Why CAPA Fails: Recurring Quality Problems in FDA Warning Letters

1. Executive Summary

The corrective and preventive action (CAPA) system is the operational core of a quality management system (QMS) in the medical device and pharmaceutical industries. It is meant to be a self-correcting mechanism that identifies, investigates, and remediates quality problems so they do not recur. However, a review of U.S. Food and Drug Administration (FDA) warning letters issued between 2017 and 2026 shows that CAPA deficiencies remain among the most frequent and serious areas of noncompliance. This report investigates why CAPA systems so often fail to prevent recurring quality problems.

The study reviews FDA warning letters across medical devices, drugs, and biologics. By examining the specific violations cited, it identifies systemic patterns of failure in CAPA triggers, root cause analysis (RCA), verification of effectiveness (VoE), investigation scope, and the integration of post-market data with risk management.

The findings point to five major failure modes. First, firms fail to open CAPAs when quality thresholds or complaint trends call for them, leaving systemic risks unaddressed. Second, root cause analysis is often superficial, defaulting to “operator error” or skipping manufacturing reviews when laboratory investigations are inconclusive. Third, verification of effectiveness is omitted, poorly documented, or done without statistical rationale, leading to premature closure. Fourth, investigations are rarely extended to other batches or related products, producing local, temporary fixes instead of systemic remediation. Fifth, firms rely on retraining and procedure revisions as standalone corrective actions, without addressing underlying process, equipment, or design flaws.

The principal conclusion is that CAPA failures are not isolated procedural omissions but symptoms of deeper organizational and cultural problems: a “check-the-box” mindset, siloed quality data, and weak links between post-market surveillance, risk management, and design controls. The FDA’s move to the Quality Management System Regulation (QMSR) on February 2, 2026, which aligns 21 CFR Part 820 with ISO 13485:2016, raises the bar for risk-based, integrated CAPA.

For manufacturers, the implication is to move from reactive, local corrections to proactive, integrated, data-driven quality management. That means quantitative triggers for opening CAPAs, scientifically rigorous RCA, objective evidence of effectiveness, and independent review of remediation. A successful CAPA system is a continuous improvement loop that feeds back into risk analysis and design.

2. Introduction

Background and Context

In medical device and pharmaceutical manufacturing, the integrity of the QMS is essential to patient safety and product effectiveness. Under the FDA’s legacy Quality System Regulation (21 CFR 820.100) and the Quality Management System Regulation, effective February 2, 2026, device manufacturers must establish and maintain procedures for corrective and preventive action. Drug manufacturers have parallel obligations under 21 CFR Part 211. CAPA is the main vehicle for continuous improvement, letting firms systematically address nonconformities, complaints, and other quality problems.

The FDA uses warning letters to notify firms of significant violations, such as noncompliance with current good manufacturing practice (CGMP) or quality system requirements. Firms are generally expected to respond within 15 working days, describing the steps taken to correct the violations and prevent recurrence. Under the FDA’s close-out letter program, which covers letters issued on or after September 1, 2009, the FDA may issue a close-out letter once it has verified that the violations have been addressed, usually through a follow-up inspection. Despite these pathways and the consequences of noncompliance (including seizures, injunctions, civil money penalties, and import detentions), CAPA deficiencies continue to appear in FDA findings year after year.

Problem Statement and Research Questions

Despite a mature regulatory framework, firms consistently struggle to execute effective CAPAs. The result is recurring quality problems: the same deviation, contamination, or defect happening again after CAPAs have been closed. This report addresses the following questions:

1. Why do established CAPA systems fail to prevent recurring quality problems in FDA-regulated facilities?
2. What are the main failure modes in root cause analysis and verification of effectiveness?
3. How does failing to extend investigations to other batches, or to bring post-market data into risk management, undermine CAPA?
4. What does the 2026 transition to the QMSR mean for CAPA compliance?

Objectives and Scope

The objective is an evidence-based analysis of CAPA failures using FDA warning letters from 2017 to 2026. The scope includes:

• Systemic patterns of CAPA effectiveness deficiencies.
• The depth of root cause analysis and the validity of effectiveness checks.
• The impact of inadequate investigation scope on product quality and patient safety.
• The limits of corrective actions that rely on retraining and procedure revisions.
• A framework for building robust, integrated CAPA programs under the QMSR.

Theoretical Framework

This analysis draws on quality management theory, specifically the Plan-Do-Check-Act (PDCA) cycle and risk-based decision-making. In an ideal QMS, CAPA represents the “Check” and “Act” phases, where performance data are evaluated and systemic changes made. A failed CAPA is a breakdown in this feedback loop, often caused by a disconnect between quality data analysis (the inputs) and risk management and design controls (the outputs).

3. Literature Review & Analysis

Theme 1: Failure to Initiate CAPAs (The Trigger Problem)

A fundamental failure mode is not opening a CAPA when quality data call for one. Under 21 CFR 820.100(a)(1), device manufacturers had to analyze quality data sources, including complaints, nonconformances, and service records, to identify existing and potential causes of nonconforming product. Yet firms often tolerate repeated quality problems without escalating them to a formal CAPA.

For example, Happiest Baby, Inc. did not open a CAPA for eighteen complaints that its SNOO sleep sacks were too big for infants. Royal Philips did not open CAPAs for 9 complaint investigations into transducer fluid ingress and corrosion, three of which were associated with Medical Device Reports (MDRs). iRhythm Technologies did not initiate a CAPA although FDA’s inspection confirmed 39 examples of inaccessible patient electrocardiogram (ECG) data. And Meridian Bioscience, whose Magellan Diagnostics site makes the LeadCare II blood lead test, did not open a CAPA for approximately 179 patient false-positive complaints. These cases show firms treating recurring, high-volume complaints as isolated events instead of as a trigger for CAPA.

Theme 2: Deficiencies in Root Cause Analysis (RCA)

Once a CAPA is opened, its success depends on the rigor of the root cause analysis. Under 21 CFR 820.100(a)(2), firms had to investigate the causes of nonconformities relating to product, processes, and the quality system. A robust RCA evaluates all potential sources of failure and explains the scientific basis for ruling each out. Common deficiencies include not reviewing relevant records, not analyzing isolates or failed parts, and ignoring physical facility or equipment problems.

When an out-of-specification (OOS) result or complaint investigation has no identified laboratory cause, drug manufacturers are expected to review production thoroughly, including batch records, raw materials, process capability, equipment, and deviation history. Instead, firms often close CAPAs without a root cause or default to “operator error” without examining the underlying conditions. For instance, JAS Diagnostics/Drew Scientific closed CAPA 19-010 without a root cause and CAPA 19-012 without completing the investigation. Phillips Precision did not adequately investigate the root cause of blades received with metal debris under CAPA 1175. And in its January 2024 warning letter to Fresenius Kabi, covering the Ivenix Infusion System made at Fresenius Kabi USA, the FDA noted that no further root cause investigation was documented for a software bug under CAPA-00040.

Theme 3: Verification of Effectiveness (VoE) Failures

Verification of effectiveness is a core requirement: under 21 CFR 820.100(a)(4), manufacturers had to verify or validate corrective and preventive actions to ensure they are effective and do not adversely affect the finished device. Yet firms routinely close CAPAs as effective without any documented check, or with flawed methods.

A common deficiency is closing a CAPA on the same day as training, treating training completion as the only evidence of effectiveness. Dongguan Microview closed CAPA No. 20190122001, about missing product acceptance labels, after implementation and same-day training. ZYTO Technologies had six CAPA records whose effectiveness columns were blank or marked “ongoing work.” In other cases, firms do not set success criteria or a statistical rationale: Kabe Labortechnik had no statistical rationale for the effectiveness check under CAPA 23G4429-1.

Firms also close CAPAs even when post-action data show the problem persists. Medline Industries closed CAPA-01872 on syringe disconnections even though complaint rates remained above its threshold, acknowledging that the action had not been effective. Nipro Renal Solutions saw out-of-specification endotoxin results recur after the corrective actions under CAPA-25012.

Theme 4: Inadequate Scope and Impact Assessment (“Other Batches”)

Under 21 CFR 211.192, drug manufacturers must thoroughly investigate any unexplained discrepancy or failure of a batch to meet specifications, and the investigation must extend to other batches of the same drug product and other drug products that may have been associated with the failure. Failing to do this is a major driver of recurring problems, because systemic manufacturing failures get treated as isolated batch incidents.

Glenmark Pharmaceuticals, Aurobindo Pharma, and Shree Jaya Laboratories were all cited for not extending investigations of rejected batches or complaints to other batches. Glenmark, for example, rejected 14 batches for content uniformity failures it attributed to compression parameters, but did not test other batches made on the same compression equipment. Other firms released batches despite contamination or out-of-trend (OOT) results in related batches. Zydus Lifesciences released batches with “not detected” cross-contamination results despite OOT contamination in related batches. OsteoLife Biomedical distributed bone allograft batches from donors whose other batches tested positive for organisms such as Bacillus and Stenotrophomonas maltophilia. EyePoint Pharmaceuticals continued to manufacture and release YUTIQ batches after a release-rate failure, without completing investigations into whether other batches were affected.

Theme 5: Over-reliance on Retraining and Procedure Revisions

When choosing corrective actions, firms consistently default to retraining staff or revising procedures. The FDA has repeatedly said this is not enough on its own. In a 2025 device warning letter, it wrote that a focus on training alone does not substitute for implementing actual validation processes; in a drug warning letter to Lupin, it noted that the firm’s CAPAs had often been limited to retraining analysts. Retraining is also unconvincing without supporting evidence, such as competency assessments or post-training evaluations showing that people can do the work correctly, and a documented training plan.

Revising a procedure does not guarantee compliance either, especially when document control is weak under 21 CFR 820.40. A common failure is a mismatch between the procedures in use and their approved versions. At TALON, an S & S Technology Company, the online version of the engineering change control procedure was dated 2016 while the last approved version was dated 2006. Firms also submit revised procedures that remain deficient: Sol-Millennium Medical, Rontis Hellas, and iRhythm Technologies revised their MDR procedures, but the revisions still omitted key elements such as the definition of “reasonably suggests” or instructions for completing FDA Form 3500A.

Theme 6: Failure to Integrate Post-Market Data and Risk Management

A critical gap is the disconnect between post-market complaint data, risk management, and CAPA. Under ISO 13485:2016 and the legacy design control requirements in 21 CFR 820.30, manufacturers must maintain risk management that reflects post-market experience. When risk documentation is not updated with complaints, recalls, or relevant safety data from similar devices, the CAPA system works from outdated hazard estimates.

Beta Bionics did not incorporate complaints about printed circuit board assembly failures and insulin over-infusion into its system risk analysis. Nipro Renal Solutions had not updated its MedicaLyte risk analysis since November 2020, despite a Class I recall initiated in April 2025. Royal Philips did not evaluate a competitor’s MDR concerning a patient death. Koven Technologies did not evaluate risks to the fetus for its fetal dopplers. And Anigan had not conducted a risk analysis for its menstrual cups, leaving risks such as biocompatibility, placement, and use with an intrauterine device (IUD) undocumented. These gaps keep the CAPA system from prioritizing investigations by actual clinical risk.

4. Data Analysis & Results

Quantitative Findings

The following tables compile data from FDA warning letters issued between 2017 and 2026. Firm names link to the letters on the FDA website.

Table 1: Key FDA Warning Letters and CAPA/Quality System Deficiencies

Table 2: Common Root Cause Analysis and Verification of Effectiveness Failures

Table 3: Complaint Backlogs and Quality Data Analysis Failures

Qualitative Analysis and Thematic Coding

Coding the warning letters shows that CAPA failures cluster around three organizational behaviors:

1. Siloed quality systems: complaint handling, deviation management, and risk management operate separately instead of feeding the CAPA system, which prevents holistic analysis of quality data.
2. Lack of objective evidence: firms close CAPAs without documenting objective evidence that the actions worked and did not introduce new risks.
3. Inadequate retrospective reviews: when systemic failures are found, firms propose narrow reviews. The FDA often asks for retrospective reviews covering the last three years, for example of invalidated OOS results in its 2024 letter to Viatris and of critical investigations in its 2026 letter to Medline Inc..

Trends: The 2026 QMSR Transition

The transition from the legacy QS regulation to the QMSR on February 2, 2026 aligns Part 820 with ISO 13485:2016. This has direct implications for CAPA:

• Risk-based CAPA: under ISO 13485, corrective action must be appropriate to the effects of the nonconformities. High-risk problems call for comprehensive CAPAs; low-risk issues may be handled with local corrections.
• Supplier controls: corrective actions should reach suppliers where the cause lies there, through supplier controls and quality agreements.
• Corrective actions under the QMSR: warning letters issued after the effective date state that corrective actions must meet the QMSR, as in the April 2026 letter to Unetixs Vascular. Devices made under nonconforming quality systems are adulterated under section 501(h) of the FD&C Act.

5. Discussion

Interpretation of Findings

The evidence shows that CAPA failures are rarely caused by missing procedures; they come from not carrying out procedures with scientific and technical rigor. Recurring quality problems point to a conflict between throughput and quality oversight, which shows up in several ways:

• A “check-the-box” culture: firms close CAPA files to meet internal KPIs rather than solve technical problems. At JAS Diagnostics/Drew Scientific, CAPA 19-011 was closed because the responsible employees were no longer with the company, abandoning the effectiveness check.
• The retraining trap: blaming human error and prescribing retraining is quick and cheap, but human error is usually a symptom of deeper problems, such as poor interface design, inadequate lighting, or confusing procedures.
• Fragmented data: without integrated quality data analysis, firms miss trends. Beta Bionics used redundant complaint codes (“Use Error – User Did Not Announce Meals” and “User Error – Did Not Announce Meals”), which split the data and obscured the true rate of the problem.

Theoretical Implications

From a systems perspective, a CAPA failure is a broken feedback loop. A control loop needs accurate sensors (quality data analysis), an effective processor (root cause analysis), and a working actuator (corrective action and effectiveness verification). If effectiveness is not verified, the actuator is unchecked and nonconformities recur. Risk management must also be dynamic: treating the risk file as a static design-phase document rather than a living file updated with post-market data runs against ISO 13485:2016 and the QMSR.

Practical Applications

To fix these systemic failures, firms should adopt modern, data-driven practices:

• Automation: automated inspection and testing reduce reliance on manual operations and produce objective records.
• Independent assessment: FDA warning letters often ask firms to engage a qualified consultant to assess their CAPA, documentation, and change management systems. Independent review helps keep effectiveness checks free of internal bias.
• AI and machine learning: AI can support predictive quality and automated trending, but AI functions in medical devices must have the appropriate FDA marketing authorization. FDA has issued warning letters for marketing unauthorized software functions, including to SeniorLife Technologies, Exer Labs, and RadLogics.

Limitations and Alternative Explanations

This study relies on public FDA warning letters, which represent the most serious cases of noncompliance, so it may over-represent firms with weak quality cultures. Some CAPA delays may have other explanations: LeMaitre Vascular, for example, took 216 days to implement a medium-risk CAPA, and supply chain disruptions or supplier engineering changes can lengthen remediation even when a firm acts in good faith. Even so, manufacturers remain responsible for supplier oversight and for interim controls that reduce risk during long remediation periods.

6. Conclusions

Answers to Research Questions

1. Why do CAPA systems fail to prevent recurrence? Because they are run as isolated administrative exercises rather than integrated scientific investigations. Firms lack robust triggers, perform superficial RCA, skip rigorous effectiveness checks, and do not extend investigations to other batches or related products.
2. What are the main failure modes in RCA and VoE? RCA failures rely on “operator error” and skip manufacturing reviews when laboratory causes are inconclusive. VoE failures involve closing CAPAs prematurely, often on the day of training, without statistical rationale or objective evidence of lasting effectiveness.
3. How do inadequate scope and risk integration undermine CAPA? Not evaluating other batches lets defective products stay on the market. Not bringing post-market data into risk management means CAPA works from outdated risk estimates and fails to prioritize high-risk hazards.
4. What does the QMSR transition mean? The QMSR calls for a risk-based approach to CAPA and tighter integration with supplier controls. Corrective actions after February 2, 2026 must meet the QMSR, and devices made under nonconforming quality systems are adulterated.

Key Contributions

This report brings together CAPA failure modes from a decade of FDA warning letters, through the 2026 QMSR transition. By linking specific citations to systemic quality system gaps, it offers a diagnostic framework that professionals can use to evaluate and improve their own systems.

Recommendations for Industry

1. Set quantitative CAPA triggers: define statistical thresholds for complaint and deviation trends that require a formal CAPA, reducing subjective decisions.
2. Require scientific root cause analysis: do not accept “operator error” as a standalone root cause. Require a full review of production, materials, and equipment whenever a laboratory investigation is inconclusive.
3. Use a two-phase effectiveness check: verify implementation in the short term (for example with competency assessments, not just training records), and monitor quality data over the longer term to show the problem has not recurred.
4. Make scope expansion standard: build an “other batches and related products” impact assessment into deviation and CAPA templates.
5. Link risk management to post-market data: have every closed CAPA and every significant complaint trend trigger a review of the risk management file and design FMEA.
6. Use independent auditing: have independent reviewers periodically audit the CAPA and document control systems, including whether the procedures in use match the approved versions.

Future Research Directions

Future research should examine the long-term effect of the 2026 QMSR transition on compliance, including whether ISO 13485’s risk-based approach reduces recurring quality problems in FDA inspections. Further study is also needed on validation and regulatory pathways for AI-driven trending tools in QMS software.