It’s no secret that establishing an effective corrective and preventive action (CAPA) system is one of the highest quality systems hurdles that MedTech manufacturers must jump. Warning letters issued by the US Food and Drug Administration bear this out; FDA investigator observations of 21 CFR, Part 820.100 – the section of the Quality System Regulation (QSR) that lays bare requirements for CAPA – can be found on most of the agency’s compliance missives sent in any given year.
Rebecca Fuller, QualityHub’s VP of Regulatory Compliance, says it’s essential for makers of medical devices to fully grasp the three key components that make up a CAPA system:
- Correction: An immediate fix for a problem.
- Corrective action: The act of identifying and addressing root causes so the problem doesn’t happen again.
- Preventive action: The act of identifying and addressing potential problems before they occur.
Below are five tips from Fuller that companies can put into practice to make sure their CAPA system is sturdy, healthy, and in compliance with regulatory requirements. (Related Story: “What is CAPA – Corrective and Preventive Action?” QualityHub, Jan. 31, 2023.)
CAPA Pro Tip No. 1
Use preventive action to make sure an existing problem in one area doesn’t extend to other systems, processes, or products.
QHub’s Rebecca Fuller Says: If you have a problem, you need to consider proactively addressing that problem in multiple products, processes, or systems that may be impacted. If there are no other products, processes, or systems affected, then that’s fine – document that you did an assessment to determine the full potential for an identified problem to exist in areas where the problem has not yet been seen and that no further action is required.
At its core, quality assurance is “preventive.” QA requires monitoring operations and products and mitigating potential problems before they occur. A quality assurance program and the processes that are set up within are inherently designed to identify potential problems before they escalate to the point of affecting patients or users. The goal is to make sure nonconforming product doesn’t ever leave a manufacturing site.
A good QA program will prevent a problem from manifesting itself, and companies do that by way of several types of activities, including, for example:
- Conducting routine scheduled maintenance on a manufacturing line,
- Establishing effective training programs,
- Monitoring quality data, and
- Auditing processes.
These are all preventive in nature. A preventive action within the CAPA system looks at related systems, processes, and products that perhaps never experienced a particular problem to make sure proper controls are in place to prevent a future product nonconformance.
Best Practice: The CAPA system should include a mechanism to help identify the need for preventive actions. For example, a decision tree can help the firm decide whether a CAPA should be deescalated to a related manufacturing plant where the same or very similar processes may be performed and therefore may be susceptible to the same problem.
CAPA Pro Tip No. 2
Track and set thresholds for analyzing quality data to identify problems before product nonconformances occur.
QHub’s Rebecca Fuller Says: The FDA’s QSR requires that manufacturers collect, identify, track, and monitor quality data – that’s called quality data analysis. Companies must have a program for proactive quality data analysis. And there’s a lot of different sources of quality data.
Two common sources of quality data include:
- Product nonconformances in manufacturing, which document failure to meet an established specifications, and
- Complaints, which document product problems that occur after the product has left the manufacturer’s control. These metrics represent product problems that have already occurred.
But there are other data sources that are very important to monitor that can expose serious problems before they impact the finished products. For example, a program for proactively monitoring environmental control data identifies shifts in that data well before you’re outside of your specification for, say, viable or nonviable particulate load. If you have effective monitoring in place then you don’t have to wait until actual product is out of compliance before taking an action to prevent that nonconformance from happening.
Similarly, monitoring in-process materials attributes against established specifications can detect trends that indicate an attribute is moving toward an upper or lower control limit. If the trend can be detected before product is outside of the specification limits (i.e. nonconforming), adjustments can be made without significantly interrupting operations.
Sometimes the most important thing is not what dataset you’re analyzing – after all, you need to analyze a lot of datasets – but it’s understanding how to set the threshold or control limit which, if met, requires action. Detecting and flagging the problem before the product is nonconforming reduces patient and business risk. This means that “alert limits” and “action limits” must be set inside the specification range for the measured attribute. This allows early detection and provides time to evaluate the cause, and then adjust or correct the underlying cause of the shift in measured outputs.
So, it’s not all about the data sources. Yes, you must look at all of them, but you also must carefully consider how to set threshold limits that elicit timely reaction. This requires understanding how to apply the right statistical methods both to the analysis of the data and to the setting of risk-based alert and action limits.
Best Practice: Invest in systems that monitor the right data against established thresholds or control limits using statistical methods capable of detecting signals. Identify statistically valid signals and react to these quickly. Evaluate the situation before product attributes are outside of the approved specification range and before the risk of shipping nonconforming product. The investment in proactive product and process monitoring programs will ultimately be less than the cost of recalls, field corrections, customer dissatisfaction and regulatory actions.
CAPA Pro Tip No. 3
Use strong objective evidence when building a CAPA.
QHub’s Rebecca Fuller Says: Everything that’s done as part of a CAPA has to be documented. That’s a regulatory requirement. Quality problems must be documents. Investigations and the results of those investigations must be documented, and through the Quality System Regulation – or Clause 8 in the case of international quality systems standard ISO 13485 – manufacturers must document actions taken to correct and prevent quality problems as part of an overall CAPA system.
Companies struggle with documentation; technical writing is challenging and so is building objective evidence to support actions taken and, just as important, actions not taken. Documentation within a CAPA requires objective evidence – in fact, it requires strong objective evidence to support every action executed, every decision made, and every conclusion stated.
It’s not good enough to say, “I did something,” or “Here’s my result. Here’s what happened.” Rather, you must have objective data that is traceable to its source. The story told must be supported by facts and the facts must be supported by real data from reliable sources. Reliable sources might include testing data from validated test methods, objective inspections documented with photographic evidence, well-documented interviews with those who witnessed a process, or information taken from approved source documents such as risk management files, batch records, or product specifications.
Let’s say a company must make a packaging change. In this case, the firm must have objective evidence of that packaging change, and sometimes that includes a lot of documents that must be referenced or linked into the CAPA, such as:
- A revised drawing for new packaging material,
- A packaging validation study,
- An engineering change order that makes the packaging effective, and
- An update to the bill of materials for the new packaging.
All those become pieces of objective evidence, and the CAPA needs to refer to all of them.
Best Practice: Build objective evidence into each element of each phase of the CAPA. CAPA records must clearly state, for every action taken, the objective evidence that shows the action was fulfilled (the who, what, where, when, why, and how). Objective evidence must support every decision made with information that is free of opinion, bias, and assumption.
CAPA Pro Tip No. 4
Demonstrate that preventive actions are indeed effective.
QHub’s Rebecca Fuller Says: The FDA’s QSR and the ISO 13485 standard requires companies to demonstrate the effectiveness of preventive actions, just as they do for corrective actions.
Best Practice: Based on the original CAPA problem statement, decide which documents, product, and processes you need to evaluate to determine if all actions taken were effective. Look at evidence associated with the original manufacturing line, process, or product that was nonconforming to determine if the corrective action was effective. Look at evidence of the problem existing in similar or related processes or products to determine if the preventive action is effective. Consider both.
Consider, for example, you are conducting an audit of batch records to determine if changes made in the manufacturing process have resulted in less nonconformances per batch. This audit should include review of batch records associated with the original product line where the high scrap rate was observed to ensure corrective actions were effective. But if preventive measures were taken for similar production lines as an improvement or preventive measure, intended to decrease potential for the nonconformance, some batch records for these similar product lines should also be sampled and reviewed. These batch record reviews for verification of effectiveness must be documented with traceability to who reviewed which records, when, and the results. This provides the objective evidence for the verification of effectiveness of all actions taken, corrective and preventive.
CAPA Pro Tip No. 5
Develop a culture of quality that devotes resources to routinely reviewing the CAPA system and related processes.
QHub’s Rebecca Fuller Says: It is important to have a company culture that is willing to put resources into periodically examining the systems and processes that are in place, monitoring data, and reporting on the results of that monitoring.
Having a culture of quality means having strong programs for data analysis and the ability to react when early signals are seen. A culture of quality supports being proactive about fixing a potential problem before it becomes a reality involving finished product in commercial distribution. If management is not proactively participating in management reviews, CAPA reviews, and quality data analysis reviews, at the right level and the right time, then the organization is culturally immature and has failed to recognize the importance of management’s role in ensuring quality. The support for quality assurance and dedication of resources needed for it must come from the C-suite and trickle down. (Related Story: “Successful MedTechs Use Management Controls to Oversee Quality Systems, Avoid FDA Risk. Here’s How Yours Can, Too,” QualityHub, Dec. 4, 2025.)
Management also needs to support employees when they say, “We detected a signal, we think we need to do something.” Management’s response needs to be, “Absolutely – let’s move forward with this. Let’s go ahead and open the CAPA and let’s get started on an investigation,” and not say, “It doesn’t sound like a problem right now. It hasn’t affected anything in the field.”
By the time something’s in the field and nonconforming, it’s much too late and then you’re initiating an expensive recall and potentially putting patients or users at risk.
Best Practice: A culture of quality must come from the top down, and leaders must listen to employees when they suspect there’s a potential problem. Employees must be given the autonomy, authority, time and resources to react to potential quality issues in a proactive manner.