Corrective and Preventive Action (CAPA) is a formal quality system process that medical device manufacturers use to investigate problems, correct existing nonconformities, and stop potential ones from occurring. It combines root cause analysis, documented action, and effectiveness verification, and it is required under ISO 13485 and the FDA Quality Management System Regulation.
What is Corrective and Preventive Action (CAPA)?
Corrective and Preventive Action (CAPA) is the closed-loop mechanism a quality management system uses to respond to problems. Corrective action addresses a nonconformity that has already happened and removes its cause so it does not recur. Preventive action targets a potential nonconformity, acting on a risk or trend before a failure occurs.
In a device organization, CAPA sits at the center of the quality system. It takes inputs from complaints, audit findings, nonconforming products, process monitoring, and post-market surveillance, then drives structured investigation and correction. A well-run CAPA process is one of the clearest signals to an auditor that a manufacturer actually learns from its own data.
Why Corrective and Preventive Action (CAPA) matters in medical device development
For regulated devices, CAPA is where quality problems either get resolved or get repeated. A missed root cause can reach patients through a field failure, a recall, or an adverse event. That is why CAPA is one of the most heavily scrutinized areas in any inspection.
CAPA records are a frequent subject of FDA warning letters and audit nonconformities. Regulators read a weak CAPA system as evidence that a manufacturer cannot detect or contain its own failures. The cost also compounds: an unresolved systemic issue can trigger repeat deviations, delayed submissions, and holds on product release. Caught early, the same signal becomes a cheap fix during development rather than an expensive one in the field.
How the Corrective and Preventive Action (CAPA) process works.
CAPA is governed by ISO 13485, clause 8.5.2 (corrective action) and clause 8.5.3 (preventive action). In the United States, these requirements now reach manufacturers through the FDA Quality Management System Regulation (21 CFR Part 820), which took effect on February 2, 2026, and incorporates ISO 13485:2016 by reference, replacing the older 820.100 CAPA clause. EU MDR 2017/745 carries the same expectation through its quality system and post-market surveillance articles.
A typical CAPA flows through these stages:
- Identification and intake. A problem or signal enters the system from a complaint, audit, nonconformity, or trend.
- Evaluation and triage. The team assesses severity and risk, often using ISO 14971 inputs, to decide whether a full CAPA is warranted.
- Investigation and root cause analysis. Tools such as the five whys, fishbone diagrams, or fault tree analysis trace the true cause rather than the symptom.
- Action planning. Corrective actions remove the existing cause; preventive actions address related risks elsewhere.
- Implementation. Changes are made under change control, updating procedures, designs, or processes as needed.
- Effectiveness verification. Objective evidence confirms the action worked and introduced no new problem.
- Closure. The record is documented, approved, and closed, with links to affected files.
Risk feeds the whole flow. ISO 14971:2019 informs how a manufacturer prioritizes signals, and design or software changes may pull in IEC 62304 for software or IEC 60601-1 for electrical safety.
Common challenges and best practices
The most common failure is treating the symptom instead of the cause. A team scraps a faulty batch but never asks why the process let it through, so the problem returns. Strong root cause analysis, backed by real data, is what separates a durable fix from a temporary patch.
Two other patterns show up often. CAPA systems get overloaded when every minor issue becomes a formal CAPA, burying the serious ones, so a risk-based triage step keeps the queue focused. Effectiveness checks are also frequently skipped or done too soon, closing records before there is proof the fix held. Good practice ties each CAPA to measurable criteria and verifies against them before closure.
How SJML helps with Corrective and Preventive Action (CAPA)
Syrma Johari MedTech (SJML) runs CAPA as part of its Compliance-as-a-Service offering. Its QARA team handles complaint intake, adverse-event reporting, root cause analysis, and CAPA execution, tied into post-market surveillance and vigilance workflows. Because SJML operates an ISO 13485 quality system across design, manufacturing, and regulatory functions, corrective and preventive actions can be traced from a field signal back to the design or process that caused it, then closed under structured change control. Support scales from startups through large OEMs.
Frequently asked questions
Corrective action responds to a nonconformity that has already occurred and removes its cause so it does not happen again. Preventive action targets a potential nonconformity, acting on a risk or adverse trend before any failure takes place. Both live inside the same CAPA process and follow the same investigate, act, and verify discipline.
CAPA is required by ISO 13485, clauses 8.5.2 and 8.5.3. In the United States, the FDA Quality Management System Regulation (21 CFR Part 820) incorporates ISO 13485:2016 by reference as of February 2, 2026. EU MDR 2017/745 also requires a CAPA process within the manufacturer’s quality management system and post-market activities.
A CAPA can be triggered by customer complaints, internal or external audit findings, nonconforming product, out-of-specification results, process monitoring trends, returned devices, and post-market surveillance data. Not every signal needs a formal CAPA. A risk-based triage step decides which issues warrant a full investigation and which can be handled through simpler correction.
Effectiveness verification uses objective evidence to confirm that the action removed the root cause and created no new problem. Teams define measurable criteria up front, such as a target defect rate or absence of recurrence over a set period, then check performance against them before closing the record. Closing a record too early is a common audit finding.
Related terms
- Root Cause Analysis (RCA)
- Nonconforming Product
- Post-Market Surveillance (PMS)
- Complaint Handling
- Change Control
