CAPA in Pharma and Medical Devices: Corrective and Preventive Action Guide (2026)

CAPA stands for Corrective and Preventive Action. It is the part of a quality system that investigates a problem, finds its root cause, removes that cause so the problem does not come back (corrective action), and removes the cause of problems that have not happened yet (preventive action). FDA expects it of every drug and device manufacturer, and it is one of the sections FDA cites most often.

That last point is not a figure of speech. In our dataset of US FDA inspections, 21 CFR 820.100(a), the device CAPA procedures requirement, was cited in 4,691 inspections. Only one section is cited more. This guide covers what CAPA means, how the process runs, what the drug and device rules require since the Quality Management System Regulation (QMSR) took effect in February 2026, and what investigators write when a CAPA system falls short.

What is CAPA? Meaning and full form

The CAPA full form is Corrective and Preventive Action. Some procedures write it as "corrective action and preventive action"; the meaning is the same. A CAPA is both a process and a record: the documented trail from a quality problem to a verified fix.

Three ideas sit underneath it:

• A correction fixes the immediate problem: rework the batch, quarantine the lot, recalibrate the balance.
• A corrective action removes the cause, so the same problem does not occur again.
• A preventive action removes the cause of a potential problem, found through trends, risk reviews or a failure somewhere else.

Most weak CAPAs stop at the correction. Retraining one operator after a mix-up is a correction. Finding that the line clearance checklist does not cover the label magazine, and changing it, is a corrective action.

The ICH Q10 pharmaceutical quality system names CAPA as one of its four elements, alongside process performance monitoring, change management and management review. In practice that means a CAPA is rarely a standalone event: it opens from a deviation, a complaint or an audit, and it usually closes through a change control.

Corrective action vs preventive action: what is the difference?

The difference is timing. Corrective action responds to a nonconformity that has happened. Preventive action responds to one that could happen.

One practical test: if you cannot name the event that opened the record, it is probably preventive. If the record never asks whether the same cause exists elsewhere, it is not finished as a corrective action either.

What triggers a CAPA?

Not every deviation needs a CAPA. A one-off with a known, contained cause can close with a correction and a documented rationale. A CAPA is opened when the cause is systemic, the risk is high, or the problem repeats. Common sources:

• Deviations and nonconformances that recur or carry product impact
• Out-of-specification and out-of-trend results (our guide to what OOS means and how it is investigated covers the investigation that usually feeds the CAPA)
• Customer complaints and adverse event reports
• Internal audit findings and supplier audit findings
• Form 483 observations and warning letter citations
• Trend data from the annual product review, environmental monitoring or returned goods
• Management review outputs

The trigger decides the urgency, but the decision rule should be written down. A procedure that says "the quality unit decides" gives an investigator nothing to check.

The CAPA process, step by step

Most CAPA procedures follow the same eight steps, whatever the software or form used.

1. Identify and describe the problem. What happened, where, when, how often, which products and lots. A vague problem statement produces a vague root cause.
2. Contain it. Quarantine affected material, stop the line, notify customers if needed. This is the correction, and it happens first.
3. Assess risk. Severity, likelihood and detectability decide the priority, the depth of the investigation and the target date.
4. Investigate the root cause. Use a structured method (next section) and test the cause against the evidence. A cause that does not explain every fact is not the cause.
5. Define actions. Corrective actions for the cause found; preventive actions for the same cause elsewhere. Each action gets an owner, a due date and an expected result.
6. Implement through change control. Procedure revisions, equipment changes and training go through the change system, so the CAPA record links to the evidence.
7. Verify effectiveness. Check, against criteria set at step 5, that the problem has not recurred and the action did not create a new one.
8. Close and review. The quality unit approves closure. Trends across CAPAs go to management review.

The device rule has always said this in its own words. The former 21 CFR 820.100(a) listed seven requirements: analyze quality data sources, investigate the cause, identify actions, verify or validate them, implement, communicate to those responsible, and submit the information for management review.

Which root cause tools hold up in an inspection?

Investigators do not care which tool you use. They care whether the conclusion follows from the evidence and whether "human error" was the answer.

A useful rule: if the root cause is human error, ask one more question. Why was the error possible, and why was it not detected? The answer to that second question is the cause FDA wants addressed.

How do you prove a CAPA worked?

The effectiveness check is the step most often missing from closed CAPAs. A good one is planned when the action is defined, not after.

• Set the criterion first: "no recurrence of fill weight below specification in the next 30 batches" is testable; "process improved" is not.
• Pick a window long enough to see recurrence: for a monthly event, one month proves nothing.
• Measure the original failure mode, not only training completion.
• If the check fails, reopen the CAPA. Opening a new one for the same cause hides the repeat.

For the measures that work at program level (recurrence rate, on-time closure, ageing, effectiveness pass rate), go deeper with our guide to CAPA effectiveness metrics.

CAPA for drugs vs medical devices: 211.192, 211.22 and ISO 13485

The drug and device rules reach the same place by different routes. Drug CGMP has no section called CAPA. Device rules always did, and since February 2, 2026 they point to ISO 13485.

For devices, the full text of the amended rule is in 21 CFR Part 820 on eCFR; for drugs, read 21 CFR 211.192 itself, which runs to a single paragraph. One difference matters in practice: ISO 9001:2015 dropped its separate preventive action clause, but ISO 13485:2016 kept 8.5.3. A device manufacturer cannot answer preventive action with "risk-based thinking" alone.

What FDA cites: CAPA in Atlas inspection data

CAPA failures show up in every slice of our data, across drugs and devices, before and after QMSR.

Across all years, 21 CFR 820.100(a) was cited in 4,691 inspections in our dataset, second only to 21 CFR 1.502(a) for foreign supplier verification at 5,162 (US FDA inspections analytics).

QMSR changed the citation, not the finding. In our review of 96 device Form 483s issued from May to July 2026, 91 cited ISO 13485, and clause 8.5.2 corrective action appeared on 28% of them, second only to clause 7.1 risk management at 31% (ISO clauses by industry).

A wider pull says the same. Of the 192 most recent device Form 483s in our FDA Form 483 database (issued March 26 to July 17, 2026; directory release of August 15, 2026), 58, or 30%, carry at least one corrective action observation. Those 58 forms hold 67 such observations: 42 say corrective action procedures were not documented, 17 say corrective action was not taken, 5 say records were not maintained, and 3 say corrective actions were unduly delayed.

Drugs look much the same. Of the 192 most recent human-drug Form 483s (March 20 to July 10, 2026), 54, or 28%, cite failed or incomplete investigations under 211.192. In an earlier sample of 90 human-drug 483s, 211.22 (quality unit) and 211.192 were cited on 32% and 31% respectively, two of the three most common sections. By region, CAPA was tagged 766 times in North American device inspection findings and was the top human-drug issue in North America with 169 findings (region-wise top issues).

Four recent forms show what these citations look like:

• C.R. Bard Inc., Queensbury, June 5, 2026: two observations, one under ISO 13485 clause 8.5.2 for corrective action procedures not documented.
• Barco N.V., Kortrijk, Belgium, June 5, 2026: two observations, again including clause 8.5.2.
• Lonza Bend Inc., Bend, May 19, 2026: a single observation, and it is 211.192.
• Baxter Healthcare Corporation, Round Lake, April 2, 2026: nine observations, with 211.192 among them alongside process and laboratory controls.

The Olympus case shows where repeated CAPA citations lead. Six Olympus facilities received Form 483s in late 2025 with 31 observations between them, 21 CFR 820.100(a) was cited at all six, and FDA issued a warning letter in October 2026. Our breakdown of the Olympus FDA warning letter goes facility by facility.

Atlas

See what the FDA knows about your next investigator.

30 minutes with the founder. No pitch deck.

See it live

When the root cause sits at a supplier: SCAR

When the cause of a nonconformity is a purchased component, material or service, the CAPA extends to the supplier through a Supplier Corrective Action Request (SCAR). The manufacturer still owns the outcome: ISO 13485 clause 7.4 and 21 CFR 211.84 make supplier control your responsibility, not the supplier's.

A SCAR follows the same steps as an internal CAPA, with two differences. The supplier performs the investigation, so your job is to judge whether its root cause and evidence are credible. And the effectiveness check usually runs on your side, through incoming inspection results and the supplier's next lots. Our SCAR process guide covers the request, the supplier response and closure criteria.

Why CAPA systems fail inspections

The 483 wording above points to five patterns:

• No written procedure, or one nobody follows. The most common device citation in our pull is the plainest: corrective action procedures not documented.
• Investigations that stop at human error. Retraining closes the record and the event recurs.
• No extension to other batches or products. 211.192 requires it; many investigations look only at the lot in front of them.
• Effectiveness checks that measure activity. "Training completed" is not evidence the problem stopped.
• Late or ageing CAPAs. "Unduly delayed" appears on its own in device 483s, and an open CAPA past its due date with no extension rationale is easy for an investigator to find.

The same section cited at two inspections in a row is one of the most common routes from a VAI classification to an OAI. Our analysis of why companies still fail CAPA and investigation requirements looks at the organizational causes behind these patterns.

Atlas

FDA Inspection Intelligence Digest

We track every 483, EIR, and warning letter the moment it happens. Get the signals before they hit the FDA website.

Subscribe