Why the CAPA system gets audited first
When auditors or inspectors want to know whether a quality system works, they look at CAPA. It shows whether the organization detects problems, understands their causes and fixes them for good. It is also where enforcement concentrates: an analysis of FDA’s FY2025 data found inadequate CAPA procedures were the most cited device observation (GMP Insiders), and Hogan Lovells notes that “CAPA deficiencies are often the tipping point for escalation to warning letters” (Hogan Lovells).
For device makers, two 2026 changes raise the stakes. FDA’s new inspection approach under the QMSR groups corrective and preventive action under “Measurement, Analysis, and Improvement” (FDA), and internal audit reports are no longer shielded from FDA review because the QMSR dropped the old 820.180(c) exception (FDA QMSR FAQ). A CAPA audit report may now be read by an investigator.
For a ready-to-use effectiveness check template, see CAPA Effectiveness Check Template for Medical Device and GMP Teams.
What a CAPA audit looks at
| Area | Questions auditors ask |
|---|---|
| Inputs | Do complaints, deviations, nonconformances, audits, returns and trends all feed CAPA? Are data sources analyzed together? |
| Decision criteria | Are there documented, risk-based criteria for opening a CAPA? Are they followed? |
| Investigation | Is the root cause supported by evidence? Was the scope assessed beyond the triggering event? |
| Actions | Do actions address the root cause, not just the symptom? Were they verified or validated before implementation? |
| Timeliness | Are CAPAs completed on time? Are delays justified? |
| Effectiveness | Were effectiveness criteria defined in advance and checked with data? |
| Recurrence | Do the same problems keep returning? |
| Management oversight | Is CAPA status reviewed in management review, with resources assigned? |
The recurrence question is often the most revealing. FDA’s quality surveillance staff ask, “Recurring issues may indicate poor root cause analysis and/or effectiveness?” (FDA OQS). In a January 2026 device warning letter, FDA found the firm had “closed these complaints without investigation” and that the firm “failed to implement corrective and preventive actions (CAPA) for complaints related to device malfunctions” (FDA warning letter, Beta Bionics).
Designing effectiveness checks that prove something
An effectiveness check confirms that a CAPA achieved its objective and did not create new problems. ICH Q10 expects that “the effectiveness of the actions should be evaluated” (ICH Q10). The GHTF guidance on CAPA adds that “The manufacturer should gather data over a period of time related to the effectiveness of the implemented action,” and “If the manufacturer finds the actions are not effective, the manufacturer should re-initiate Phase III activities” (GHTF SG3 N18:2010).
| Weak effectiveness check | Strong effectiveness check |
|---|---|
| ”Training completed" | "Zero recurrences of label mix-up in 3 months of production (minimum 40 lots), verified by line clearance records" |
| "Procedure revised" | "Deviation rate for step 7 below 0.5% over 6 months, compared with 3% baseline" |
| "No complaints received” (without volume context) | “Complaint rate for failure mode X below 2 per 10,000 units over 2 quarters, from 9 per 10,000” |
Good checks share four features: criteria defined before implementation, a measurable indicator tied to the root cause, a time window or sample size large enough to detect recurrence, and a named reviewer. FDA’s quality surveillance also asks of field alert investigations: “Does the FAR/BPDR include effectiveness checks for the proposed CAPA?” (FDA OQS).
How to run a CAPA audit
- Pull a risk-based sample of open and closed CAPAs, weighted toward high-risk products and repeat issues.
- Trace each CAPA end to end from source record to closure and effectiveness result.
- Test the root cause against the evidence in the file.
- Check for recurrence by searching complaint, deviation and nonconformance data after closure.
- Review timeliness and overdue items, including justification for extensions.
- Look across CAPAs for systemic patterns, such as retraining as the default action.
- Write findings with requirement, evidence and gap, knowing the report may be read by FDA.
- Follow up to confirm audit findings are themselves corrected effectively.
CAPA audit checklist
- CAPA procedure current with QMSR / ISO 13485 or 21 CFR 211 and ICH Q10 expectations
- All quality data sources feed the CAPA process
- Risk-based criteria for opening CAPAs exist and are applied consistently
- Sampled investigations show evidence-based root causes and scope assessment
- Actions address root causes and were verified before implementation
- Effectiveness criteria defined in advance and measured with data
- No unexplained recurrence after closure
- Overdue CAPAs tracked, escalated and justified
- Retraining-only and human-error closures reviewed critically
- CAPA metrics reviewed in management review
- Audit report written to be inspection-ready
Audit CAPA records faster, with evidence
A thorough CAPA audit means reading dozens of records end to end. AskDona can do the first pass: it reviews CAPA files against your procedure and ISO 13485, 21 CFR or ICH Q10 expectations, flags unsupported root causes, missing scope assessments and weak effectiveness checks, and cites the passage behind every finding, so auditors can focus on sampling and interviews.
Run a sample CAPA audit assessment on a batch of closed CAPAs. AskDona shows the evidence; your auditors decide.
FAQ
What is a CAPA audit? An evaluation of whether a CAPA system meets requirements and actually prevents recurrence, usually by sampling CAPA records end to end.
What is a CAPA effectiveness check? A planned verification, using predefined measurable criteria, that a CAPA achieved its objective without causing new problems.
How long should an effectiveness check run? Long enough to detect recurrence given how often the problem occurred; GHTF guidance calls for data “over a period of time” (GHTF).
Is training a valid effectiveness check? Completion of training shows the action happened, not that it worked. Measure the outcome.
Can FDA read CAPA audit reports? For device makers under the QMSR, internal audit reports are no longer exempt from FDA review.
References
All pages opened and checked by October 13, 2026.
| Source | Type | Date | Used for |
|---|---|---|---|
| GMP Insiders: FY2025 observations | Trade analysis | Jan 5, 2026 | CAPA citations |
| Hogan Lovells: Device inspections in 2025 | Law firm | Sep 18, 2025 | Escalation |
| FDA: QMSR risk-based inspections | Regulator | Apr 1, 2026 | MAI area |
| FDA: QMSR FAQ | Regulator | Oct 2, 2026 | Audit records access |
| FDA OQS: PQS effectiveness | Regulator presentation | c. 2023 | Recurrence, effectiveness checks |
| FDA warning letter: Beta Bionics | Regulator | Jan 28, 2026 | Complaints to CAPA |
| ICH Q10 (FDA) | Guideline | Apr 2009 | Effectiveness |
| GHTF SG3 N18:2010 | Guidance | Nov 4, 2010 | Effectiveness data |