrective action cannot be implemented, meaning recurrence cannot be prevented.

It is necessary to determine the “why” behind why such a situation occurred. The challenge is to dig deeper beyond superficial causes to uncover systemic issues.

Corrective action always involves the elimination of the root cause. To eliminate the root cause, all causes must be thoroughly investigated. Identifying and specifying causes is an indispensable action for corrective action.

Without root cause investigation, corrective action cannot exist.

Eliminating the identified cause means ensuring that the same nonconformity or other undesirable situation never occurs again, which is to say, preventing recurrence.

As root causes, pursue defects, weaknesses, inadequacies, contradictions, and ambiguities in the system (the mechanism, i.e., the Quality Management System or QMS).

In other words, the core of corrective action (recurrence prevention) is to address defects, weaknesses, inadequacies, contradictions, and ambiguities in the QMS. This approach is emphasized in ISO 13485:2016 Clause 8.5.2 and 8.5.3, as well as 21 CFR Part 820.100 for medical devices and 21 CFR Part 211 Subpart J for pharmaceuticals.

However, it is not easy to suddenly identify the root cause (true cause). The true cause does not readily reveal itself without systematic and rigorous investigation.

Common pitfalls to avoid in root cause analysis include:

• Stopping at symptoms rather than digging to systemic causes
• Accepting “human error” as a root cause without investigating why the error was possible
• Focusing on individual blame rather than system improvement
• Failing to verify root causes through data and evidence

5. Action Plan (Development of Action Plan)

Based on the analysis, create the best action plan to correct and prevent the problem.

This action plan should describe the changes to be implemented and the assignment of responsibilities for tasks.

Also, as appropriate, enumerate the actions to be completed, changes to documents or specifications, changes to processes, procedures or systems, employee training, monitoring or controls to prevent recurrence of the problem, and the responsible person/personnel for completing each task.

If human error or human factors such as discipline, attentiveness, or awareness are made the corrective action, recurrence will eventually occur.

Corrective actions such as “thorough training was provided” are not acceptable. The plan must address defects in the QMS, not rely solely on human vigilance. This principle is fundamental to modern quality management and is emphasized in human factors engineering approaches required by FDA and international standards.

Effective action plans should:

• Address the root cause, not just symptoms
• Include system-level improvements to the QMS
• Incorporate error-proofing (poka-yoke) mechanisms where possible
• Define measurable success criteria
• Establish realistic timelines with milestones
• Identify required resources (personnel, equipment, budget)

The action plan should also consider:

• Whether changes require validation or qualification
• Impact on other processes or products
• Need for regulatory notifications or submissions
• Supplier involvement if applicable

6. Implementation (Execution of Actions)

Execute the tasks planned in the action plan.

Fully document all necessary work described in the action plan.

Be sure to record all revised procedures, documents, specifications, etc. Change control procedures must be followed in accordance with regulatory requirements.

Also, employee training is an essential requirement for implementing any changes and should be part of the action plan. Training should be documented with:

• Training objectives and content
• Attendees and their signatures
• Date and duration
• Assessment of training effectiveness (where appropriate)
• Qualification of trainers

To be effective, all corrections and change implementations must be communicated to all affected or potentially affected personnel, departments, suppliers, etc. This communication should be documented and include verification that the message was received and understood.

Implementation considerations should include:

• Pilot testing of changes before full implementation (where appropriate)
• Monitoring during implementation phase
• Documentation of any deviations from the action plan
• Adjustment of the plan if unforeseen issues arise

7. Follow-Up (Verification and Monitoring)

One of the most fundamental steps in the CAPA process is verification of effectiveness (completion of evaluation of response measures).

Verification of effectiveness not only confirms completion of identified tasks but also evaluates the appropriateness and effectiveness of the response measures.

CAPA is complete when verification of effectiveness (follow-up) is finished.

Enter the date and obtain signatures from personnel with appropriate authority. The sign-off should confirm that:

• All planned actions have been completed
• The root cause has been eliminated
• The problem has not recurred
• The effectiveness of the corrective action has been verified through objective evidence

Effectiveness verification should include:

• Short-term verification: Immediate confirmation that actions were implemented as planned
• Long-term verification: Monitoring over an appropriate time period to ensure sustained effectiveness and no recurrence

The duration of effectiveness monitoring should be risk-based and sufficient to provide confidence that the corrective action has achieved its objective. For high-risk issues, longer monitoring periods may be warranted.

Key metrics and indicators should be established to measure effectiveness, such as:

• Reduction in nonconformity rates
• Improved process capability indices
• Decreased customer complaints
• Enhanced audit findings
• Better compliance metrics

Management Review and Continuous Improvement

Implemented CAPAs should be reported to Management Review after conducting statistical analysis and data analysis. This reporting is a requirement of ISO 13485:2016 Clause 5.6, 21 CFR Part 820.20(b) for medical devices, and 21 CFR Part 211.180(e) for pharmaceuticals.

Management Review should evaluate:

• Trends in CAPA initiation and closure rates
• Recurring issues indicating systemic problems
• Effectiveness of the CAPA system itself
• Resource adequacy for CAPA activities
• Opportunities for preventive actions based on CAPA data
• Integration of CAPA data with other quality metrics

It is strongly recommended that the above seven steps be documented as a formal procedure within your Quality Management System. This procedure should define:

• Roles and responsibilities at each step
• Timelines and escalation criteria
• Documentation requirements
• Approval authorities
• Links to related procedures (change control, document control, training, etc.)
• Metrics for measuring CAPA system performance

Regulatory Perspective

The CAPA system is a critical element of quality systems regulation worldwide. Key regulatory requirements include:

For Medical Devices:

• FDA 21 CFR Part 820.100 (US)
• ISO 13485:2016 Clauses 8.5.2 and 8.5.3 (International)
• EU MDR Article 10 and Annex I (European Union)
• MDSAP AU G004 (Medical Device Single Audit Program)

For Pharmaceuticals:

• FDA 21 CFR Part 211.180(e) and Part 211.192 (US)
• ICH Q10 Pharmaceutical Quality System (International)
• EU GMP Chapter 1 (European Union)
• PIC/S GMP Guide (International)

Regulatory inspections frequently cite CAPA deficiencies as significant findings. Common observations include:

• Inadequate root cause analysis
• Failure to implement corrective actions in a timely manner
• Lack of effectiveness verification
• Treating symptoms rather than addressing root causes
• Accepting “human error” without systemic investigation
• Inadequate documentation
• Failure to identify trends requiring preventive action

A robust, systematic seven-step CAPA process as described in this article provides a framework for meeting these regulatory expectations and, more importantly, achieving genuine quality improvement and patient safety.

Conclusion

The seven-step CAPA process—Identification, Evaluation, Investigation, Analysis, Action Plan, Implementation, and Follow-Up—provides a systematic framework for addressing quality issues and preventing their recurrence. When properly implemented and integrated into the overall Quality Management System, this process becomes a powerful engine for continuous improvement.

The key to success lies not in merely following the steps mechanically, but in embracing the underlying principles: thorough investigation, root cause identification, systemic improvement, and verification of effectiveness. Organizations that master this approach demonstrate true quality culture and regulatory compliance while delivering safer, higher-quality products to patients and customers.