CAPA: Correction, Corrective Action, Preventive Action

CAPA is the system for investigating problems and stopping them recurring. For devices it is 21 CFR 820.100, one of the most cited subsections in the regulation. For drugs it lives inside the quality unit's responsibilities in 21 CFR 211, and ICH Q10 covers it as a pharmaceutical quality system element.

Correction, corrective action and preventive action

The terms are often used interchangeably but mean different things.

Correction. Fixing the instance. The batch is quarantined, the record is amended, the label is reprinted. It addresses what happened and nothing else.

Corrective action. Removing the cause of something that has already happened, so it does not recur.

Preventive action. Removing the cause of something that has not yet happened, found through trending, risk assessment or observation elsewhere.

A CAPA record containing only a correction is the most common finding in this area. The product was fixed and the cause was not addressed, so it happens again, and the next inspection sees two records with the same description.

Root cause analysis

An action built on the wrong root cause does not prevent recurrence. Root cause analysis usually falls short by:

• Stopping at human error. "Operator did not follow the procedure" is a restatement of the event. The question is why it happened: was the procedure wrong, ambiguous, untrained, or impossible as written under normal conditions?
• Stopping at the first plausible cause without testing it against the evidence.
• Not asking where else. The same cause almost always has other exposures, and finding them is what turns a fix into a corrective action.

Effectiveness checks

A CAPA closes when the action is shown to have worked, not when it is done. That requires:

• A defined measure decided in advance.
• A period long enough for recurrence to have shown up.
• A documented conclusion, including where the check failed and the CAPA reopened.

If every effectiveness check passes, the checks are probably not capable of failing.

Common CAPA system failures

Everything becomes a CAPA. Every deviation opens one, the system carries hundreds, and the important ones are indistinguishable. Risk-based triage exists to prevent this.

Overdue actions with no justification. Visible in your own log and among the easiest findings to make.

No trending. 21 CFR 820.100 requires analysis of quality data to identify recurring problems. Twelve deviations sharing one cause is only visible if somebody looks across them.

Closed on completion rather than effectiveness, which converts the system into a task tracker.