CAPA stands for corrective action and preventive action. Both are formal processes inside a medical device quality management system, and both exist to remove the cause of a problem rather than patch the symptom.
- Corrective action eliminates the root cause of a nonconformity that has already occurred, so it does not happen again.
- Preventive action eliminates the cause of a potential nonconformity before it occurs.
- Correction is neither. It is the immediate fix for the nonconforming product or process itself, such as rework, quarantine, or a hold on production. A correction does not touch the cause, which is why it is not a substitute for a CAPA.
ISO 13485:2016 covers corrective action in clause 8.5.2 and preventive action in clause 8.5.3. Since February 2, 2026, the FDA's Quality Management System Regulation (QMSR) incorporates ISO 13485:2016 by reference in 21 CFR Part 820, so US device makers meet the same requirements. Not every issue needs a CAPA. The rest of this article covers how to tell which response an issue calls for.
Corrective Action
To begin with a quick refresh, you're going to use a CAPA process to prevent and correct issues identified in your company, but not every issue warrants a CAPA.
If you have an issue that proves to be repetitive and systemic or it is something that is quite severe, that is when CAPA comes into play. Otherwise, you would just use other procedures within your quality system to manage the issue; for example, for your complaints procedure or change management.
So, let's say you've found a series of nonconformances. You've discovered that you have a systemic issue and that you need to enact your CAPA procedure. The first thing you do is contain it: quarantine the affected product, stop the process if you have to, and record that correction. Then the corrective action begins. Its purpose is to find the root cause of the nonconformity and eliminate it, so the same issue cannot recur. Containment is where corrective action starts, not where it ends.
For example, immediate corrections might include halting the manufacturing process until you've got to the bottom of the issue, or putting product into quarantine rather than allowing it to go out to customers and end users. Those steps protect patients today; the corrective action that follows is what protects them next year.
The corrective action is going to occur when you've had feedback from one of your quality data sources to show that you have an issue for CAPA.
Here's another example; let's imagine that your source for identifying a CAPA issue was an internal audit. Perhaps you've identified a non-conformance within manufacturing that appears to be happening regularly. A corrective action might be to immediately require your manufacturing staff to undergo extra training to help stop the issue from happening again (this could be a corrective and a preventive action).
An extreme corrective action would be to issue a recall of the product involved. A product recall is its own "beast" with many nuances and decision points that warrants its own discussion, so we won't go into it in detail here. However, you should be familiar with and have procedures for addressing potential product recalls. Review FDA 21 CFR Part 806 for more details.
Corrective action is, by definition, a response to something that has already occurred. The trap is stopping at the reaction. If the record shows a rework and a retraining but no root cause investigation and no effectiveness check, you have documented a correction and called it a corrective action, and that is exactly what an inspector will point out.
Preventive Action
When you go into CAPA, there tends to be a greater emphasis on corrective actions rather than preventive.
People always seem to be fighting fires and taking a reactive stance. A good analogy is in your health care; for example, maybe you develop high blood pressure and are put on medications to lower it.
There are risk factors to high blood pressure that are known prior to the condition ever appearing. If someone knows they need to lose a few pounds ahead of ending up with high blood pressure, a good preventive action is to lose that weight. Going on the medication is the reactive, corrective action.
This is essentially the difference between corrective action and preventive action; preventive is proactive. It seeks to monitor and prevent issues before they become a problem.
Imagine you have a non-conformance and find an issue with product not meeting your specification, while that product is still under your control (at your manufacturing facility). A preventive action might be to look at inspecting more components or parts, or perhaps even inspecting more regularly. You want to be thorough with your product and inspection criteria before it becomes a problem. A good process implies that you have the necessary checks and balances in place to identify issues before your products leave the facility and therefore, before things like complaints or recalls become necessary.
For example, if you've had an issue with product A, have you checked products B and C as well? That issue might show up at some point for them too, especially if it is process-related, so be proactive.
If you found people weren't following a procedure because they didn't have adequate training, this might cause issues across multiple products or areas of the business. This is where that training is both corrective and preventive.
Here are some common preventive actions:
- Installing "alarms" into your process. This might be monitoring of statistics or process control charts.
- Audits or reviews of suppliers.
- Review of non-conformances in similar companies or products. How might the lessons learned there apply to your business? Perform regular risk analyses (such as failure mode and effects analysis, or FMEA) to uncover possible hazards.
- Any preventive maintenance or calibration programs that ensure your equipment functions uniformly.
- Regular review of processes or controls to spot any potential issues that could drift into the area of a non-conformance.
- Establish comprehensive training programs with regular performance reviews to ensure employee performance standards are kept up.
- Have planning in place for hazards, disaster recovery, or any unexpected situations so that your company is prepared.
| Question | Corrective action | Preventive action |
|---|---|---|
| Has the nonconformity already happened? | Yes. A complaint, audit finding, nonconformance report, or trend has confirmed it. | No. Data or risk analysis shows it could happen. |
| What triggers it? | Quality data sources: complaints, internal and supplier audits, nonconforming material reports, service records, returned product. | Trend analysis, risk analysis (FMEA, ISO 14971 risk files), process capability data, lessons learned from similar products or suppliers. |
| What does it change? | The root cause of the confirmed problem: a procedure, a design input, a supplier, a training gap, a piece of equipment. | The conditions that would let the problem occur: added inspection, process monitoring, calibration intervals, supplier controls, training requirements. |
| How is it verified? | Verification of effectiveness after implementation: does the nonconformity recur? | Verification of effectiveness against the leading indicator: did the risk metric move? |
| Example | Field complaints show a connector cracking. Root cause is an out-of-tolerance molding parameter. Corrective action: revise the process specification, requalify the process, retrain operators. | Trend data shows the same connector's dimensions drifting toward the limit on a second product line. Preventive action: add SPC monitoring to that line before any part fails. |
How to decide: correction, corrective action, or preventive action
Run every quality event through four questions before you open a CAPA.
- Is product or patient safety at risk right now? If yes, take the correction first: quarantine, stop the line, or evaluate a recall under 21 CFR Part 806. Document it, then move to the questions below. A correction alone is never the end of the record.
- Is the issue systemic, repeat, or severe? A single, isolated nonconformance is usually handled inside your nonconformance or complaint procedure. Repeat events, trends, or anything with a high risk rating warrant a CAPA.
- Has it happened, or could it happen? Confirmed events get a corrective action. Potential events identified through risk analysis or trend data get a preventive action. Many CAPAs carry both: the corrective action fixes product A, the preventive action checks products B and C for the same process weakness.
- Do you know the root cause? If not, you are not ready to define the action. Use a structured root cause analysis method (5 Whys, fishbone, fault tree) and document the evidence before you write the action plan. Actions written before the root cause is known are the most common reason a CAPA fails its effectiveness check.
How to make your CAPA process proactive
The overall aim is to design and develop quality systems that are leading indicators of any issues rather than lagging after the fact. Build in processes that help prevent issues from happening in the first place, then monitor and review those processes regularly.
Medical device companies that have a difficult time with compliance tend to be those that are reactive rather than proactive. Compliance activities become checkbox items they "have" to do because an audit or inspection is coming, and the CAPA log fills with corrections that were never investigated. Preventive action, trend review, and management review are the parts of the quality system that break that pattern.
If this is the case, your company is missing the point. Regular monitoring and reviewing of processes can help you provide better, safer devices, which should always be the end goal. Monitoring or auditing should be treated as opportunities to learn and improve where possible.
Remember, the FDA won't be sending you a warning letter just because you have a CAPA, they'll do so because you didn't document or follow good processes to deal with it.
Final Thoughts
Which sits more easily with your company? Reactive measures when issues arise or taking a proactive stance to catch things before they become an issue?
There tends to be a lot of "fire fighting" and focus given to corrective actions for non-conformances and less attention given to the proactive, preventive measures. Our feeling is that it tends to be the companies who strive to be proactive and catch possible issues before they become non-conformances who have a smoother path with getting their products to market and with dealing with regulatory bodies.
It might sound like a lot of work putting in checks and alarms, but doing that work upfront can save you from costly or time-consuming corrective actions later on.
Frequently asked questions about corrective and preventive action
Is a correction the same as a corrective action?
No. A correction fixes the nonconforming product or output itself, for example reworking a batch or quarantining inventory. A corrective action removes the cause so the nonconformity does not recur. A CAPA record normally documents both: the correction taken to contain the issue and the corrective action taken to eliminate its cause.
When is a CAPA required?
A CAPA is required when a quality issue is systemic, recurring, or severe enough that your nonconformance, complaint, or change control procedures cannot resolve it on their own. Your CAPA procedure should define the triggers, for example a complaint trend crossing a threshold, a repeat audit finding, or any event with a high risk rating, so the decision is documented rather than left to judgment in the moment.
What are the 7 steps of CAPA?
Common breakdowns list seven steps: identification, evaluation, investigation, root cause analysis, action plan, implementation, and verification of effectiveness. Greenlight Guru groups the same work into five elements. See the 5 key elements of an effective CAPA system for each step in detail.
What are the most common CAPA mistakes?
Opening a CAPA for every minor issue, stopping at the correction without finding the root cause, writing actions before the investigation is complete, and closing a CAPA without a documented effectiveness check. FDA inspectors look at CAPA records specifically for evidence that the cause was found and the fix held, so each of these shows up as an inspection observation.
Still managing CAPAs in spreadsheets or on paper? Greenlight Guru's eQMS gives medical device companies a dedicated CAPA management workflow: every record links its correction, root cause investigation, action plan, and effectiveness check, and connects to the complaint, nonconformance, or audit finding that triggered it. See how it works in a free demo.
