CAPA: corrective and preventive actions
CAPA stands for corrective and preventive action. With CAPA, you find the real cause of a mistake or complaint, take a measure that prevents it from recurring, and check afterwards that the measure works. The CAPA register is the list in which you record all these cases, from report to closure.
Almost every management system standard requires it. ISO 9001 and the other standards with the High Level Structure cover it in clause 10.2. ISO 13485 for medical devices literally calls it CAPA; the details are on CAPA under ISO 13485. This page covers the approach that works for every standard.
CAPA in one sentence: not only solving the problem, but making sure it does not come back, and proving that.
What does CAPA mean?
CAPA consists of three types of action. Auditors check that you keep them apart, even when they appear on one form.
| Term | Meaning | Example with a wrongly delivered order |
|---|---|---|
| Correction | Solving the immediate problem | Delivering the correct products after all |
| Corrective action (CA) | Removing the cause so it does not happen again | Order picking with a barcode scanner instead of on paper |
| Preventive action (PA) | Preventing a problem that has not yet occurred | Introducing the same scanning at the second location, where nothing has gone wrong yet |
A correction without a corrective action is firefighting. The customer is satisfied, but next month it goes wrong again.
Which standards ask for CAPA?
The term CAPA comes from the medical and pharmaceutical world. Other standards use different words for the same idea.
| Standard | Clause | What it is called |
|---|---|---|
| ISO 9001:2015 | 10.2 | Nonconformity and corrective action |
| ISO 14001:2015 | 10.2 | Nonconformity and corrective action |
| ISO 45001:2018 | 10.2 | Incident, nonconformity and corrective action |
| ISO 27001:2022 | 10.2 | Nonconformity and corrective action |
| ISO 13485:2016 | 8.5.2 and 8.5.3 | Corrective and preventive actions (CAPA) |
Notably, since 2015, ISO 9001 and the other HLS standards no longer have a separate requirement for preventive actions. This has been absorbed into risk-based thinking; see risk management under ISO 9001. ISO 13485 still treats preventive actions separately. You can read how ISO 9001 handles nonconformities at nonconformities and improvement.
The CAPA process in seven steps
The CAPA process is roughly the same in every standard. You can take these seven steps directly into your procedure.
Report and register
Record what went wrong, when, where and who reported it. Sources include complaints, internal nonconformities, audit findings, incidents and trends.
Assess
Is this worth a CAPA? A one-off typing error on an invoice is not, but a recurring error or a safety risk is. Record the decision and the reason.
Correction and containment
Solve the immediate problem and prevent further damage. Block a batch, inform the customer, stop a machine.
Analyse the cause
Find the root cause. The CAPA analysis below covers this.
Plan and carry out the action
Link each cause to an action, with an owner and a date.
Check effectiveness
After a period chosen in advance, check whether the problem has really gone. This is the step most often missing.
Close and learn
Close the CAPA with evidence. Take the lessons into your risk analysis and your management review.
CAPA analysis: how do you find the real cause?
The CAPA analysis is the cause analysis within the CAPA process. The aim is a cause you can remove. “Human error” is therefore never the final answer: ask why that error was possible.
| Method | When to use it | Explanation |
|---|---|---|
| 5 whys | Simple problems with one clear cause | Root cause analysis and 5 whys |
| Ishikawa diagram | Several possible causes, team session | Ishikawa diagram (fishbone) |
| 8D report | Customer complaints where the customer expects a report | 8D report |
| FMEA | Searching in advance for what could go wrong, for preventive actions | FMEA |
A short 5 whys for the example of the wrong delivery:
- Why did the customer receive the wrong products? The order picker took the wrong item.
- Why? Two items were stored next to each other and looked alike.
- Why did nobody notice? There is no check between picking and packing.
- Why is there no check? The picking process uses paper lists without scanning.
- Why? When the warehouse grew, the process was never adjusted.
The root cause is the missing check in the picking process, not the order picker.
Example of a CAPA register
The CAPA register is your overview of all CAPAs. A spreadsheet is enough for most small companies. Take these columns over as a template.
| No. | Date | Source | Description | Correction | Root cause | Action | Owner | Deadline | Effectiveness check | Status |
|---|---|---|---|---|---|---|---|---|---|---|
| CAPA-26-01 | 12 January 2026 | Complaint | Customer received the wrong items three times in four weeks | Correct items delivered later | No check between picking and packing | Barcode scan during picking | Head of warehouse | 1 March 2026 | Zero wrong deliveries in 8 weeks after implementation | Closed 28 April 2026 |
| CAPA-26-02 | 3 February 2026 | Internal audit | Calibration of 2 measuring instruments expired | Instruments calibrated, measurements reassessed | No reminder in the schedule | Calibration dates in the maintenance plan with automatic alert | Quality manager | 15 March 2026 | At the next audit, all measuring instruments on time | Open, check planned for September 2026 |
| CAPA-26-03 | 20 February 2026 | Near miss | Forklift hits racking at the loading door | Racking inspected and repaired | Walking route and driving route cross at the door | Driving route moved, floor markings applied | Facility manager | 31 March 2026 | No new reports in 3 months | Closed 30 June 2026 |
Two columns make the difference in an audit: the root cause and the effectiveness check. If these say “n/a” or are empty, it is not a CAPA but a task list.
Plan the effectiveness check as soon as you open the CAPA, with a date and a measurable criterion. “We keep an eye on it” is not a check.
When do you use software for your CAPA register?
A spreadsheet works well up to a few dozen CAPAs a year. Above that, or if you have several locations, you quickly lose track of deadlines and owners. In the medical sector, auditors often expect a system with recorded approvals. See ISO software for your management system for the trade-offs.
Common mistakes with CAPA
- Confusing correction and corrective action. The problem is solved, the cause is not.
- The cause is a person. “Employee was careless” leads to a reprimand, not a better process.
- No effectiveness check. Or a check without a criterion and a date.
- Everything is a CAPA. A register with hundreds of open lines is no longer read. Set a threshold.
- CAPAs stay open forever. Discuss open CAPAs monthly and escalate delays.
- No link to risks. A new cause also belongs in your risk matrix.
Further reading
- CAPA under ISO 13485 - the specific requirements for medical devices
- Root cause analysis and 5 whys - the cause analysis step by step
- Major and minor nonconformity - how you respond to an audit finding
- Planning and carrying out internal audits - an important source of CAPAs