What CAPA means
CAPA stands for corrective and preventive action. It is the quality system process for finding out why something went wrong, fixing the cause so it does not happen again (corrective action), and acting on signs that something could go wrong before it does (preventive action). In regulated industries such as pharmaceuticals, biologics and medical devices, CAPA is the engine of the quality system: complaints, deviations, audit findings, nonconformances and trends all feed into it.
ICH Q10, the pharmaceutical quality system guideline adopted by FDA, describes it plainly: “The pharmaceutical company should have a system for implementing corrective actions and preventive actions resulting from the investigation of complaints, product rejections, nonconformances, recalls, deviations, audits, regulatory inspections and findings, and trends” (ICH Q10, FDA). It adds that “CAPA methodology should result in product and process improvements and enhanced product and process understanding.”
| Term | Meaning | Example |
|---|---|---|
| Correction | Immediate fix of the specific problem | Quarantine and rework a nonconforming lot |
| Corrective action | Action to remove the cause of an existing problem and prevent recurrence | Redesign a fixture that caused misassembly |
| Preventive action | Action to remove the cause of a potential problem before it occurs | Add a sensor after a trend shows drift toward a limit |
What the main frameworks require
| Framework | CAPA requirement | Notes |
|---|---|---|
| Drugs: 21 CFR 211.192 | Unexplained discrepancies “shall be thoroughly investigated, whether or not the batch has already been distributed” (eCFR) | ICH Q10 adds the CAPA system expectation |
| Medical devices: QMSR (21 CFR 820) | FDA “has incorporated the corrective action and preventive action requirements of ISO 13485 by reference into the QMSR” (Federal Register) | Effective February 2, 2026; former 820.100 no longer exists |
| ISO 13485:2016 clauses 8.5.2 and 8.5.3 | Separate corrective and preventive action procedures, proportionate to the effects of nonconformities, with verification that actions do not adversely affect regulatory compliance or device safety and performance | The standard itself is paywalled; check your licensed copy |
| ISO 9001:2015 and 2026 | No separate preventive action clause; “Preventive action is built-in when a management system is risk-based” (ISO/TC 176 guidance) | ISO 9001:2026 was published September 16, 2026 (ISO) |
ICH Q10 also sets two principles that apply everywhere: “A structured approach to the investigation process should be used with the objective of determining the root cause,” and “The level of effort, formality, and documentation of the investigation should be commensurate with the level of risk, in line with ICH Q9” (ICH Q10, FDA).
Why CAPA compliance matters: the enforcement data
CAPA is one of FDA’s most cited areas. An analysis of FDA’s fiscal year 2025 inspection observation data by GMP Insiders found that 21 CFR 820.100(a), inadequate CAPA procedures, was the most cited device observation with 279 citations, and that 21 CFR 211.192, failure to thoroughly investigate discrepancies, was the second most cited drug observation with 164 (GMP Insiders). Hogan Lovells put it bluntly: “CAPA remains the most frequently cited issue,” and “CAPA deficiencies are often the tipping point for escalation to warning letters” (Hogan Lovells).
The pattern continues under the new device rule. In early QMSR inspections, a CDRH official said “Risk management is the top observation,” and “Violations tied to corrective actions rank fourth on the list” (RAPS). FDA has also stopped using the QSIT technique; under the new compliance program, corrective and preventive action sit within the “Measurement, Analysis, and Improvement” area (FDA).
The CAPA process, step by step
- Identify and record the problem from its source: complaint, deviation, audit, nonconformance, trend or inspection finding.
- Assess risk and decide whether a CAPA is needed, using defined criteria so the decision is consistent.
- Contain and correct the immediate problem, such as quarantining product.
- Investigate the root cause with a structured method proportionate to risk.
- Plan actions that address the root cause, with owners and due dates.
- Verify or validate that the actions do not create new problems, including for device safety and performance.
- Implement the actions, including procedure changes and training.
- Check effectiveness with measurable criteria over a defined period.
- Close and feed back results into trending and management review.
Common CAPA failures inspectors find
- Root causes that stop at “human error” without evidence. FDA has criticized firms that “attributed the root cause” to human error while earlier CAPAs proved “ultimately ineffective” (FDA warning letter, Medgel).
- Investigations that lack depth: “your investigation was not sufficient to adequately determine root cause(s)” (FDA warning letter, Glenmark).
- CAPAs that are not timely: “Your response is inadequate because your CAPA was not timely” (FDA warning letter, Apotex).
- Retraining as the only action, without addressing system causes.
- Closure without a real effectiveness check.
CAPA compliance checklist
- CAPA procedure covers all quality data sources and defines when a CAPA is required
- Risk-based criteria set investigation depth and urgency
- Root cause method documented and evidence-based
- Corrections, corrective actions and preventive actions distinguished
- Actions verified or validated before implementation
- Effectiveness checks have measurable criteria and timeframes
- CAPA timeliness tracked and overdue items escalated
- CAPA data trended and reviewed in management review
- Procedures reference current requirements (QMSR and ISO 13485 clauses, ISO 9001:2026)
Check CAPA records with cited evidence
CAPA records are where inspectors look first. AI document assessment can review CAPA records and investigation reports against your procedure, ISO 13485, 21 CFR 211.192 or ICH Q10 expectations, flag unsupported root causes or missing effectiveness checks, and cite the passage behind every finding.
Run a sample CAPA record assessment on one closed CAPA. AskDona shows the evidence; your quality team decides.
FAQ
What does CAPA stand for? Corrective and preventive action.
What is the difference between corrective and preventive action? Corrective action removes the cause of an existing problem; preventive action removes the cause of a potential problem before it happens.
Is CAPA required by FDA? Yes. Drug makers must investigate discrepancies under 21 CFR 211.192, and device makers must meet ISO 13485’s CAPA requirements under the QMSR.
Does ISO 9001 still require preventive action? Not as a separate clause; since 2015 it is addressed through risk-based thinking.
Why is CAPA cited so often? Because weak investigations and ineffective actions let problems recur, and inspectors see the evidence in records.
References
All pages opened and checked by October 13, 2026.
| Source | Type | Date | Used for |
|---|---|---|---|
| ICH Q10 (FDA) | Guideline | Apr 2009 | CAPA system, root cause, risk |
| eCFR: 21 CFR 211.192 | Regulation | Current | Drug investigations |
| Federal Register: QMSR final rule | Regulator | Feb 2, 2024 | ISO 13485 CAPA incorporation |
| ISO/TC 176: ISO 9001:2015 and risk | Standards committee document (hosted copy) | 2015 | Preventive action |
| ISO: ISO 9001:2026 news | Standards body | Sep 16, 2026 | New edition |
| GMP Insiders: FY2025 observations | Trade analysis | Jan 5, 2026 | Citation counts |
| Hogan Lovells: Device inspections in 2025 | Law firm | Sep 18, 2025 | CAPA enforcement |
| RAPS: Top QMSR observations | Professional body | May 14, 2026 | QMSR findings |
| FDA: QMSR risk-based inspections | Regulator | Apr 1, 2026 | CP 7382.850 |
| FDA warning letter: Medgel | Regulator | Jul 20, 2023 | Human error |
| FDA warning letter: Glenmark | Regulator | Jul 11, 2025 | Root cause |
| FDA warning letter: Apotex | Regulator | Oct 31, 2025 | Timeliness |