The CAPA process is a frequent topic of discussion here at Greenlight Guru, mainly because it's still such a big issue for medical device companies. Year after year, CAPA (corrective and preventive action) is always one of the most cited areas for 483s and warning letters during FDA inspections.
Given that your CAPA process will always be evaluated during an FDA inspection or ISO audit, it's important that medical device companies have an airtight CAPA process in place. So, here's the step-by-step process we recommend that will help any medical device manufacturer get the best results from their CAPAs.
What is a CAPA process?
A CAPA process is the documented, step-by-step method a company uses to run corrective and preventive actions: identify a systemic quality problem, investigate it, find the root cause, plan and implement the actions, and verify that they worked. In a medical device quality management system it is a regulatory requirement, and it is the process FDA investigators review most closely.
The 15 steps at a glance
The 15 steps below fall into five phases. Request and review (steps 1 to 4): raise a CAPA request, have the right people review it, accept or reject it, and formally open the CAPA with a tracking number. Investigation (steps 5 to 9): confirm the sources, assemble a cross-functional team, contain the immediate problem, investigate, and determine the root cause. Action (steps 10 and 11): write the action plan and carry it out. Review and approval (steps 12 and 13): confirm the work is complete and sign off. Effectiveness verification (steps 14 and 15): define how you will prove the actions worked, then prove it and close the CAPA.
Breakdown of the CAPA process and procedure steps
Use CAPA judiciously. You want a strong procedure ready when an issue does warrant a CAPA, but you also have to decide whether the issue meets your own criteria for one. Only systemic issues should open a CAPA. Not every nonconformance is a CAPA, and treating every one as a CAPA is how companies end up with a backlog they cannot close.
However, once you identify a problem that you believe is worthy of a CAPA, here are the steps you should follow:
FREE RESOURCE: Click here to download your own PDF copy of the full CAPA Process Infographic.
1. Create a CAPA request and submit for review
The first part of your process is determining whether the issue at hand actually requires a CAPA. This means submitting a CAPA request that will then be reviewed by individuals within the company who have the knowledge to make the determination of whether a CAPA is necessary in this case.
During the CAPA request, you'll need to identify your sources for this CAPA and record them. For example, did the issue that triggered the CAPA stem from an internal audit, a customer complaint, or a nonconformance? Be very clear about what the issue is and how it came to light in your request.
2. The appropriate personnel should review the CAPA request
Your sources and reviewers will determine whether the CAPA should be accepted and formalized into your quality system.
Who should review the CAPA request? Usually someone from quality, such as the quality manager, plays the critical role, but it does not have to be one person. Many companies use a Management Review Board (MRB) or Quality Review Board (QRB) to review CAPA requests as a team.
One tip: set these meetings up on a recurring basis, not just for CAPA requests but for all quality events, so nothing waits for a meeting to be scheduled. A regular review of any issues that arise will help you keep your finger on the pulse of your organization.
3. Accept or reject the CAPA request
Once the CAPA request has been reviewed, it will either be accepted or rejected by the board or individual in charge of the review.
If the CAPA request is rejected, the rationale behind the rejection should be documented and kept for your records. Just remember that this doesn't mean the issue you've raised is not a problem. It still may require a solution, but that will need to happen outside of your CAPA process.
If the CAPA request is accepted, you'll move on to the next step in the process.
4. The request is formally initiated as a CAPA
When a CAPA is initiated, you need to assign it a tracking or identification number, both for documentation purposes and to help you keep track of it throughout the CAPA process. There should always be a clear trail of documentation and a way to monitor progress for a specific CAPA.
Many companies have received warning letters or observations for failing to track CAPAs properly, especially if that failure to track meant CAPAs were left open indefinitely.
Keep in mind, there is no specific timeline for closing a CAPA. You'll often hear "90 days" as the standard, but setting that as the goal for every CAPA can lead to people cutting corners as they try to close the CAPA within that time frame.
Instead of creating an arbitrary timeline, your best bet is to work in a timely manner and follow the plan you have in place for your CAPA process. If it takes longer than 90 days to do a thorough investigation and ensure you've corrected the issue and prevented it from happening again, then so be it.
5. Finalize your CAPA source
Think of this as getting your ducks in a row before you start taking action. Identify any sources contributing to the CAPA, including processes, product, or other quality problems. You'll rely on this information as you perform your investigation, so be as thorough and holistic as possible as you gather your information.
6. Determine a CAPA cross-functional team
Your CAPA should be treated like a project. Once you've clearly determined the sources, products and processes involved with the CAPA, this will help you to identify the people you need on the team overseeing the investigation.
For example, you might need engineering, marketing, manufacturing or regulatory as part of your team. Whatever the case may be, build your CAPA team appropriately for addressing the issues identified.
7. Identify any immediate actions or corrections required
This next step in the CAPA process is to identify anything that will require you to take action immediately. For example, if you identify an issue with a particular product, you may need to quarantine any finished product you believe was affected by the issue that triggered the CAPA. In an extreme case, you may need to consider issuing a recall, which is something that has to happen immediately.
The bottom line is that this step in the CAPA process is about containment. Are there any actions you can take immediately to prevent the issue from continuing or becoming more widespread? If so, then you need to take those actions now and then move on to finding more durable long-term solutions to the problem.
8. Investigate and capture findings from the CAPA
Once you've taken care of any pressing issues stemming from the CAPA, you're ready to conduct a thorough investigation of the problem.
This means returning to the sources of the CAPA (the product, the processes, and the people involved) and examining every aspect of the issue. Make sure you understand the who, what, when, where, why, and how of the problem at hand. The goal here is to leave no stone unturned as you seek to determine the root cause of the issue.
Remember to document all your findings while you work, as this will leave you with an important record of how you came to your final determination of the root cause.
9. Determine a root cause of the CAPA
Determining a root cause is the ninth step for a reason. All too often, medical device companies will skip straight to this step, ignoring the earlier process and documentation-oriented steps.
It's understandable that you'll want to get to the bottom of a systemic issue quickly. But by immediately jumping into a root cause determination, many companies simply restate the problem in different language, rather than finding the root cause. Without a well-documented and thorough investigation, you risk never finding and fixing the root cause of the problem that triggered your CAPA. And that means you'll probably be opening another CAPA for the same issue in the near future.
There are a number of tools and techniques you can use to determine a root cause, such as a fishbone diagram, a fault tree, or the 5 Whys method. All have their pros and cons, so take some time to figure out which root cause analysis is best for your situation.
10. Develop an action plan for your CAPA
This step should shed some light on why it's so important to determine the root cause of the issue.
At this point of the CAPA process, you're laying out the series of actions you'll take to correct the problem and/or prevent it from happening again. If you haven't correctly identified the root cause, you may come up with a number of actions that really amount to busy work. In other words, your action plan is only as good as your root cause determination.
Your action plan should include specific steps you will take as an organization, as well as deadlines for completing those steps. Again, there is no one timeline that works for every CAPA, but you don't want to let it drag out any longer than necessary.
Your action plan should demonstrate that you understand the importance of closing the CAPA in a timely manner and that you have a process in place to do so.
11. Complete the action plan
Here, you're simply taking the actions you previously identified. This may include updating your CAPA procedures, redesigning processes, or even adding an inspection step.
As with every other step in your CAPA process, be sure that you are thoroughly documenting these actions and keeping your records easily accessible for both internal stakeholders and auditors.
Not only does this help keep you compliant with regulations, it also helps ensure that the changes you've made within the organization will stick. After all, this isn't just about compliance. This is about making sure your methods and procedures reflect a commitment to True Quality.
12. Review CAPA for completeness
In this step, the CAPA goes back to the cross-functional team and the MRB or Quality Review Board to assess whether it has been satisfactorily completed. If not, you may need to repeat steps in the CAPA process, such as determining the root cause or developing an action plan.
If the reviewers decide the CAPA has been completed to their satisfaction, then it moves on to step 13.
13. Approve CAPA actions
This step requires those with oversight to sign off on the CAPA investigation and outcomes. This should only happen if they feel the investigation and the actions taken have been successfully corrected and/or prevented the systemic issue that triggered the CAPA.
14. Specify steps for effectiveness verification
It does feel as though step 13 should be the final step, but that isn't the case. Many companies do end their CAPA process there, but by doing so, they're missing a crucial part of the process: verification.
Yes, you still need to make sure that the actions you took were effective. They may have sounded good on paper, and they may have been given the thumbs up by the reviewers, but that doesn't mean they necessarily worked.
In this step you define the effectiveness verification: the specific evidence that will prove the actions worked, who will collect it, and when. For example, if you added an inspection step, you'll need to confirm that the extra step has prevented the issue from recurring. So, you'll need to plan verification activities that prove this is the case.
Remember to capture all your verification activities during this stage in your quality system as well as which items of your action plan they correspond with.
15. Verify the effectiveness of the CAPA
The final step is effectiveness verification: confirming that the corrective and preventive actions you took resolved the systemic issue that triggered the CAPA. If you set up your verification activities properly in the previous step, you'll simply need to document the outcomes and assess them.
And if you've followed your process every step of the way, there's a good chance that your actions have proven effective and you can close the CAPA.
How the 15 steps map to the 7-step CAPA model
Most published CAPA models use seven steps: identify the problem, evaluate risk, investigate, find the root cause, plan corrective and preventive actions, implement them, and verify effectiveness. Our 15 steps cover the same ground; they split the review, approval, and verification work into separate records so that each decision has an owner and a date. Steps 1 to 4 are the seven-step model's "identify and evaluate," steps 5 to 9 are "investigate and find the root cause," steps 10 and 11 are "plan and implement," and steps 12 to 15 are "verify effectiveness" with the approvals an auditor will ask to see. If your quality system already uses a seven-step procedure, you do not need to rewrite it; check that the review and verification records exist.
CAPA is not a Six Sigma tool, although Six Sigma root cause methods such as the 5 Whys, fishbone diagrams, and fault tree analysis are the usual choices in steps 8 and 9. CAPA is a quality management system requirement under ISO 13485 and FDA's QMSR, and it applies whether or not a company uses Six Sigma.
NOTE: For a deeper dive into all things CAPA, check out our Ultimate Guide to Corrective and Preventive Action (CAPA)
FREE RESOURCE: Click here to download your own PDF copy of the full CAPA Process Infographic.
What FDA and ISO 13485 require of your CAPA process
Since February 2, 2026, FDA's Quality Management System Regulation (QMSR) has incorporated ISO 13485:2016 by reference, so the CAPA requirements a US medical device company must meet are the standard's corrective action and preventive action clauses (8.5.2 and 8.5.3). In practice that means a documented procedure that reviews nonconformities and complaints, determines causes, evaluates the need for action, plans and implements it, verifies that the action did not adversely affect the device, and reviews effectiveness. Every one of those activities has to be recorded, which is why the 15 steps above put a record behind each decision. The old 21 CFR 820.100 language that many CAPA procedures still quote no longer exists in Part 820; procedures that cite it should be updated to reference the QMSR and the ISO 13485 clauses.
How to make your CAPA process risk-based
A complete CAPA procedure is not enough on its own. ISO 13485 expects corrective and preventive action to be risk-based: you open CAPAs for the right issues, prioritize by severity and probability of harm, and keep the records tied to your broader risk management process. The points below preserve the practical guidance from our former 13-step risk-based CAPA article and fit it into this 15-step process.
Feed CAPA from many quality inputs
CAPA should be the heart of your QMS, not a single-source queue. Complaints, nonconformances, audits, production data, and post-market signals (including competitor events you monitor in sources such as MAUDE) should all be able to raise a request. Multiple inputs are how you catch preventive actions before a corrective action is forced on you.
Use risk to decide when to open a CAPA
Not every incident should become a CAPA. Use systemic patterns and significant severity as the filter. Issues that could lead to significant harm should open a CAPA immediately; lower-severity one-offs may belong in nonconformance, complaint, or risk management processes instead. There is no FDA "rule of three." Opening a separate CAPA for every minor repeat of the same symptom creates backlog; one CAPA that investigates the pattern is usually the better risk-based move.
Use the right risk language
In medical devices, "risk" follows ISO 14971, not the ISO 9001 definition. Prefer "control" over "mitigation": risk is reduced and monitored, not eliminated. When you score issues that may become CAPAs, separate P1 (probability of a hazardous situation occurring) from P2 (probability that the hazardous situation leads to harm). Process validation often informs P1; post-market surveillance is usually the more reliable source for P2.
Contain in parallel, plan in writing, and monitor what stays open
While investigation runs (steps 7 to 9 above), containment must already be stopping further exposure. ISO 13485 also expects planning and documentation for corrective and preventive actions; the action plan in steps 10 and 11 is that record. After approval, monitor open CAPAs (for example, count of open CAPAs versus days open) so effectiveness verification in steps 14 and 15 is based on data, not hope. Inspection depth and process validation decisions used as risk controls should themselves be risk-based.
Adopt a purpose-built solution to help you manage the CAPA process
A good CAPA process relies heavily on thorough investigation and documentation. When patient safety is at stake, you really can't afford to do it any other way.
But it does raise some challenges. Imagine having two or three CAPAs going at once. How would you keep track of them all and ensure you're taking action in a timely manner?
With a paper-based quality management system (QMS), that burden rests entirely on your team's shoulders. They're forced to navigate and find information within any number of disconnected and generic tools.
That is one of the reasons we built a dedicated CAPA management workflow into the Greenlight Guru QMS. The 15 steps are configured in the platform on day one, each CAPA is linked to the complaint, nonconformance, or audit finding that triggered it, and the effectiveness verification record closes the loop. A risk-based CAPA system in a connected QMS is what keeps the process both effective and compliant.
If you are ready for that kind of visibility into your CAPAs, get your free demo of Greenlight Guru today.
CAPA Management Software for Medical Devices
