CAPA for Medical Devices: How Correction, Corrective Action and Preventive Action Really Work

Ask a quality manager where most of their QMS effort goes and the answer is usually CAPA — Corrective and Preventive Action. Yet many CAPAs close without changing anything: the root cause reads 'operator error', the action is 'retrained the operator', and six months later the same non-conformity reappears with a new CAPA number attached.

This guide explains how correction, corrective action and preventive action actually differ, what ISO 13485:2016 and the FDA's QMSR expect from your CAPA system, and how to run a seven-step process that produces CAPAs you can defend in an audit — with a worked example you can adapt to your own records.

1. Correction, corrective action, preventive action

The three terms are not interchangeable, and auditors notice when they are mixed up. Getting the language right is the first step, because each term implies a different response and a different record.

Under the FDA's Quality Management System Regulation (QMSR), which incorporates ISO 13485:2016 by reference, the terminology converges: correction, corrective action and preventive action must be distinct, documented and trended. One well-designed CAPA process can serve both frameworks, provided the data sources, records and trending that FDA expects are built in from the start.

2. The seven-step CAPA process

A defensible CAPA follows the same sequence every time. Skipping a step is what turns a CAPA into paperwork. For each step, keep the evidence — the record is what the auditor samples.

1. 1Identify and document the problem. Sources include complaints, internal audits, production data, supplier performance and trends. State what happened, where, when, how many, and which product or batch.
2. 2Triage by risk. Not every deviation deserves a CAPA — but every decision either way needs a documented justification. Risk decides the depth of the investigation, not convenience.
3. 3Contain. Quarantine, sort, hold shipments, notify affected customers if needed. A correction protects the customer; it is not the corrective action and should be recorded separately.
4. 4Investigate. Gather the evidence: batch records, logs, calibration data, interviews. Define the problem precisely before explaining it — most weak investigations start with an assumed cause.
5. 5Determine root cause. Use a structured method (5 Whys, fishbone, fault tree), verify the cause against objective evidence, and document why alternative causes were rejected.
6. 6Act. Implement corrective actions for the actual cause and preventive actions where a potential problem was identified. Assign owners and due dates, and update risk management files, procedures and training where the actions require it.
7. 7Verify effectiveness, then close. Define success criteria and a timeframe before closure, verify against data, and feed the result to management review.

3. A worked example: one complaint, end to end

Scenario: three complaints arrive over eight weeks reporting that an infusion set's tubing cracks at the luer connector within two hours of infusion start. Here is the same CAPA done weakly and done well.

4. Root cause quality: the make-or-break step

'Operator error' fails not because operators never err, but because it names a person instead of a system. If a person made a mistake, the auditor's question is: what in the system allowed that mistake to reach product — or to go undetected until it did?

• A real root cause explains why, not just what — trace from the symptom down to a controllable process cause.
• It is verified against evidence: logs, records, measurements — not agreed in a meeting.
• It passes the recurrence test: remove this cause and the event cannot repeat the same way.
• 5 Whys must stop at a process cause. If the fifth 'why' is a person, keep asking.
• A fishbone helps rule out categories — method, machine, material, measurement, environment, people — and the record should say why rejected causes were rejected.

5. Effectiveness verification: prove it worked

ISO 13485 requires review of the effectiveness of corrective action (8.5.2) and preventive action (8.5.3) — but a closure box that says 'verified' is not a review. Verification is a planned activity with its own evidence.

• Define the success criteria before the action is implemented — not on the day of closure.
• Set the timeframe from the process cycle time and production volume, not from convenience.
• Sample enough data: repeat events, complaint rates, SPC trends, internal audit results.
• Include the negative test: what evidence would have shown the action failed? If nobody can answer, the verification was a formality.
• Record the verification itself — data, dates, sampler — as a record attached to the CAPA.
• If effectiveness is not demonstrated, the CAPA reopens. That is the system working, not failing.

6. Where weak CAPAs get found

Auditors and FDA investigators look for the same weak-evidence signals. Use this table as a self-check before they do.

7. Quick CAPA checklist

8. Where to go next

If you want to build CAPA handling into a repeatable skill — precise terminology, investigation technique, root cause quality and audit-ready records — the free CAPA Fundamentals course covers all of it with realistic examples, decision tables and a certification exam at the end.