Corrective and Preventive Action (CAPA)

What it is

Corrective and Preventive Action (CAPA) is a structured, documented process to investigate nonconformities, remove their causes, and prevent recurrence or occurrence. In devices and IVDs, CAPA is a core QMS requirement that links complaints, risk management, change control, and post-market surveillance (ISO 13485:2016 §8.5.2–§8.5.3; MDR/IVDR Art. 10; FDA 21 CFR 820/QMSR).

Regulatory framework

• US (FDA): Corrective and preventive action under 21 CFR Part 820 (QMSR, aligning with ISO 13485); legacy CAPA §820.100; complaint handling §820.198; corrections/removals 21 CFR 806; MDR event reporting 21 CFR 803.
• EU (MDR/IVDR): Manufacturer QMS must include CAPA integrated with PMS and risk management (MDR Art. 10(9); IVDR Art. 10(8)); PMS/Vigilance (MDR Arts. 83–92; IVDR Arts. 78–87); technical documentation updates Annex II–III.
• Standards: ISO 13485:2016 §8.5.2 (Corrective action) and §8.5.3 (Preventive action); ISO 14971:2019 risk controls and feedback; ISO 19011 auditing inputs to CAPA.

Key elements

• Defined triggers: complaints, audits, nonconformities, deviations, field actions, trends.
• Documented problem statement with scope, impact, and containment.
• Root cause analysis using suitable methods (e.g., 5-Why, Ishikawa, fault tree).
• Corrective/preventive actions with owners, due dates, risk assessment, and change control.
• Verification of implementation and effectiveness check with objective criteria.
• Records: traceable links to risk files, DHF/DMR/DHR, labeling, and training.

Process — how it works

• Capture & contain: Log the issue; assess risk; apply immediate containment where needed.
• Investigate: Define problem, gather data, determine root cause(s), and evaluate systemic impact.
• Plan actions: Select corrective and preventive actions; update risk files (ISO 14971) and plan changes.
• Implement: Execute actions, update procedures/records/labeling, and retrain as required.
• Verify & validate: Confirm actions were implemented and are effective over time; monitor key metrics.
• Close & trend: Approve closure with evidence; trend outcomes and feed management review/PMS.

Common pitfalls

• Jumping to fixes without a clear problem statement or data-driven root cause.
• Actions that address symptoms only; no systemic prevention or change control.
• Missing effectiveness checks or weak acceptance criteria.
• Poor linkage to risk management, complaints, and PMS/PSUR.
• Overuse of “training” as the sole action without process change.

Quick checks

• Is the root cause proven and documented? If not, pause implementation.
• Do actions reduce risk to acceptable levels per ISO 14971, and is change control applied?
• Are effectiveness criteria measurable and time-bound?
• Are updates reflected in procedures, records, labeling, and training logs?