CAPA and non-conformities: addressing the cause without turning every deviation into a quality project
A non-conformity comes up: an out-of-specification lot, a complaint, a finding in an audit. The temptation is to open a CAPA and tick boxes until it is closed. A good system does the opposite: it distinguishes the deviation you correct from the systemic problem you investigate, and it keeps what you need to prove that the action worked. Here is what the regulations expect, and what you need to put in place.
What do the regulations require?
No text requires a CAPA for every deviation. What they ask is that you control the non-conformity, address its cause when that is warranted, and verify that the action had its intended effect. Three words come up and are often confused, so let's define them first.
- Correction
- An action that deals with the observed non-conformity itself: quarantining a lot, correcting a document, replacing a part. It brings the situation back under control, but does not necessarily address the cause that allowed the problem to occur.
- Corrective action
- An action aimed at the cause of a non-conformity so that it does not happen again, not to be confused with the correction, which deals with the immediate effect. The MDR also uses "corrective action" in a broader regulatory sense: always state the framework in a procedure or a record.
- Effectiveness check
- A step separate from carrying out the action: with a suitable criterion and observation period, you verify that the action has actually reduced or eliminated the targeted problem. The MDR and the IVDR explicitly include it in the manufacturer's quality system.
| Framework | What it requires in practice |
|---|---|
| ISO 13485 | Distinguish correction, corrective action and preventive action, address causes in proportion to risk, and verify the effectiveness of actions. No analysis method (5 whys, Ishikawa) is imposed. |
| MDR 2017/745 & IVDR 2017/746 | Include in the QMS the management of corrective and preventive actions and the verification of their effectiveness. The MDR defines "corrective action" more broadly than ISO does: set the vocabulary in your procedures. |
| FDA QMSR (2 February 2026) | 21 CFR Part 820 now incorporates ISO 13485:2016 and no longer keeps the former section 820.100. The investigation of a nonconforming product must be proportionate to its significance and to the risk. |
Operational summary: it replaces neither reading the texts nor the opinion of your regulatory affairs lead.
What should you do?
A CAPA system is not judged by the number of open records, but by its ability to triage, find the real cause and prove the effect. That comes down to a few decisions the record must keep, whatever the tool.
- Describe the fact without writing the assumed cause into it, and link the event to the product, lot, supplier or process concerned.
- Contain and correct immediately what needs to be, without waiting for the end of the root cause analysis.
- Assess the risk, recurrence and extent, then set a proportionate level of investigation, and justify that level even when you do not open a CAPA.
- Establish the cause from facts (production data, batch records, equipment, suppliers), not from a chain of reasoning written without evidence.
- Link each action to the cause it addresses, with an owner, a deadline and a status.
- Verify effectiveness with an observable criterion and a time frame consistent with how often the problem occurs: tasks at 100% prove execution, not results.
Praeventis keeps a CAPA's whole timeline in a single record
Praeventis links the initial event, its criticality, the owners, the actions, the deadlines, the evidence and the post-implementation analysis. The software structures the workflow; your procedures remain responsible for the opening criteria, investigation methods and closure rules.
- Categorized quality tickets, with owner, status and deadline.
- CAPA with criticality, action plan and post-implementation analysis.
- Actions linked to the originating event, investigation documents kept in the record.
- Status history and exports to analyze lead times, categories and recurrences.
The Cerebellis software related to this topic
Further reading
Computerized system validation (CSV) according to GAMP 5
Software categories, V-model, risk analysis and traceability matrix: how GAMP 5 structures a risk-proportionate computerized system validation.
ISO 13485 QMS software: what it should support
A QMS is not a piece of software: what the MDR, the IVDR and ISO 13485 ask of the quality system, and how to choose which workflows to digitize first.
Medical device traceability: reconstruct a lot in seconds
What ISO 13485 and the MDR require of lot traceability, the six practical requirements to meet, and a simple test to see where yours stands.