A corrective action request (CAR) is a formal quality record that assigns a specific nonconformity to an owner and requires that owner to contain it, find its root cause, remove that cause and prove the problem does not come back. A CAR is raised after an audit finding, a nonconformance or a complaint, and it stays open until the quality unit verifies the fix.
The set of procedures, forms and tracking that manages every CAR from issue to closure is the CAR system, and it is what auditors and FDA investigators test. In the Atlas Form 483 directory (release of August 15, 2026), ISO 13485 clause 8.5.2, the device corrective action clause, appears on 91 of 349 device Form 483s issued since the Quality Management System Regulation (QMSR) took effect in February 2026. The most common finding is not a missed fix. It is a CAR procedure that does not exist on paper.
Key facts:
- A CAR covers one internal nonconformity; a SCAR goes to a supplier; a CAPA is the wider quality system process that both feed.
- ISO 9001:2015 sets the corrective action requirement in clause 10.2; ISO 13485:2016 sets it in clause 8.5.2 and requires a documented procedure.
- Since February 2, 2026, FDA enforces ISO 13485 for devices through the QMSR, so device 483s now cite clause 8.5.2 where they used to cite 21 CFR 820.100.
- In the Atlas directory, 52 of 349 post-QMSR device Form 483s (15%) cite "corrective action procedures not documented", against 32 (9%) for "corrective action not taken".
- For drugs, 21 CFR 211.192 investigations appear on 70 of 323 human drug Form 483s issued January 8 to July 10, 2026 (22%).
What is a corrective action request?
A corrective action request is a written instruction, issued by quality or an auditor, that names a nonconformity, the requirement it breaks, the owner and a due date, and asks the owner to correct it and eliminate its cause. The CAR is the unit of work; the CAR system is the process around it.
Two words get mixed up in most CAR forms. A correction fixes the instance: rework the lot, retrain the operator, update the record. A corrective action removes the cause so the same nonconformity does not recur. ISO 9001 and ISO 13485 both ask for the second, and a CAR closed with only a correction is the most common reason an auditor reopens one.
CARs also exist outside FDA work. In US defense contracting, the Defense Contract Management Agency issues CARs to contractors at four levels, from a Level I issue fixed on the spot to a Level IV that can suspend acceptance or payments. The principle is the same: severity decides who receives the CAR and how much management attention it gets.
When is a corrective action request raised?
A corrective action request is raised when a nonconformity is confirmed and its cause is not yet known or not yet removed. Most quality manuals list the triggers in the CAR procedure so the decision is not made case by case:
- An internal or external audit finding, including a finding from a certification body or a customer audit.
- A nonconformance report (NCR) on product, process or documentation, especially a repeat or a major one.
- A customer complaint whose investigation points to an internal cause.
- A deviation, out-of-specification result or failed batch that an investigation traces to a process gap.
- A negative trend in quality data, such as rising scrap, yield loss or complaint rate.
- An FDA Form 483 observation or a regulator's inspection finding.
Not every NCR needs a CAR. A one-off minor nonconformity with a known cause can be closed with a correction and a risk-based rationale. Repeats, major findings and anything touching patient safety should always open one. If the cause sits with a supplier, the request goes out as a SCAR instead, which our guide to the SCAR process covers step by step.
What are the steps in the CAR process?
The CAR process runs in eight steps, from logging the problem to verifying the fix. Each step has an owner, and the quality unit controls the first and last.
- Identify and record the nonconformity: what failed, where, when, how many, and the requirement it breaks.
- Contain: quarantine product, stop the process or apply a temporary control, and record what was done.
- Assign the CAR to an owner with a due date and a severity rating.
- Investigate the root cause with data, using 5 Whys, a fishbone diagram or fault tree, and check whether the same cause affects other products, lines or facilities.
- Plan corrective actions that address the root cause, with owners and dates.
- Implement the actions and update affected documents, training and validation.
- Verify effectiveness against a measure decided at step 5, over a set period or number of lots.
- Close the CAR, with quality unit approval, and feed the result into management review and trending.
Step 4 is where most CAR systems fail an audit. "Human error" with retraining as the fix is accepted only when the investigation shows why the error was possible and why retraining removes that condition. Step 7 is the other weak point; our piece on CAPA effectiveness metrics explains how to set a measure that proves something.
What does a CAR form contain?
A CAR form contains enough fields to show the whole chain from finding to verified fix without opening another file. The table below lists the fields an auditor expects to see; your electronic QMS may split them across screens.
| Field | What goes in it |
|---|---|
| CAR number and date opened | Unique ID, issue date, link to the source record (audit report, NCR, complaint number) |
| Source and requirement | Where the finding came from and the clause, SOP or specification it breaks |
| Description of nonconformity | Objective evidence: what, where, when, quantity, batch or serial numbers |
| Severity and risk | Critical, major or minor, with the risk rationale |
| Owner and due date | Responsible person and department, response and completion dates |
| Containment and correction | Immediate actions taken and their date |
| Root cause investigation | Method used, data reviewed, root cause statement, extent check on other products |
| Corrective action plan | Actions tied to the root cause, owners, dates, documents to change |
| Implementation evidence | Revised SOPs, training records, validation, change control numbers |
| Effectiveness check | Criterion, period, result, pass or fail |
| Closure | Quality unit approval, date, link to related CAPA if escalated |
A blank form is not the problem FDA writes up most. The problem is a form with no procedure behind it, so each department fills it differently. Atrium Medical Corporation in Merrimack, New Hampshire received a two-observation Form 483 on June 1, 2026, and one of the two was "corrective action procedures not documented" under clause 8.5.2.
CAR vs SCAR vs CAPA: what is the difference?
A CAR handles one internal nonconformity, a SCAR asks a supplier to fix one it caused, and a CAPA is the quality system process that analyzes data from both and adds preventive action. The terms overlap, so define them in your procedure.
| CAR | SCAR | CAPA | |
|---|---|---|---|
| Full form | Corrective Action Request | Supplier Corrective Action Request | Corrective and Preventive Action |
| Who investigates | An internal process owner or department | The supplier | Your quality system, across functions |
| Scope | One internal nonconformity | One supplied material, component or service | Corrections, corrective and preventive actions across the system |
| Typical trigger | Audit finding, NCR, complaint, deviation | Nonconformance traced to the supplier | Trends and any quality data source, including CARs and SCARs |
| Regulatory home | ISO 9001 clause 10.2; ISO 13485 clause 8.5.2 | ISO 13485 clause 7.4; 21 CFR 211.84 for drug components | ISO 13485 clauses 8.5.2 and 8.5.3; 21 CFR 211.192 for drugs |
| Who closes it | The quality unit, after verification | The manufacturer, after verification | The quality unit, after an effectiveness check |
Many companies use one electronic record for all three and let a field decide the type. That works as long as a CAR that reveals a systemic problem is escalated into a full CAPA rather than closed at the local level. Our CAPA guide covers the system-level process.
What do ISO 9001 and ISO 13485 require for corrective action?
ISO 9001:2015 clause 10.2 and ISO 13485:2016 clause 8.5.2 both require the organization to react to a nonconformity, find its cause, act to stop it recurring and review whether the action worked. ISO 13485 is stricter on paperwork and on the medical device.
| Requirement | ISO 9001:2015, clause 10.2 | ISO 13485:2016, clause 8.5.2 |
|---|---|---|
| Trigger | Any nonconformity, including those from complaints | Nonconformities, including complaints |
| Documented procedure | Not required; documented information as evidence of actions and results (10.2.2) | Required: a documented procedure covering the CAR steps |
| Root cause | Review and analyze the nonconformity, determine causes | Determine the causes of nonconformities |
| Extent | Determine whether similar nonconformities exist or could occur | Evaluate the need for action to ensure nonconformities do not recur |
| Timing | Not specified | Corrective actions taken without undue delay |
| Proportionality | Appropriate to the effects of the nonconformity | Proportionate to the effects of the nonconformity |
| Device-specific check | None | Verify the action does not adversely affect regulatory compliance or the safety and performance of the device |
| Effectiveness | Review the effectiveness of corrective action taken | Review the effectiveness of corrective action taken |
| Records | Retain evidence of the nonconformity, actions and results | Maintain records of investigations and actions taken |
Two practical consequences follow. First, an ISO 13485 site without a written CAR procedure has a nonconformity before any CAR is opened, and that is exactly the clause 8.5.2 finding FDA writes most often. Second, the "without undue delay" wording turns an aging CAR backlog into evidence: FDA used it as an observation title on 3 post-QMSR device 483s in the Atlas directory.
For devices sold in the US, the QMSR incorporates ISO 13485:2016 by reference (21 CFR Part 820 on eCFR). Before February 2, 2026, the same expectation sat in 21 CFR 820.100(a). Drug manufacturers have no CAR clause as such; 21 CFR 211.192 requires thorough, documented investigations of discrepancies and failures, extended to other batches that may be affected, with conclusions and follow-up.
What does FDA cite when a CAR system fails?
FDA cites the CAR procedure itself more often than any single missed action. We counted every corrective action observation in the Atlas FDA Form 483 database, directory release of August 15, 2026.
Devices. Of 349 device Form 483s issued from February 2 to July 17, 2026, 91 (26%) carry at least one clause 8.5.2 observation. By title: "corrective action procedures not documented" on 52, "corrective action not taken" on 32, "corrective action records not maintained" on 5 and "corrective actions were unduly delayed" on 3. Device 483s with a corrective action finding averaged 4.9 observations, against 4.0 for all post-QMSR device 483s. A separate published sample of 96 device 483s from May to July 2026 put clause 8.5.2 at 28% (ISO clauses by industry).
Before the QMSR, the device CAPA rule 21 CFR 820.100(a) was cited in 4,691 inspections in the Atlas US FDA inspections dataset, second only to 21 CFR 1.502(a) for foreign supplier verification.
Drugs. Of 323 human drug Form 483s issued from January 8 to July 10, 2026, 70 (22%) cite 21 CFR 211.192 "investigations of discrepancies, failures".
Three indexable examples show the pattern:
- Vynacron Dental Resins, Jackson, June 25, 2026: eight observations, including corrective action procedures and preventive action procedures both not documented, next to complaint handling gaps that should have fed those CARs.
- First Source, Rochester, June 24, 2026: three observations, one of them clause 8.5.2 corrective action procedures not documented, alongside design change control.
- Carlsbad Technology, Carlsbad, California, June 30, 2026: three observations on a drug 483, led by 211.192 investigations of discrepancies and failures.
A Form 483 observation like these is answered with a CAR of its own, scoped across the whole system. Our guide to what a Form 483 is covers the document and the 15 business day response window.
AtlasSee what the FDA knows about your next investigator.
30 minutes with the founder. No pitch deck.
How do you measure a corrective action request system?
A corrective action request system is measured by how fast CARs close, how many run past their due date, and how often the same problem comes back. Track these monthly and report them at management review.
| Metric | How to calculate | What it tells you |
|---|---|---|
| Cycle time | Median days from CAR opened to CAR closed, by severity | Whether investigations stall; split out root cause time from implementation time |
| Overdue rate | Open CARs past due date / all open CARs | Backlog risk; the "unduly delayed" finding starts here |
| Aging | Count of CARs open over 90 and 180 days | Old CARs that no one owns |
| Recurrence rate | CARs whose nonconformity repeats within 12 months / CARs closed | Whether root causes were real |
| Effectiveness pass rate | Effectiveness checks passed / checks performed | Whether the actions worked |
| Retraining-only closures | CARs closed with training as the only action / all closed | A proxy for shallow root cause analysis |
| Extension count | Due date extensions per CAR | Whether due dates are set honestly |
Targets belong in your procedure, set by severity. A falling cycle time with a rising recurrence rate is a warning sign, not an improvement: CARs are closing faster because investigations are getting thinner. The FDA data points the same way. Of the 91 post-QMSR device 483s with a clause 8.5.2 finding, 32 say the corrective action was not taken at all, which is what an overdue rate measures before an investigator does.
AtlasFDA Inspection Intelligence Digest
We track every 483, EIR, and warning letter the moment it happens. Get the signals before they hit the FDA website.
Frequently asked questions
In auditing, a CAR is the request an auditor raises against a finding, asking the audited area to correct the nonconformity and remove its cause by a due date. Internal auditors, certification bodies and customers all issue them. The audit is not closed until the auditee submits a root cause, an action plan and evidence, and the auditor or quality unit verifies it.
Written by
Bhavish Agarwal
Founder, Atlas
Bhavish Agarwal is the founder of Atlas and previously worked at Google and Microsoft. He has spent the past several years building regulatory data infrastructure for the pharmaceutical industry.
