Corrective and Preventive Action (CAPA) is one of the most scrutinised processes during FDA and EU GMP inspections. A weak CAPA system leads to repeat deviations, warning letters, and loss of regulatory confidence. This guide gives you the practical steps to build and maintain a CAPA system that satisfies regulators and actually prevents recurrence.
What CAPA Is - and What It Is Not
CAPA is not simply a form you fill in after a deviation. It is a structured quality process that encompasses:
- Detection - identifying the non-conformance or potential risk
- Containment - preventing further impact while the investigation runs
- Root cause analysis - finding the true cause, not just the symptom
- Action planning - designing corrective and preventive measures
- Implementation and verification - confirming the action was carried out correctly
- Effectiveness check - confirming the problem has not recurred
Regulators distinguish between a corrective action (fixing a problem that happened) and a preventive action (eliminating a potential problem before it occurs). Both must be managed through the same structured process under ICH Q10 and applicable GMP guidelines.
Step 1: Detect and Classify the Event
Every CAPA starts with a trigger. Common sources include:
- Deviations and out-of-specification (OOS) results
- Internal audit findings
- Customer complaints
- Regulatory inspection observations
- Trend analysis of process or quality data
- Returned goods or product recalls
Classify the event by risk - critical, major, or minor - to determine the urgency and depth of investigation required. Classification should be documented and justified using a risk-scoring matrix aligned with your QMS.
Step 2: Perform Root Cause Analysis
Root cause analysis (RCA) is where most CAPA systems fail. Common mistakes include stopping at the immediate cause, listing multiple hypothetical causes without evidence, and failing to distinguish between systemic and isolated failures.
5-Whys Analysis
The 5-Whys technique asks "why?" repeatedly until you reach the fundamental cause. It works well for straightforward deviations with a clear chain of events.
Fishbone (Ishikawa) Diagram
For complex deviations with multiple contributing factors, a fishbone diagram maps potential causes across the 6M categories: Man, Machine, Method, Material, Measurement, and Mother Nature (environment). Each branch is investigated with evidence.
Inspector expectation: FDA and EU GMP inspectors will read your RCA narrative in detail. They expect to see documented evidence for the root cause you identified - not just an assertion. "Training gap" is rarely an acceptable root cause unless you can show what the specific knowledge gap was and why it existed.
Step 3: Define Corrective and Preventive Actions
Once the root cause is confirmed, define specific, measurable actions:
- Assign each action to a named owner with a clear due date
- Distinguish between immediate corrections (containment) and systemic corrective actions
- Identify whether similar risks exist in other processes or products (preventive action scope)
- Reference any SOP revisions, training updates, or equipment changes required
Step 4: Implement and Verify
Implementation must be documented. For each action, retain evidence that it was completed - revised SOPs, training records, qualification data, or system configuration records. Quality sign-off on implementation should happen before the CAPA is moved to effectiveness check status.
Step 5: Effectiveness Check
The effectiveness check is the final test of your CAPA system. It asks: did the action actually prevent recurrence? Set a clear metric for success before implementation begins - for example, "zero recurrence of this deviation type over a 90-day monitoring period."
Common inspection finding: Many sites mark CAPAs as "effective" without documented evidence of the monitoring period or success metric. Ensure your QMS captures the date of effectiveness check, the data reviewed, and the conclusion - signed by a qualified reviewer.
Regulatory Requirements for CAPA
CAPA requirements appear in:
- FDA 21 CFR Part 820.100 - Corrective and preventive action (medical devices, also referenced for pharma)
- EU GMP Chapter 1 - Quality management principle requiring CAPA for all quality defects
- ICH Q10 - Pharmaceutical quality system, CAPA as a key enabling activity
- ISO 9001:2015 - Nonconformity and corrective action clause
FDA warning letters frequently cite inadequate CAPA systems. Common observations include: failure to identify root causes, inadequate effectiveness checks, and lack of systemic review across similar processes.
How PHARPRO Supports Your CAPA Programme
PHARPRO provides hands-on support at every stage of CAPA management: facilitating root cause workshops, writing investigation reports, reviewing your CAPA SOP against current regulatory expectations, and supporting CAPA responses to regulatory observations. We work within your quality system and adapt to your team's existing processes.