CAPA Effectiveness Checks and Metrics: How to Prove a Fix Worked

A CAPA effectiveness check is the documented test that the problem behind a corrective or preventive action did not come back. It needs four things, all set when the CAPA opens: a metric tied to the original failure mode, a numeric acceptance standard, a monitoring window long enough to see recurrence, and a named data source. Without those, a closed CAPA proves only that work was done.

This is the step of the CAPA process most often missing from closed records, and FDA cites it. Of the 192 most recent device Form 483s in our directory, 30% carry a corrective action observation. Below: how effectiveness differs from verification, how to plan the check, which methods hold up, how much data is enough, the program-level CAPA effectiveness metrics, and a template you can copy.

Effectiveness vs verification: two different questions

Verification asks whether the action was done as designed and did not create a new problem. Effectiveness asks whether the problem stopped, using outcome data collected over a meaningful window. A revised SOP that is approved, trained and in use is verified. It is effective only when the failure it targeted stops appearing in the data.

For devices, the former 21 CFR 820.100(a)(4) required manufacturers to verify or validate a corrective and preventive action to ensure it is effective and does not adversely affect the finished device. Since February 2, 2026, the Quality Management System Regulation incorporates ISO 13485, and the requirement sits in clause 8.5.2, which asks you to review the effectiveness of corrective action taken. The citation moved; the expectation did not. In our review of 96 device Form 483s from May to July 2026, clause 8.5.2 appeared on 28% of them (ISO clauses by industry). For drugs, 21 CFR 211.192 requires thorough investigations with documented follow-up, and ICH Q10 expects CAPA effectiveness to be evaluated.

Plan the check when the CAPA opens, not at closure

An effectiveness check written at closure tends to measure whatever data happens to be available. Write it when you define the actions, with four fields:

1. Metric tied to the failure mode. Measure the thing that failed: fill weight below specification, seal leak rate, mislabel complaints. Not training completion.
2. Numeric acceptance standard. "Zero recurrences in 30 batches" or "complaint rate below 2 per million units for two quarters". A standard you cannot fail is not a standard.
3. Window, with a reason. Start and end dates justified by process cadence and how often the failure occurred before. If the failure appeared once a quarter, a one-month window proves nothing.
4. Named data source. The LIMS report, complaint database query, audit schedule or SPC chart the result will come from, and who pulls it.

The Medline Industries warning letter of March 25, 2026 shows a check with a real threshold and what happens when the threshold is ignored. FDA wrote that Medline's NAMIC Division in Glens Falls, New York, had received 221 complaints and filed 177 medical device reports for syringe disconnections. Its CAPA procedure allowed a CAPA to be routed back when an effectiveness check failed, yet complaint rates for devices made after the corrective action stayed above the firm's own 15.98 complaints-per-million threshold through 2025, and the CAPA was neither rerouted nor replaced. The letter cites 21 CFR 820.100(a) for not following the firm's own procedure (FDA warning letter to Medline Industries, LP).

Which methods produce effectiveness evidence?

Pick the method that measures the failure mode directly. Most CAPAs need one primary method; high-risk CAPAs often need two.

For laboratory CAPAs, trend the OOS and OOT rate for the affected test before and after the action; our guide to OOS results and how they are investigated covers where that data comes from.

Three "methods" do not count as effectiveness evidence on their own:

• Procedure revised. That is verification of the action, not proof the problem stopped.
• Staff retrained. Training records show attendance. If the root cause was a design gap in the process, retraining leaves it in place.
• "Did not happen three times in a row." Three passes say very little statistically (see the next section), and if the failure was rare to begin with, three passes were likely anyway.

The Fresenius Kabi AG warning letter of January 4, 2024 is a clean example of a check that existed on paper only. FDA found the verification of effectiveness for CAPA-00044, opened to address fluid ingress into the Ivenix Large Volume Infusion Pump, inadequate because the required validation was not conducted: the leak test called for by the firm's own verification and effectiveness plan was not followed (FDA warning letter to Fresenius Kabi AG).

How much data before you call a CAPA effective?

When the check is a pass/fail test, the sample size follows from two choices you state up front: the reliability you want to demonstrate and the confidence you want in that claim. Reliability demonstration testing with zero failures allowed uses the success-run relationship, n = ln(1 - C) / ln(R):

Two consequences. The lower the failure rate you are willing to tolerate, the faster the sample grows. And "three in a row" at 95% confidence demonstrates a reliability of only about 37%. State the confidence level in the CAPA plan, not after the data arrives, and have a statistician sign off on the sampling plan for any high-risk check. If failures are allowed in the plan, the numbers change, which is one more reason to get that sign-off.

Scale rigor to risk

Not every CAPA needs 299 samples. Match the depth of the check to the risk the CAPA addresses, and write the tiers into your procedure so the choice is consistent.

The program-level CAPA effectiveness metrics

A single check answers whether one CAPA worked. Program metrics answer whether your CAPA system works. Track these by risk tier, product line and facility, and pair each with an escalation rule.

Measure outcomes, not activity. "CAPAs closed this month" rewards closing. "CAPAs closed with a passed effectiveness check" rewards fixing. A rising recurrence rate alongside a high pass rate usually means the checks are too easy to pass.

What FDA cites when effectiveness is missing

Our data shows the gap clearly on the device side. Of the 192 most recent device Form 483s in our FDA Form 483 database, issued March 26 to July 17, 2026 (directory release of August 15, 2026), 58, or 30%, carry at least one corrective action observation. Those forms hold 67 such observations, and 17 of them say corrective action was not taken. Three more say corrective actions were unduly delayed.

Over the longer run, 21 CFR 820.100(a) was cited in 4,691 inspections in our US FDA inspections dataset. By region, CAPA was tagged 766 times in North American device inspection findings (region-wise top issues).

Three 2026 forms show the pattern behind those counts:

• Fresenius Medical Care Renal Therapies Group, Waltham, Massachusetts, June 3, 2026: six observations, including corrective action not taken under clause 8.5.2 and feedback information not used as input into risk management.
• LeMaitre Vascular, North Brunswick, New Jersey, June 25, 2026: eight observations, including corrective and preventive action procedures not documented and nonconforming product not adequately evaluated.
• Light Age, Somerset, New Jersey, May 15, 2026: citations under nine ISO 13485 clauses, including records of data analysis results not maintained (8.4) and preventive action records not maintained (8.5.3). Without data analysis records, there is nothing to run an effectiveness check against.

When the same section returns at the next inspection, the 483 tends to become a warning letter. Our comparison of Form 483 and warning letter responses covers what changes in the response once that happens.

Atlas

See what the FDA knows about your next investigator.

30 minutes with the founder. No pitch deck.

See it live

What to do when the effectiveness check fails

A failed check is a finding, not a paperwork problem. The CAPA stays open, and you choose one of three routes, documented with a rationale:

• Return to root cause. If the failure mode is the same, the cause was probably wrong or incomplete. Reopen the investigation with the new data.
• Open a new CAPA only if the evidence points to a different cause. Opening a new record for the same cause hides a repeat, and investigators look for exactly that.
• Escalate the risk. Reassess product already released while the ineffective action was in place: complaint review, field action assessment, and a health hazard evaluation if the failure affects safety. Clause 8.3.3 covers action on nonconforming product found after delivery.

If the cause sits at a supplier, the same logic applies to the supplier's response; our SCAR process guide covers how to judge it and when to escalate.

CAPA effectiveness planning template

Copy this into the CAPA record when the actions are defined.

```
CAPA number:
Problem statement (what, where, when, how often):
Root cause (with evidence reference):
Actions and verification (how you will confirm each was implemented as designed):
Risk tier (low / medium / high) and rationale:

EFFECTIVENESS CHECK
Metric tied to the failure mode:
Baseline (rate or count before the action, with period):
Acceptance standard (numeric):
Method (trend, audit, sampling and testing, KPI, product review):
Sample size, confidence and reliability (if pass/fail testing):
Window start and end, with justification:
Data source and owner:
Statistician sign-off (high risk):

RESULT
Data summary:
Pass / fail against the standard:
If fail: route chosen (re-investigate, new CAPA, risk escalation) and rationale:
Released product assessment:
Quality unit approval and date:
```

Atlas

FDA Inspection Intelligence Digest

We track every 483, EIR, and warning letter the moment it happens. Get the signals before they hit the FDA website.

Subscribe