CAPA: Corrective & Preventive Action
CAPA is the machinery a quality system uses to learn from what goes wrong and stop it recurring. It is also the most misunderstood process in GxP: the term collapses three different actions into one acronym, and the industry routinely does the easy one while calling it the hard one. Getting the distinction right — correction versus corrective action versus preventive action — is the difference between a CAPA system that actually reduces risk and a backlog of paperwork that closes findings without fixing anything. ICH Q10 names CAPA as a core element of the pharmaceutical quality system for exactly this reason.
What an explainer is not
A topic explainer is SPEQ’s synthesis of what a practice involves, cited to the standards that govern it. It does not reproduce their text, and it does not determine which of them apply to your product or process.
[ POSITION IN THE FRAMEWORK ]
7 DIMENSIONS · 23 LINKSCAPA is how a quality system learns from failure — a QMS and GMP element that only works when correction, corrective action, and preventive action are kept distinct and closure waits on an effectiveness check, tracked in the eQMS below.
06 · QUALITY MATURITY — CAPA: CORRECTIVE & PREVENTIVE ACTION, REACTIVE TO ADAPTIVE
Corrections are logged as corrective actions, root cause is "human error," and the same problem returns under a new number.
A CAPA procedure and forms exist, but every event gets a full CAPA, root-cause tools are applied superficially, and closure is on "action implemented."
Correction, corrective, and preventive action are distinguished, root cause names a system deficiency, and closure waits on an effectiveness check.
CAPA effectiveness, recurrence, and aging metrics feed management review, and risk-based triage keeps the backlog focused on what matters.
Preventive action acts on trends and near-misses before failure; CAPA knowledge compounds and the system demonstrably reduces recurrence.
SPEQ’s shared five-stage progression, labelled synthesis — not the FDA QMM rating scale. Where does your organization sit? Score your quality system →
07 · REGULATORY & EVIDENCE
GOVERNING STANDARDS · 4
Derived from the 4 standards SPEQ maps to this subject, across 3 regulatory bodies: FDA, ICH, ISO.
RECORDS & OBJECTIVE EVIDENCE
- CAPA records distinguishing correction, corrective, and preventive action
- Root-cause analyses naming a system deficiency, not a person
- Predefined, measurable effectiveness-check criteria and their results
- Risk-based triage rationale for whether an event warrants a CAPA
- CAPA metrics (open, aging, recurrence, effectiveness pass rate) into management review
COMMON INSPECTION FINDINGS
- Corrections recorded as corrective actions ("operator re-trained")
- Root cause stated as "human error" with no systemic analysis
- CAPAs closed on "action implemented" with no effectiveness check
- Recurring deviations with the same shallow correction each time
- An aging, growing CAPA backlog with overdue effectiveness checks
Correction ≠ corrective action ≠ preventive action
A **correction** fixes the immediate problem: reject the batch, re-clean the line, re-train the operator who made the error. It addresses the symptom in front of you and nothing else. A **corrective action** addresses the *cause* so the problem cannot recur: if the operator erred because the procedure was ambiguous, the corrective action fixes the procedure, not just the operator. A **preventive action** acts on a risk that has not yet produced a failure — a trend, a near-miss, a weakness seen on a similar line — to stop it becoming one.
The near-universal error is doing a correction and recording it as a corrective action. "Operator re-trained, CAPA closed" is the classic example: it corrects one instance and leaves the cause — the ambiguous procedure — untouched, so the same deviation returns under a different name. An inspector reading a stack of "re-training" CAPAs for the same recurring issue is looking at a system that is treating symptoms. The three words are not synonyms, and a CAPA system that blurs them is a CAPA system that does not work.
Root cause: the step everyone shortcuts
Corrective and preventive action are only as good as the root-cause analysis beneath them — and root cause is where the process is most often rushed. A true root cause is one that, if removed, stops the problem recurring; "human error" almost never qualifies, because behind the error is a system that made it possible or likely. Structured methods (five-whys, fishbone, fault tree) exist to push past the first plausible answer to the condition that actually allowed the failure.
The tell of a weak investigation is a root cause that names a person and a corrective action that re-trains them. The tell of a strong one is a root cause that names a system deficiency — a procedure, a design, a control, a workload — and an action that changes it. This is also where quality risk management enters: ICH Q9(R1) frames how much investigation and how strong an action a given problem warrants, so effort is proportionate to risk rather than uniform.
Effectiveness checks: "action complete" is not "CAPA closed"
The most consequential discipline in a mature CAPA system is the effectiveness check. Implementing the action — issuing the revised procedure, installing the new control — is not evidence that it worked. A CAPA is genuinely closed only when the organisation has gone back, after enough time and enough occurrences, and confirmed the problem actually stopped recurring. Closing on "action implemented" is how a system accumulates CAPAs that were never verified and problems that quietly return.
This is why CAPA closure is a two-stage event: the action is completed, then its effectiveness is checked against a predefined, measurable criterion (for example, zero recurrences of the specific deviation over a defined period or number of batches). If the check fails, the CAPA reopens or escalates — the investigation missed the real cause. Regulators treat a missing or perfunctory effectiveness check as a sign the CAPA system is closing records rather than solving problems.
The health of the CAPA system itself
A CAPA process can fail not because individual investigations are weak but because the system is overloaded. Opening a full CAPA for every minor, well-understood deviation floods the process, lengthens the backlog, and starves the genuinely serious problems of attention — so risk-based triage is itself a control: minor events are corrected and trended, and a CAPA is raised when risk, recurrence, or significance warrants it. An ever-growing CAPA backlog with aging open records is one of the clearest signals of a quality system under strain.
That is why CAPA is not a standalone log but a managed element of the quality system. ICH Q10 places CAPA alongside change management and management review, and both 21 CFR 211’s requirement to investigate discrepancies and unexplained failures and ISO 13485’s corrective- and preventive-action clauses expect the outputs to feed management review — where CAPA metrics (open count, aging, recurrence, effectiveness-check pass rate) tell leadership whether the system is learning or merely closing tickets. A CAPA system is only as good as the honesty of those numbers.
FREQUENTLY ASKED
What is the difference between a correction and a corrective action?
A correction fixes the immediate problem (reject the batch, re-clean the line, re-train the operator). A corrective action addresses the underlying cause so the problem cannot recur (fix the ambiguous procedure that led to the error). Recording a correction as a corrective action — "operator re-trained, CAPA closed" — is the most common CAPA failure, because the cause is left untouched and the problem returns.
What is a preventive action?
A preventive action addresses a risk that has not yet produced a failure — a trend, a near-miss, or a weakness observed on a similar process — to stop it becoming an actual problem. Corrective action responds to something that happened; preventive action acts on something that could.
When is a CAPA actually closed?
Only after an effectiveness check confirms the problem stopped recurring — not when the action is merely implemented. Closure is a two-stage event: the action is completed, then its effectiveness is verified against a predefined, measurable criterion. If the check fails, the CAPA reopens or escalates, because the investigation missed the real cause.
Should every deviation get a CAPA?
No. Opening a full CAPA for every minor, well-understood deviation overloads the system and starves serious problems of attention. Minor events are corrected and trended; a CAPA is raised when risk, recurrence, or significance warrants it. Risk-based triage — informed by ICH Q9(R1) — keeps the CAPA system focused and its backlog healthy.