CAPA

Corrective and Preventive Action

Three things get conflated, and separating them is most of the discipline. A correction is the immediate fix — reject the batch, replace the seal, retrain the operator. A corrective action addresses the cause so that this problem does not recur. A preventive action addresses a cause that has not yet produced a failure, or extends a fix to other places the same weakness exists. Systems that record corrections and file them as CAPA close records without changing anything.

The quality of a CAPA is bounded by the quality of the root-cause analysis behind it. "Operator error" is almost never a root cause — it is where the investigation stopped. The useful question is why the system allowed the error: was the instruction ambiguous, the training ineffective, the interface easy to mis-read, the workload unrealistic? Structured techniques (5 Whys, fishbone, fault tree) exist to push past the first plausible answer.

Effectiveness checks are the step most often skipped or faked. A real check defines in advance what evidence would show the action worked, over what period, and what happens if it did not — then goes back and looks. Recurrence of the same deviation after a "closed and effective" CAPA is one of the most damaging findings in an inspection, because it calls the whole quality system into question rather than one record.

• —Correction ≠ corrective action ≠ preventive action — fixing the instance is not fixing the cause.
• —"Operator error" is where an investigation stopped, not a root cause.
• —Preventive action includes extending a fix to other products, lines, or sites with the same weakness.
• —Effectiveness checks need pre-defined evidence, a defined period, and a defined response to failure.
• —Recurrence after a closed CAPA is a systemic finding, not an isolated one.
• —CAPA volume and ageing are quality-system health indicators — a growing backlog is itself a signal.

US devices: 21 CFR 820.100 (transitioning under the FDA QMSR, effective February 2026, which incorporates ISO 13485 by reference); pharmaceuticals: ICH Q10 §3.2.2 and EU GMP Part I Chapter 1; ICH Q9(R1) for the risk basis of prioritisation.