_1762866128417-DS2_OO1j.png)
What CAPA means
CAPA stands for corrective and preventive action. The term comes from regulated industries – especially medical devices and pharma – but is now used in almost every sector. It means a structured process that permanently eliminates problems that have occurred and prevents potential problems before they happen.
| Term | Meaning | Example |
|---|---|---|
| Correction | Immediately eliminating the defect | Sort out and rework defective parts |
| Corrective action | Eliminating the cause so the defect does not recur | Adjust an inspection fixture, change a work instruction |
| Preventive action | Eliminating the cause of a potential defect | Transfer lessons learned to similar products |
The difference between correction and corrective action is crucial: if you only correct, you fight symptoms. Only corrective action tackles the problem at its root.
What the standards require
| Standard | Clause | Core requirement |
|---|---|---|
| ISO 9001 | 10.2 | React to nonconformities, evaluate causes, implement actions, review effectiveness, update risks and opportunities |
| ISO 13485 | 8.5.2, 8.5.3 | Documented procedures for corrective and preventive action without undue delay |
| IATF 16949 | 10.2.3–10.2.6 | Structured problem solving, error-proofing, warranty analysis |
| ISO 27001, ISO 14001, ISO 45001 | 10.2 | Nonconformity and corrective action under the Harmonized Structure |
Since ISO 9001:2015 there is no separate requirement for preventive action – risk-based thinking in clause 6.1 takes on that role. In medical devices, preventive action remains explicitly required under ISO 13485.
When to open a CAPA
Not every deviation needs a full CAPA. Define criteria for opening one – for example by severity, frequency or risk. Typical triggers are:
- Customer complaints and returns
- Internal deviations and production defects
- Findings from internal and external audits
- Supplier problems
- Trends in KPIs, such as rising scrap rates
- Incidents, accidents or security events
- Findings from the management review
Isolated minor deviations are often just corrected and documented. If they accumulate, they become a CAPA. In docxpert, deviations can be escalated directly into a CAPA.
The CAPA process in eight steps
- 1
Capture
Describe the problem: what happened, where, when, how often, with what impact? Attach evidence such as photos, measurements or customer letters.
- 2
Assess and contain
Assess severity and risk, protect affected products and customers – for example by blocking, sorting or informing. Critical cases need containment within 24 hours.
- 3
Root cause analysis
Use methods such as 5 whys or Ishikawa to find the actual cause – not just the obvious one. More in the guide root cause analysis.
- 4
Plan actions
Define a corrective action with owner and due date for each cause. Check whether the same cause could act elsewhere.
- 5
Implement
Implement actions and collect evidence – changed documents, trainings, technical changes.
- 6
Verify
Check that the actions were implemented as planned.
- 7
Check effectiveness
After an appropriate period, evaluate whether the problem has actually stopped occurring – based on data, not gut feeling.
- 8
Close and learn
Close the CAPA, transfer lessons learned, update risks and documents.
Containment by severity
How fast you must react depends on the risk. A clear scale helps everyone involved:
| Severity | Example | Containment deadline |
|---|---|---|
| Critical | Safety-related defect at the customer | 24 hours |
| High | Functional defect, delivery stop looming | 3 days |
| Medium | Dimensional deviation without functional impact | 5 days |
| Low | Cosmetic defect, documentation error | 10 days |
These deadlines are guidelines; customers and industries may set stricter ones.
Checking effectiveness properly
The effectiveness check is the step most often missing or done too early. A CAPA closed on the day of implementation has not proven its effectiveness. Define during planning:
- Criterion: how will you know the problem is solved? For example: no repeat complaint for this failure mode in 90 days.
- Period: long enough that the problem would have recurred if it persisted.
- Data source: complaint statistics, inspection results, audit findings.
- Owner: who evaluates and decides on closure?
If the action is not effective, the CAPA is not closed; instead the root cause analysis is reviewed.
Example: a CAPA from start to finish
| Step | Content in the example |
|---|---|
| Capture | Customer reports three housings with cracks at the screw boss from delivery 4711. |
| Containment | Stock and ongoing production blocked, 100% inspection introduced, customer informed within 24 hours. |
| Root cause analysis | 5 whys shows: tightening torque too high because the cordless screwdriver was not recalibrated after a repair; there was no requirement to check after repairs. |
| Actions | Screwdriver recalibrated; tool maintenance work instruction extended with a torque check after repair; maintenance team trained; all other screwdrivers in the plant checked. |
| Verification | New work instruction approved, training completed, all screwdrivers checked. |
| Effectiveness | No cracks in the following 90 days across around 12,000 housings produced; torque records complete. |
| Closure | CAPA closed, FMEA updated, lesson transferred to two more assembly lines. |
The example shows why "why" must be asked several times: the first answer, "screwdriver set incorrectly", would only have led to a correction. The missing requirement after repairs is the cause that can be eliminated for good.
Roles in the CAPA team
- CAPA owner: drives the process, tracks deadlines and documents.
- Experts from the affected process: know the workflows and find causes fastest.
- Quality management: facilitates the root cause analysis and evaluates effectiveness.
- Manager: provides resources and decides on conflicting priorities.
KPIs for the CAPA process
| KPI | What it tells you |
|---|---|
| Number of open CAPAs | Workload and backlog |
| Average cycle time | Responsiveness of the organisation |
| Overdue CAPAs | Discipline in implementation |
| Effectiveness rate | Quality of root cause analysis |
| Repeat defects | Are causes really eliminated? |
These KPIs belong in the management review.
Common mistakes in the CAPA process
- "Retrain the employee" as the default action: if the cause is "human error", the analysis usually didn't go deep enough.
- Too many CAPAs: opening a CAPA for every minor issue loses the overview, and important cases get buried.
- No effectiveness check: CAPAs are closed after implementation without checking whether they worked.
- No transfer: the same cause keeps acting on other products or sites.
- Unclear ownership: actions without owners and due dates don't get done.
The CAPA checklist helps you check your process for these weaknesses.
CAPA management with docxpert
CAPA management in docxpert guides you through every phase – from intake, triage and containment through root cause analysis with 5 whys or Ishikawa, action plan, implementation, verification and effectiveness check to change control and closure. Gates between phases show which evidence is still missing before you move on. Severity determines the containment deadline.
Frequently asked questions
Does every deviation have to trigger a CAPA?
No. Define criteria such as severity, recurrence or customer impact. Isolated minor deviations are corrected and documented; a CAPA is opened only when they accumulate or the risk is higher. Put this rule in writing so the decision is traceable.
How do I document a CAPA properly?
At a minimum with the problem description, containment, root cause analysis, actions with owners and due dates, evidence of implementation, the result of the effectiveness check and the closure decision. Software with fixed phases ensures no step is missed.
What is the difference between correction and corrective action?
A correction eliminates the current defect, for example through rework. A corrective action eliminates the cause so the defect does not recur.
Does ISO 9001 still have preventive action?
Not as a separate clause. Since 2015, prevention happens through risk-based thinking in clause 6.1. ISO 13485 still explicitly requires preventive action.
How long may a CAPA take?
The standards set no fixed deadline but require an appropriate response. Containment should happen within hours to days depending on severity; the effectiveness check often takes several weeks or months.
Who is responsible for a CAPA?
Each CAPA needs an owner who drives the process. Root cause analysis and actions are best worked out by a small cross-functional team.
What is the difference between CAPA and 8D?
8D is a structured problem-solving method used mainly in the automotive industry for customer complaints. It fits well within a CAPA process. More in the 8D report guide.
When may a CAPA be closed?
Only when the actions are implemented and the effectiveness check shows that the problem no longer occurs.
How do I distinguish containment, correction and corrective action in a CAPA?
Containment first protects against further impact, for example by quarantining affected stock or informing customers. Correction removes the specific detected error, perhaps through rework or replacement. Corrective action addresses the confirmed cause and is intended to prevent recurrence. Record these steps separately with timing, scope, owners and evidence so a fast response is not mistaken for a lasting solution. Root cause analysis should consider both why the failure happened and why existing controls did not prevent or detect it. Only then can suitable actions be defined. Also decide how effectiveness will be checked and what evidence will be sufficient. Keeping these concepts distinct prevents premature closure after a symptom is fixed while the underlying cause remains.