CAPA stands for Corrective and Preventive Action, a formal quality system that pharmaceutical and medical device companies use to find the root cause of problems and stop them from happening again. It is one of the most scrutinized elements of any FDA inspection. Year after year going back to 2010, inadequate CAPA procedures have been the single most common reason companies receive inspection citations.
How CAPA Works
A CAPA system has two distinct parts. A corrective action addresses something that has already gone wrong: a batch of tablets that failed a quality test, a piece of equipment that malfunctioned, a pattern of customer complaints. The goal is to find the underlying cause and eliminate it so the problem doesn’t recur. A preventive action, by contrast, targets a problem that hasn’t happened yet but could, based on trends, audit findings, or risk analysis. Corrective action prevents recurrence; preventive action prevents occurrence in the first place.
There’s also an important distinction between a “correction” and a “corrective action.” A correction is the immediate fix, like discarding a contaminated batch or reworking a product. A corrective action goes deeper, asking why the contamination happened and changing the process so it won’t happen again. A correction without a corrective action is like mopping up a leak without fixing the pipe.
The Regulatory Requirements
The FDA codified CAPA requirements under 21 CFR 820.100, which lays out seven specific steps companies must follow. These include analyzing quality data to identify existing and potential causes of problems, investigating the root cause of nonconformities, identifying what needs to change, verifying that the changes actually work, implementing and recording those changes, communicating the findings to the right people, and submitting the information for management review.
The regulation also requires that every activity in the process be documented. The scale of your response should match the scale of the risk. A minor labeling inconsistency doesn’t demand the same investigation as a sterility failure. The FDA explicitly states that corrective and preventive actions should be “commensurate with the risks encountered.”
The Investigation: Finding Root Cause
The investigation phase is where most of the real work happens. Companies use structured problem-solving tools to move past surface-level symptoms and identify the true root cause. The most common include:
- 5 Whys: You keep asking “why” (typically five times) until you drill down from the obvious symptom to the underlying system failure. If a tablet press produced out-of-spec tablets, why? Because the granulation was too wet. Why? Because the humidity controls failed. Why? And so on.
- Fishbone diagram: A visual tool that maps possible causes across categories like people, process, equipment, materials, and environment. It helps teams avoid tunnel vision by forcing them to consider all contributing factors.
- Pareto chart: A bar chart that ranks different causes by frequency or impact, making it easy to see which problems are responsible for the most failures.
- Comparative analysis: Isolates variables by comparing conditions when the problem occurs versus when it doesn’t, narrowing down which specific factor is responsible.
The goal isn’t just to pick a tool and fill out a template. Regulators want to see that the investigation genuinely uncovered why something went wrong, not that the company went through the motions. A fishbone diagram with only two branches filled in, or a 5 Whys analysis that stops at “operator error,” will raise red flags during an inspection.
Verifying That the Fix Actually Worked
Identifying a root cause and implementing a change is only half the job. The FDA expects companies to verify that their corrective or preventive action was effective and didn’t create new problems. This is called the effectiveness check, and it’s where many companies fall short.
A meaningful effectiveness check answers three questions: What will you measure? When will you measure it? What counts as success? For example, if your CAPA addressed a recurring deviation in a mixing process, you might track deviation rates for that process over the next several production cycles to confirm the rate dropped to an acceptable level. Industry practice often involves a monitoring window of three to six months after implementation, though waiting that long without interim checks can introduce unnecessary regulatory risk. The best programs build in earlier checkpoints to confirm the fix is on track.
Why CAPA Is the Top FDA Citation
Between 2013 and 2019, the FDA issued 355 warning letters related to CAPA deficiencies, totaling 407 individual violations. The breakdown reveals where companies struggle most. A full 72% of those violations were for failing to establish and maintain adequate CAPA procedures in the first place. Another 10.6% were for poor documentation. Failures in verification and validation accounted for 4.4%, while problems with analyzing quality data made up 8.4%.
The pattern is clear: the most common failure isn’t botching a complex root cause analysis. It’s not having a functioning CAPA system at all, or having one that exists on paper but isn’t followed in practice. Even as the total number of warning letters has declined over the years, CAPA-related observations on FDA inspection reports (known as Form 483s) remain stubbornly at the top of the list. A review published in the Journal of Medical Device Regulation noted that despite the inspection framework being in place for over 23 years, “there continues to be significant inadequacies in how medical device companies use the CAPA system.”
What a Typical CAPA Looks Like in Practice
Imagine a pharmaceutical manufacturer notices a spike in out-of-specification results during final testing of a sterile injectable product. The rejection rate for a filling line, normally around 2%, has climbed to 6% over the past month. That trend triggers a CAPA.
First, the quality team opens a formal CAPA record and gathers data: batch records, environmental monitoring logs, equipment maintenance histories, operator training records. They run a comparative analysis between the batches that passed and those that failed, looking for the variable that changed. A fishbone diagram helps them consider whether the issue is environmental, mechanical, procedural, or material-related.
The investigation reveals that a gasket in the filling equipment was replaced with a slightly different specification during routine maintenance. The immediate correction is to replace the gasket with the correct part and retest affected batches. The corrective action is to update the maintenance procedure to include part-number verification and add the gasket specification to the incoming inspection checklist. The preventive action might extend this part-number verification step to all critical equipment across the facility, not just the one filling line.
The team then defines their effectiveness check: they’ll monitor rejection rates on that filling line for the next 90 days, with a target of returning to the historical 2% baseline. All of this is documented, reviewed by management, and kept in the quality system for future inspections.
How CAPA Connects to Broader Quality Systems
CAPA doesn’t operate in isolation. It pulls data from nearly every other part of the quality system: complaints, deviation reports, audit findings, production records, and equipment logs. It’s essentially the mechanism that turns scattered quality signals into systematic improvement. When a company receives a customer complaint, that complaint gets logged and trended. If it reveals a pattern, it feeds into CAPA. When an internal audit finds a gap in a procedure, that gap becomes a CAPA input.
This is why regulators view the CAPA system as a window into a company’s overall quality culture. A well-run CAPA system suggests the organization takes quality seriously, investigates problems honestly, and follows through on fixes. A weak one suggests the opposite, regardless of how polished the rest of the operation looks.