The Seven Stages of CAPA: A Comprehensive Guide for Quality Management

In quality management and manufacturing environments, responding appropriately to problems when they occur is critically important. The widely utilized methodology for this purpose is “CAPA (Corrective Action and Preventive Action).” CAPA is not merely a problem-solving technique but is positioned as a systematic process that supports continuous improvement in organizations. This article explains the seven stages of CAPA in a manner accessible to beginners. Additionally, it provides an overview of the seven steps in FDA QSR 820.100, offering a perspective on CAPA from a regulatory compliance standpoint.

What is CAPA?

CAPA is an abbreviation for “Corrective Action” and “Preventive Action.” It is a critical element of quality management systems designed to systematically implement corrective actions to resolve problems when they occur and preventive actions to ensure similar problems do not arise in the future. CAPA is widely adopted in industries where quality is paramount, including pharmaceuticals, medical devices, aerospace, and automotive sectors.

Important Note on Terminology: While the term “CAPA” is commonly used in practice, it is important to recognize that corrective action and preventive action are conceptually distinct processes. ISO 13485:2016, the international standard for medical device quality management systems, addresses these in separate clauses (8.5.2 for Corrective Action and 8.5.3 for Preventive Action). Some regulatory experts caution against combining these processes into a single “CAPA procedure,” as doing so may obscure the fundamental differences between addressing existing problems (corrective action) and preventing potential problems (preventive action). Nevertheless, this article uses “CAPA” as an umbrella term for both concepts, as is common in industry practice.

The Seven Stages of CAPA

Stage 1: Problem Identification and Reporting

The first step in the CAPA process is to accurately identify the problem and report it appropriately. At this stage, it is essential to clearly document “what,” “when,” “where,” and “how” the problem occurred. The key is objective information gathering based on facts. Eliminating emotions and speculation, and reporting based on specific data and observation results is required.

For example, describe specifically: “In Lot Number B12345 of Product A, out-of-specification dimensional errors were detected in three consecutive units during final inspection on April 15, 2025.”

Stage 2: Problem Severity Assessment

This is the stage where the severity of the identified problem is evaluated. Here, the scope of the problem’s impact, its seriousness, and urgency are comprehensively assessed. Using risk assessment methods to quantitatively evaluate the severity of the problem is also effective.

Based on the evaluation results, response priorities are determined, and systems are established to respond quickly to serious problems requiring immediate action.

Stage 3: Immediate Response Measures (Containment)

Immediate response measures are temporary countermeasures taken to prevent the problem from expanding. The purpose of this stage is to minimize the impact of the problem until the root cause is identified and a permanent solution is implemented.

For example, this includes stopping product shipments to prevent defective products from reaching the market, isolating defective lots, and notifying customers. These measures need to be executed quickly, but it should be recognized that they are only temporary.

Stage 4: Root Cause Analysis

This is the stage where analysis is conducted to identify the true cause, not just the superficial symptoms of the problem. Here, techniques such as 5 Why analysis, cause-and-effect diagrams (fishbone diagrams), FTA (Fault Tree Analysis), and FMEA are used to pursue the root cause of the problem.

Rather than simply concluding “human error,” it is important to dig deeply into why such an error occurred and what systemic factors contributed. For example, identify fundamental factors such as “work procedures were ambiguous,” “employee training was insufficient,” or “equipment periodic inspections were not properly conducted.”

Stage 5: Implementation of Corrective Action

Based on the results of root cause analysis, this is the stage where specific measures to resolve the problem are planned and implemented. Corrective action is a response to problems that have already occurred and is intended to eliminate or control the identified root causes.

For example, this includes revision of work procedure documents, re-education of employees, equipment repair or renewal, and review of inspection methods. During implementation, it is important to clearly define “who,” “by when,” “what,” and “how” actions will be taken, and to manage progress.

Stage 6: Implementation of Preventive Action

Preventive action consists of measures to prevent similar problems from occurring in the future. While corrective action addresses “problems that have already occurred,” preventive action addresses “potential problems that have not yet occurred.”

At this stage, it is important to share the lessons learned from the current problem throughout the organization and to horizontally deploy them to similar processes and products. For example, this includes investigating whether similar defects could occur in other product lines and taking preventive measures.

Note on Preventive Action: It is important to understand that preventive action goes beyond simply applying corrective actions to other areas. It involves proactive identification of potential risks through data analysis, trend monitoring, and risk assessment activities. Under ISO 13485:2016, preventive action (Clause 8.5.3) requires organizations to determine actions to eliminate causes of potential nonconformities and to implement those actions in a manner appropriate to the magnitude of potential problems and commensurate with the risks encountered.

Stage 7: Effectiveness Verification and Closure

The final stage is to verify the effectiveness of the implemented corrective and preventive actions and to close the CAPA activity. Specifically, this involves collecting and analyzing data after implementation of measures and confirming that the problem has actually been resolved.

For effectiveness verification, it is important to establish appropriate evaluation indicators (KPIs) and conduct monitoring for a sufficient period. For example, confirm “whether the defect rate has been reduced below the target value and maintained for three months.” If verification results show that measures have not produced sufficient effects, it is necessary to return to Stage 4, root cause analysis, and reconsider.

FDA QSR 820.100 Seven Steps and the Transition to QMSR

Critical Regulatory Update: The Transition to QMSR

Important Notice for Medical Device Manufacturers: As of February 2, 2026, the FDA Quality System Regulation (QSR) at 21 CFR Part 820 will be replaced by the Quality Management System Regulation (QMSR). This represents a fundamental shift in FDA’s regulatory approach to medical device quality systems.

The QMSR incorporates by reference ISO 13485:2016 “Medical devices – Quality management systems – Requirements for regulatory purposes” and Clause 3 of ISO 9000:2015 “Quality management systems – Fundamentals and vocabulary.” This change harmonizes FDA requirements with international standards used by other regulatory authorities worldwide.

Key implications of this transition:

• All medical device manufacturers marketing devices in the United States must comply with QMSR by February 2, 2026
• The traditional terms Device Master Record (DMR), Device History Record (DHR), and Design History File (DHF) will be replaced with the unified “Medical Device File” (MDF) terminology from ISO 13485
• FDA will implement a new inspection process aligned with QMSR, replacing the Quality System Inspection Technique (QSIT)
• ISO 13485 certification alone will not exempt manufacturers from FDA inspections
• Manufacturers should conduct gap analyses comparing their current QSR-compliant systems to QMSR requirements

Until February 2, 2026, manufacturers must continue to comply with the current QSR. However, early preparation for the QMSR transition is strongly recommended.

FDA QSR 820.100 CAPA Requirements (Valid Through February 1, 2026)

In the medical device industry, CAPA is not merely a quality improvement tool but also a legal requirement. The FDA (U.S. Food and Drug Administration) specifies detailed requirements for the CAPA process in the medical device Quality System Regulation (QSR) at 21 CFR Part 820.100. Below is an overview of the CAPA requirements under FDA QSR 820.100.

Important Clarification: The original column described “seven steps” in FDA QSR 820.100. However, FDA QSR 820.100 does not explicitly outline seven distinct numbered steps. Rather, 21 CFR Part 820.100 contains subsections (a)(1) through (a)(7) and (b) that establish comprehensive CAPA requirements. The following interpretation organizes these regulatory requirements into logical process steps:

Step 1: Data Analysis and Problem Identification (820.100(a)(1))

FDA QSR requires identification of problems through analysis of quality data and identification of causes of potential product and quality problems that necessitate corrective and preventive action. This step requires collecting and analyzing data from various information sources (complaints, returns, audit reports, nonconformance reports, process data, service records, etc.) to detect trends and anomalies.

The regulation specifically states that procedures must include requirements for “analyzing processes, work operations, concessions, quality audit reports, quality records, service records, complaints, returned product, and other sources of quality data to identify existing and potential causes of nonconforming product, or other quality problems.”

Step 2: Problem Investigation (820.100(a)(2))

Investigation must be conducted to evaluate the scope and impact of identified problems. This investigation must clarify the detailed circumstances of the problem, affected products or processes, potential risks, and frequency of problem occurrence.

The regulation requires “investigating the cause of nonconformities relating to product, processes, and quality system.”

Step 3: Impact Determination (820.100(a)(3))

Based on investigation results, it is required to identify the impacts that problems have on the quality system, products, processes, and users. At this step, appropriate response levels are determined based on the severity of the problem, and systems are established to respond quickly to high-urgency problems.

The regulation states: “identifying the action(s) needed to correct and prevent recurrence of nonconforming product and other quality problems.”

Step 4: Root Cause Identification and Corrective Action Implementation (820.100(a)(4))

It is required to identify the root cause of the problem and implement corrective actions to prevent recurrence. For root cause analysis, appropriate scientific methods must be used, and it is important to address the true cause rather than merely treating symptoms. When implementing corrective actions, it is also necessary to follow change management processes and assess new risks introduced by the changes.

The regulation requires “verifying or validating the corrective and preventive action to ensure that such action is effective and does not adversely affect the finished device.”

Step 5: Preventive Action Implementation (820.100(a)(5))

It is required to identify potential problems and implement preventive actions to prevent their occurrence. At this step, it is important to assess the possibility of similar problems occurring in similar products or processes and to take preventive measures. Additionally, it is desirable to coordinate with risk management processes and implement risk reduction measures throughout the product lifecycle.

The regulation addresses this through the requirement to analyze data to identify “potential causes” and to take action to prevent occurrence.

Step 6: Verification and Validation of Changes (820.100(a)(6))

It is required to verify the effectiveness of implemented corrective and preventive actions. At this step, data is collected and analyzed after implementation of measures to confirm whether the problem has actually been resolved and whether new problems have not occurred. If effectiveness is not confirmed, measures are reviewed and new measures are implemented as necessary.

This corresponds to the verification/validation requirement in 820.100(a)(4).

Step 7: Documentation and Information Sharing (820.100(a)(7) and (b))

All activities of the CAPA process must be documented and shared with relevant departments. Items to be recorded include problem identification and reporting, root cause analysis results, implemented corrective and preventive actions, and effectiveness verification results. Additionally, it is required to evaluate the effectiveness of the CAPA system through regular reviews by management.

The regulation specifically requires that information be “disseminated to those directly responsible for assuring the quality of such product or the prevention of such problems” and that “management with executive responsibility shall review such information.”

QMSR and ISO 13485:2016 CAPA Requirements (Effective February 2, 2026)

Under the QMSR, medical device manufacturers must comply with the CAPA requirements in ISO 13485:2016, which addresses corrective action and preventive action in separate clauses:

Corrective Action (ISO 13485:2016 Clause 8.5.2): Organizations must take action without undue delay to eliminate the causes of detected nonconformities to prevent recurrence. Requirements include:

• Reviewing nonconformities, including complaints
• Determining the causes of nonconformities
• Evaluating the need for action to ensure nonconformities do not recur
• Planning, documenting, and implementing needed actions
• Reviewing the effectiveness of corrective action taken
• Updating risk management documentation where appropriate
• Making changes to the quality management system where necessary

Preventive Action (ISO 13485:2016 Clause 8.5.3): Organizations must determine action to eliminate causes of potential nonconformities to prevent their occurrence. Actions must be appropriate to the effects of potential problems. Requirements include:

• Reviewing data to identify potential nonconformities and their causes
• Evaluating the need for action to prevent occurrence of nonconformities
• Planning, documenting, and implementing needed actions
• Reviewing the effectiveness of preventive action taken
• Making changes to the quality management system where necessary

Key Points for Successful CAPA Implementation

To effectively implement the CAPA process, it is important to pay attention to the following points:

Management Commitment: CAPA is an organization-wide initiative, and strong support from executive leadership is essential.

Appropriate Documentation: At every stage, it is important to clearly document the basis for decisions and actions.

Team Approach: To capture problems from diverse perspectives, it is effective to work as a team that includes personnel from relevant departments.

Time Management: It is necessary to allocate appropriate time to each stage and manage the overall process so it does not become protracted.

Training and Education: It is important to continuously provide training and education to deepen understanding of CAPA methods and concepts throughout the organization.

Integration with Risk Management: CAPA should be closely integrated with risk management processes, particularly in medical device manufacturing. When addressing issues through CAPA, documented product risk management should be reviewed to ensure risks are accurately defined and updated as necessary. This integration reflects the risk-based approach mandated by ISO 13485:2016 and QMSR.

Systemic Thinking: CAPA should focus on systemic issues rather than individual instances. Not every nonconformity requires a CAPA; reserve the CAPA process for problems that indicate underlying systemic issues requiring comprehensive investigation and action.

Appropriate Use of CAPA: Avoid both overuse (which exhausts resources on trivial matters) and underuse (which allows systemic problems to persist). Establish clear criteria for when to initiate CAPA versus when to handle issues through other quality processes.

Comparison of CAPA Requirements Across Regulatory Frameworks

Aspect	FDA QSR 820.100 (Until Feb 2026)	FDA QMSR / ISO 13485:2016 (From Feb 2026)
Structure	Single section with subsections	Separate clauses for CA (8.5.2) and PA (8.5.3)
Terminology	Corrective and Preventive Action	Corrective Action / Preventive Action (distinct)
Data Sources	Explicitly lists multiple sources	Requires data review but less prescriptive
Root Cause	Required for both CA and PA	Required for both CA and PA
Verification	Must verify/validate effectiveness	Must review effectiveness of actions
Risk Management	Implicit requirement	Explicit link to risk management processes
Documentation	Comprehensive documentation required	Comprehensive documentation required
Management Review	Management must review CAPA information	Changes to QMS must be considered where necessary

Conclusion

The seven stages of CAPA and the regulatory requirements under FDA QSR 820.100 (transitioning to QMSR/ISO 13485:2016 in 2026) represent systematic approaches to problem-solving and quality improvement. These frameworks are not merely tools for regulatory compliance but important frameworks for shaping an organization’s quality culture and promoting continuous improvement.

For beginners, some aspects may seem complex, but by understanding the purpose and significance of each stage and step and repeating practice, more effective problem-solving capabilities will be cultivated. What is important is not formalistic implementation but a sincere commitment to true problem resolution and recurrence prevention.

Preparing for the QMSR Transition: Medical device manufacturers should begin preparing now for the February 2, 2026 QMSR transition by:

1. Conducting gap analyses between current QSR-compliant procedures and ISO 13485:2016 requirements
2. Updating terminology in procedures and documentation (e.g., transitioning from DMR/DHR/DHF to MDF concepts)
3. Training personnel on the differences between QSR and QMSR
4. Ensuring clear separation and understanding of corrective action versus preventive action processes
5. Strengthening the integration of risk management with CAPA processes
6. Reviewing and updating supplier audit and management review processes

By sharing the concept of CAPA throughout the organization and applying it in daily operations, product and service quality improvements will be achieved, ultimately contributing to enhanced customer satisfaction and the organization’s sustainable success. In the evolving regulatory landscape, particularly with the harmonization of FDA requirements with international standards, organizations that embrace systematic CAPA processes and adapt proactively to regulatory changes will be best positioned for long-term success in the global medical device marketplace.