CAPA under ISO 13485: the corrective action process
CAPA stands for corrective and preventive action. It is one of the most audit-critical parts of ISO 13485 , described in clause 8.5 of the standard. CAPA requires you not only to fix a problem, but also to remove its underlying cause and prevent it from recurring. That is what sets it apart from a simple correction.
The standard requires you to document CAPA processes, carry them out and demonstrably check their effectiveness. Auditors from certification bodies (accredited by the RvA (Dutch Accreditation Council) ) look at CAPA quality at every surveillance audit. See also how CAPA fits into the wider requirements of ISO 13485. You will find the general meaning of CAPA and a CAPA register for every standard in the knowledge base under CAPA: corrective and preventive actions.
ISO 13485 distinguishes between a correction (fixing the nonconformity itself), a corrective action (removing the cause) and a preventive action (preventing a potential problem). In practice they often sit together in one CAPA system.
A system must be able to keep the link between finding, cause, action and effectiveness check. Use that chain as a demonstration scenario when you choose QMS software for ISO 13485.
CAPA in brief
| Term | What it means |
|---|---|
| Correction | Immediate fix of the nonconformity (adjust the product, block the batch) |
| Corrective action | Find the cause and remove it structurally |
| Preventive action | Identify a potential problem and prevent it |
| Effectiveness check | Prove that the measure really works |
The CAPA process under ISO 13485 step by step
Detection and recording
Every CAPA starts with a clear trigger: a complaint, a nonconformity, an audit finding, a recall or a trend analysis. Record the source, the device or process concerned, and the initial impact.
Scope analysis (containment)
Limit the potential harm straight away. Is there a product batch in the field? Have customers been affected? Do you need to block, recall or inform anyone? This is also the stage for any quick fix (correction), but a correction is not a CAPA.
Root cause analysis
This is the core of CAPA. Use a suitable method: 5 Whys, an Ishikawa diagram or Failure Mode and Effects Analysis (FMEA). The root cause must be specific. “Human error” is not a cause, but “insufficient training on procedure X” is.
Drawing up an action plan
Link each cause to a concrete measure. Assign an owner and set a deadline. Several causes may need several actions.
Implementation
Carry out the measures. Document what was done, when and by whom.
Effectiveness check
After an agreed period, check whether the measure really works. Has the nonconformity not come back? Have the trends changed? An effectiveness check is mandatory under ISO 13485, and it is the weakest point for many organisations.
Closure and archiving
Close the CAPA formally, with evidence that the measure was effective. Keep the file in line with your document control requirements.
Example CAPA record (table)
| Field | Example |
|---|---|
| CAPA number | CAPA-2024-047 |
| Date opened | 12 April 2024 |
| Source | Customer complaint: damaged packaging on receipt |
| Product/process concerned | Packaging line 3, product code X-140 |
| Scope | 3 complaints in 6 weeks, same lot range |
| Root cause | Seal temperature fluctuating due to a faulty sensor |
| Measure | Sensor replaced and preventive maintenance frequency doubled |
| Owner | Operations manager |
| Implementation deadline | 30 April 2024 |
| Effectiveness check | No new complaints in 8 weeks; seal monitoring data stable |
| Date closed | 28 June 2024 |
Link with nonconformities, complaints and recalls
CAPA does not stand alone. It is directly linked to other processes:
- Nonconformity management: every significant nonconformity can trigger a CAPA.
- Complaint handling: with recurring complaints or serious adverse effects, a CAPA is mandatory.
- Recall and Field Safety Corrective Action (FSCA): a recall always requires a CAPA, and it also affects your technical documentation.
- Risk control: new insights from a CAPA must be fed back into the risk management file, in line with ISO 14971.
Common mistakes with CAPA under ISO 13485
| Mistake | Why it is a problem | Better alternative |
|---|---|---|
| Root cause is too vague (“human error”) | Auditors will not accept it; recurrence is likely | Use 5 Whys or Ishikawa; be specific |
| No effectiveness check | Mandatory under ISO 13485 and an audit focus | Plan a review point explicitly in the CAPA record |
| Opening a CAPA only after an audit finding | Signals are ignored until it is too late | Link complaint and nonconformity trends directly to CAPA triggers |
| Mixing up correction and CAPA | Fixing only the correction leads to recurrence | Document both explicitly and separately |
| Endless open CAPAs | The system loses credibility | Set deadlines, escalate delays and close on time |
At the surveillance audit, the auditor checks not only whether you open CAPAs, but also whether they were closed effectively. Open CAPAs without progress are a common finding.