Every medical device manufacturer has a CAPA procedure. Most have a CAPA register in Excel. And most have at least three CAPAs that have been "in progress" for longer than anyone wants to admit.
CAPA — Corrective and Preventive Action — is not paperwork for paperwork's sake. It is how your organization proves it learns from problems. ISO 13485 clause 8.5.2 and 8.5.3 require it. CDSCO inspectors ask about it. And customers auditing your facility will dig into your open CAPA list first.
When CAPA is required (and when it is not)
Not every deviation needs a CAPA. A minor documentation typo corrected on the spot may need only a correction, not a formal CAPA.
CAPA is typically triggered by:
- Internal and external audit findings
- Customer complaints and returns
- Non-conforming product or material
- Process deviations during manufacturing
- Equipment failures affecting product quality
- Supplier non-conformances
- Trend analysis showing recurring issues
- Post-market surveillance data
Your CAPA procedure should define trigger criteria clearly. Without criteria, everything becomes a CAPA and nothing gets closed. With criteria too loose, serious issues get handled informally and never investigated.
The CAPA workflow that auditors expect
1. Initiation and risk assessment
Document the problem. What happened? Which product, batch, or process? What is the immediate containment — quarantine affected material, stop the line, notify customers?
Assess impact. A labelling error on 500 units shipped nationally is different from a temperature excursion in a clean room.
2. Root cause analysis
This is where most CAPAs fail. "Operator error" or "lack of attention" is not a root cause — it is a description of the failure mode.
Use structured methods:
- 5 Whys — ask why repeatedly until you reach a systemic cause
- Fishbone (Ishikawa) — categorize causes: man, machine, material, method, measurement, environment
- Fault tree analysis — for complex or safety-critical failures
The root cause must explain why the system allowed the failure to occur, not just who pressed the wrong button.
3. Corrective action
Actions that address the identified root cause. Retraining alone is rarely sufficient unless the root cause analysis genuinely points to a training gap.
Examples of effective corrective actions:
- Revise the SOP to include a verification step that was missing
- Add a mandatory second-person check for critical parameters
- Modify equipment to prevent incorrect settings
- Change supplier qualification requirements
Each action needs an owner, target date, and evidence of completion.
4. Preventive action
Corrective action fixes this instance. Preventive action stops recurrence across similar processes or products.
Ask: could this happen in another production line, with another operator, on another product using the same process?
5. Effectiveness check
The most skipped step. After corrective actions are implemented, verify they worked.
- Run a period of monitoring — 30, 60, or 90 days depending on frequency of the process
- Review data: has the same deviation recurred?
- Document the effectiveness check with evidence
A CAPA closed without effectiveness verification is a finding waiting to happen.
6. Closure and approval
QA reviews the complete CAPA dossier: problem description, root cause, actions taken, effectiveness evidence. Authorized sign-off with date.
CAPA metrics that matter
Track these monthly in management review:
- Number of open CAPAs
- Average days to close
- Overdue CAPAs (past target completion date)
- CAPAs reopened due to recurrence
- CAPAs by source type (complaint, audit, deviation, supplier)
If average closure time exceeds 90 days, your system is backlogged. Auditors notice overdue CAPAs immediately — they are usually the first screen an inspector opens on your dashboard.
Linking CAPA to the rest of your QMS
CAPA does not exist in isolation. Auditors trace links:
- Deviation in batch record → CAPA → SOP revision → training update → effectiveness check
- Customer complaint → CAPA → design change → verification → post-market follow-up
- Audit finding → CAPA → procedure update → internal audit verification
Broken links — a CAPA referencing a batch but the batch record showing release before CAPA closure — are serious findings.
Digital CAPA vs spreadsheet tracking
Excel CAPA logs work until they do not. Common failure modes:
- No automatic escalation for overdue actions
- No link to source records (batch, complaint, audit)
- No approval workflow or audit trail on changes
- No visibility for management until someone updates the sheet
A QMS with integrated CAPA routes actions to responsible persons, tracks deadlines, links to source events, and maintains a complete audit trail from initiation to effectiveness check.
CAPAs piling up? RapidFacto tracks CAPA from initiation through effectiveness verification, linked to batches, complaints, and audits. Schedule a demo to see how it works.