Many CAPA programs start with the wrong question. Teams ask “how do we close this faster?” when the real question is “did this fix actually work?” For medical device makers, the stakes are visible in FDA data. In FDA’s fiscal year 2025 (October 2024 to September 2025), inadequate CAPA procedures under 21 CFR 820.100(a) were the most-cited device observation in FDA’s published Form 483 data — 279 of 2,660 device citations, according to GMP Insiders’ analysis.
FDA notes that this data comes from its electronic inspection tools and is not a comprehensive listing of all inspectional observations, since some Form 483s are prepared manually. CAPA deficiencies also topped the issues in FDA’s medical-device Warning Letters of that fiscal year: 26 of the 44 letters cited them, according to ECA Academy.
Since 2 February 2026, FDA has inspected device makers against the Quality Management System Regulation (QMSR), which incorporates ISO 13485:2016 by reference — and ISO 13485 requires organizations to review the effectiveness of corrective action taken. The question an inspector asks is not whether a CAPA was closed, but whether it worked, and that distinction changes what “best practice” actually means.
🔑 Key takeaways
- CAPA cannot be closed on task completion alone — it requires objective evidence that the action worked, judged against a criterion set in advance and over a period suited to the risk.
- Regulators look past CAPA closure to CAPA effectiveness — ISO 13485:2016, part of FDA’s QMSR since February 2026, requires a review of the effectiveness of corrective action taken.
- “Human error” is rarely the whole root cause. It can contribute, but investigations should establish the individual and system factors the evidence supports — the system ones are what auditors look for.
- ISO 9001, ISO 14001, and ISO 45001 set nonconformity and corrective-action requirements in the same Clause 10.2, so one corrective-action system can serve all three. ISO 13485 and FDA’s QMSR are structured differently.
- The FDA’s QMSR, effective February 2, 2026, folds device CAPA requirements into ISO 13485:2016 by reference, and FDA replaced its QSIT inspection technique the same day.
On this page
- What CAPA actually is (and the distinction regulators care about)
- The CAPA lifecycle, stage by stage
- Choosing the right root cause analysis method
- Why effectiveness verification is the whole point
- The metrics that actually predict a healthy CAPA program
- Regulatory alignment: ISO 9001, 14001, 45001, and FDA QMSR
- Common CAPA mistakes to avoid
- The role of digital CAPA tooling
- Frequently asked questions
What CAPA Actually Is (and the Distinction Regulators Care About)
Corrective and Preventive Action (CAPA) is a structured process for investigating a problem, fixing what already happened, and preventing it from happening again. The two halves are distinct: corrective action addresses the nonconformance that has already occurred; preventive action addresses the underlying condition that could cause it — or a similar problem — elsewhere in the system.
A nuance worth knowing: ISO 9001:2015 formally replaced its standalone “preventive action” clause with a broader requirement for risk-based thinking throughout the standard. In practice, many quality teams still use “CAPA” as the working term, but under ISO 9001 specifically, prevention is now framed as continuous risk management rather than a discrete corrective-action twin. ISO 9001:2026, published on 16 September 2026, keeps risk-based thinking at the centre.
Corrective action is required in every major quality and EHS framework, but the frameworks do not all use the same structure — or even the term CAPA. ISO 9001, ISO 14001 and ISO 45001 set requirements for nonconformity and corrective action in Clause 10.2 and handle prevention through risk-based planning rather than a separate clause; AS9100 builds on the same structure for aerospace.
ISO 13485:2016 — and through it FDA’s QMSR for medical devices — keeps separate clauses for corrective action (8.5.2) and preventive action (8.5.3). For pharmaceuticals, ICH Q10 names a corrective and preventive action (CAPA) system as one of four elements of the pharmaceutical quality system. What they share is the expectation that a nonconformity is investigated, acted on and checked for effectiveness; an undocumented or unverified fix is an open gap in any of them.
The CAPA Lifecycle, Stage by Stage
Trigger
A CAPA can originate from an audit finding, a customer complaint, an incident investigation, an out-of-specification result, or a regulatory inspection observation. Not every nonconformance needs a full CAPA — a one-time, low-severity issue may warrant routine correction instead — but a systemic or recurring issue almost always does.
Containment
Immediate action to limit the impact of the problem while investigation proceeds. Some organizations set internal targets by severity — for example, containment within 24 hours for critical issues and 72 hours for major ones. Treat these as possible targets to adapt to your sector and risks, unless a regulation or customer contract sets a deadline.
Investigation and problem description
A detailed, accurately documented description of the problem — what happened, where, when, and how it was detected — forms the foundation everything else builds on. A vague problem statement produces a vague root cause.
Root cause analysis
A step auditors often probe. See the RCA method comparison below for choosing the right tool for the situation.
Action plan
Document both the corrective action (fixing what happened) and the preventive action (removing the underlying condition), assign a named CAPA owner with the authority to drive it, and set a target closure date appropriate to severity.
Implementation
Execute the plan — process changes, training, supplier remediation, design changes — and document each step with traceable evidence of who did what and when.
Effectiveness verification
A step that is easy to skip or rush. See the dedicated section below — this is where a CAPA earns the right to be closed.
Closure and management review
Close only with objective evidence of effectiveness, then feed the outcome into periodic management review so trends across CAPAs — not just individual cases — inform where the quality system needs deeper investment.
Choosing the Right Root Cause Analysis Method
Root cause analysis is a frequent weak point in CAPA programs. Three methods cover most situations, plus a fourth for proactive prevention before a failure ever occurs.
RCA method comparison
| Method | Best for | Limitation |
|---|---|---|
| 5 Whys | Straightforward, single-cause problems | Can stop too early at an incomplete answer |
| Fishbone (Ishikawa) | Problems with multiple contributing factors | Does not rank candidate causes on its own |
| Fault Tree Analysis | Complex, safety-critical failures | Requires more time and facilitation skill |
| FMEA | Proactive identification of failure modes | Not a root-cause tool for an event that already happened |
A frequent RCA weakness: stopping at “human error” or “operator error.” Human error can be a genuine contributing factor, but on its own it rarely explains why the error was possible or likely. A sound investigation establishes the individual and system factors the evidence actually supports — inadequate training design, an ambiguous procedure, a missing interlock — and acts on the system factors rather than closing at the individual.
Why Effectiveness Verification Is the Whole Point
Closing a CAPA report does not, by itself, mean anything worked. The rules have long said so: the legacy 21 CFR 820.100 required corrective and preventive action to be verified or validated as effective, and ISO 13485:2016 clause 8.5.2, now part of the QMSR, requires a review of the effectiveness of corrective action taken. What an inspector looks for is evidence that the action worked, not the date it was closed.
A defensible effectiveness check needs three things: a pre-defined success criterion set before implementation (not chosen retroactively to match what happened), a defined observation period appropriate to how frequently the failure mode would recur, and objective evidence — trend data, audit results, or complaint volume — rather than a manager’s sign-off that the action “was completed.”
An example schedule, not a rule: some teams check effectiveness at 30, 60 and 90 days after implementation and watch for recurrence over 6–12 months. Size the window to the risk and to how often the problem would be expected to reappear: a failure that used to occur weekly can be judged sooner than one seen once a year. No recurrence over a period shorter than that does not prove the action worked.
The Metrics That Actually Predict a Healthy CAPA Program
Core CAPA program metrics
| Metric | What it signals | Example target |
|---|---|---|
| On-time closure rate | Whether the process itself is under control | > 90% |
| Effectiveness verification rate | Whether closed CAPAs actually worked, not just finished | > 95% |
| Repeat/recurrence rate | Whether root causes are genuinely being eliminated | < 5% |
| Average time to closure | Process efficiency, read alongside — not instead of — effectiveness | e.g. 30–90 days by severity |
| Overdue CAPA count | Early warning sign of resourcing or ownership gaps | Trending toward zero |
| Source distribution | Whether CAPAs are mostly reactive (complaints, audits) or increasingly proactive | Shifting toward proactive over time |
Example management targets, not regulatory requirements or sector averages. Set yours from your own baseline, risk and CAPA volume.
Track on-time closure and effectiveness verification together, not separately — for example, a program with a 95% on-time closure rate but a 60% effectiveness rate is closing CAPAs quickly without confirming they work, which is a worse position than a slower program that verifies rigorously.
Regulatory Alignment: ISO 9001, 14001, 45001, and FDA QMSR
CAPA across major frameworks
| Framework | Where corrective action is required |
|---|---|
| ISO 9001:2015 / ISO 9001:2026 | Clause 10.2 — Nonconformity and corrective action (preventive action reframed as risk-based thinking). The 2026 edition was published on 16 September 2026. Under the transition requirements of Global ACI (the body that took over the IAF’s role in 2026), new initial certifications are issued only to the 2026 edition from 31 March 2028; organizations already certified to the 2015 edition have until 30 September 2029 to transition |
| ISO 14001 (2026 edition) | Clause 10.2 — same nonconformity/corrective action structure, applied to environmental management. ISO 14001:2026 was published in April 2026; the transition ends on 30 April 2029, according to Global ACI |
| ISO 45001 | Clause 10.2 — incident, nonconformity, and corrective action for occupational health and safety. The 2018 edition is being revised; ISO expects a new edition in the first half of 2027, subject to the draft’s approval |
| FDA QMSR (medical devices) | Effective February 2, 2026 — the QMSR amends 21 CFR Part 820 to incorporate ISO 13485:2016 by reference, replacing the legacy 820.100 CAPA requirement with ISO 13485 clauses 8.5.2 (corrective action) and 8.5.3 (preventive action). FDA retired QSIT the same day and now inspects under Compliance Program 7382.850 |
| cGMP / ICH Q10 (pharma) | CAPA is a core element of the Pharmaceutical Quality System |
| AS9100 (aerospace) | Clause 10.2 — nonconformity and corrective action on the ISO 9001 structure, with additional aerospace requirements |
Practical implication: because ISO 9001, 14001, and 45001 all set nonconformity and corrective-action requirements under the same Clause 10.2, an organization holding more than one of these certifications can run a single, integrated CAPA system rather than three parallel ones — provided the underlying workflow captures which standard(s) each CAPA relates to.
Common CAPA Mistakes to Avoid
1. Closing on task completion, not verified effectiveness
An action can be fully implemented and still be ineffective. Closure requires evidence that it worked — against a criterion set in advance and over a period suited to the risk — not a checklist showing the task was done.
2. Stopping root cause analysis at “human error”
Human error can contribute, but it is rarely the whole explanation. Auditors look for the system-level gaps — training design, procedure clarity, missing safeguards — that RCA is supposed to surface alongside any individual factors.
3. Treating preventive action as optional
Preventive work feels less urgent than the corrective fix directly in front of you, which is exactly why it gets skipped — and why the same failure mode resurfaces elsewhere in the organization.
4. Running CAPA on spreadsheets and email at scale
Manual tracking feels flexible early on but becomes unmanageable as CAPA volume grows, breaking the traceability regulators expect during an inspection.
5. No named CAPA owner with real authority
Without a single accountable owner, CAPAs stall between departments, and no one is positioned to drive the investigation, the action plan, or the closure decision.
The Role of Digital CAPA Tooling
Digital CAPA and QMS platforms address the scale problem directly: automated workflow routing, enforced approval steps, and full audit trails linking each CAPA to the audit, complaint, or incident that triggered it. Several platforms are recognized specifically for CAPA and quality-management workflows: Intelex for organizations running CAPA alongside multi-standard ISO governance, Ideagen Q-Pulse for document control tightly bound to CAPA records, and dedicated quality platforms such as ETQ Reliance and MasterControl for regulated manufacturing environments that require electronic records and controls designed to support 21 CFR Part 11 compliance. We compare those two head to head in ETQ Reliance vs MasterControl, and Ideagen Q-Pulse against Optro (formerly AuditBoard) in Optro vs Ideagen Q-Pulse.
The common thread across credible platforms: CAPA records that link automatically to training updates, supplier records, and management review inputs, so effectiveness verification isn’t a separate manual exercise bolted onto the end of the process.
Frequently Asked Questions
What’s the difference between corrective and preventive action?
Corrective action fixes a problem that has already happened. Preventive action addresses the underlying condition to stop that problem — or a similar one — from occurring elsewhere in the system. Under ISO 9001:2015, formal “preventive action” was folded into a broader risk-based thinking requirement.
How long should a CAPA take to close?
There is no universal deadline in ISO 9001, ISO 13485 or the QMSR. Some organizations set internal targets by severity — for example, 30 to 90 days to closure, with containment within 24 hours for critical issues and 72 hours for major ones — but these are planning conventions to adapt to your sector and risks, unless a regulation or customer contract sets a deadline. Never close a CAPA early to meet a target: closure should wait for the effectiveness evidence.
Is “human error” an acceptable root cause?
On its own, rarely. Human error can be a genuine contributing factor, but it seldom explains why the error was possible in the first place. Investigations are expected to establish the individual and system factors the evidence supports — inadequate training, an ambiguous procedure, a missing safeguard — and to act on the system factors, not only on the individual who made the error.
Can one CAPA system cover ISO 9001, ISO 14001, and ISO 45001?
Yes. All three structure corrective action under the same Clause 10.2 framework, which allows an integrated CAPA system across quality, environmental, and safety management, provided each CAPA record captures which standard(s) it relates to.
What changed with the FDA’s QMSR in 2026?
Effective February 2, 2026, the QMSR amended 21 CFR Part 820, replacing most of the legacy Quality System Regulation for medical devices by incorporating ISO 13485:2016 by reference. CAPA remains a core requirement, now expressed through ISO 13485 clauses 8.5.2 and 8.5.3 rather than the original Part 820.100 language. The same day, FDA stopped using its QSIT inspection technique and moved to Compliance Program 7382.850.
What is a common reason a CAPA fails audit review?
Closing on completion of the corrective task rather than on verified evidence that it worked. Auditors look for the effectiveness criterion, the observation period and the evidence behind the closure decision; an absence of recurrence over a period too short for the problem to reappear proves little.
Should every nonconformance trigger a full CAPA?
No. A one-time, low-severity issue may only need a routine correction. A systemic or recurring issue — or anything tied to a regulatory or safety-critical requirement — almost always warrants a full CAPA with documented root cause analysis.
How do I know if my root cause analysis was thorough enough?
If the analysis stops at an individual’s action rather than the system condition that enabled it, it likely isn’t thorough enough. A useful test: would the same corrective action prevent a different person from making the same error under the same system conditions?
Does a CAPA need a dedicated software platform, or can spreadsheets work?
Spreadsheets can work for very low CAPA volumes, but they become unmanageable and break traceability as volume grows — which is precisely when regulators expect the clearest audit trail. Most organizations beyond a handful of CAPAs per quarter benefit from dedicated tooling.
Where to Go Next
For how CAPA fits into a broader occupational safety management system, see our ISO 45001 Implementation Guide. To compare two platforms that both support CAPA workflows, see SafetyCulture (now Mitti) vs Intelex Compared. To start tracking corrective actions through to verified effectiveness today, download the free CAPA Tracker, and use the Incident Investigation Report Template to document the root cause behind each one.
