CAPA: Correction, Corrective Action, Preventive Action

CAPA is the system for investigating problems and stopping them recurring. For devices it is 21 CFR 820.100, one of the most cited subsections in the regulation. For drugs it lives inside the quality unit's responsibilities in 21 CFR 211, and ICH Q10 covers it as a pharmaceutical quality system element.

What the acronym packs together

The words are used interchangeably and mean different things, and the confusion is why so many CAPAs fail.

Correction. Fixing the instance. The batch is quarantined, the record is amended, the label is reprinted. It addresses what happened and nothing else.

Corrective action. Removing the cause of something that has already happened, so it does not recur.

Preventive action. Removing the cause of something that has not yet happened, found through trending, risk assessment or observation elsewhere.

A CAPA record containing only a correction is the most common finding in this area. The product was fixed and the cause was not addressed, so it happens again, and the next inspection sees two records with the same description.

Root cause analysis is where it is won

If the root cause is wrong, everything after it is wasted.

What makes it inadequate:

• Stopping at human error. "Operator did not follow the procedure" is a restatement, not a cause. Why did it happen: was the procedure wrong, ambiguous, untrained, or impossible as written under normal conditions?
• Stopping at the first plausible cause without testing it against the evidence.
• Not asking where else. The same cause almost always has other exposures, and finding them is what turns a fix into a corrective action.

Effectiveness checks

A CAPA is not closed when the action is done. It is closed when the action is shown to have worked, which requires:

• A defined measure decided in advance.
• A period long enough for recurrence to have shown up.
• A documented conclusion, including where the check failed and the CAPA reopened.

A system where every effectiveness check passes is not a healthy system. It means the checks are not capable of failing.

Where CAPA systems fail

Everything becomes a CAPA. Every deviation opens one, the system carries hundreds, and the important ones are indistinguishable. Risk-based triage exists to prevent this.

Overdue actions with no justification. Visible in your own log and among the easiest findings to make.

No trending. 21 CFR 820.100 requires analysis of quality data to identify recurring problems. Twelve deviations sharing one cause is only visible if somebody looks across them.

Closed on completion rather than effectiveness, which converts the system into a task tracker.