CAPA (Corrective Action and Preventive Action) is the systematic approach that eliminates the causes of nonconformities that have already occurred (corrective action) and of potential nonconformities (preventive action), in order to prevent recurrence and occurrence, respectively, of health, safety, environment and quality problems.
CAPA, short for Corrective Action and Preventive Action, is the structured process an organisation uses to address the causes of environment, health, safety and quality (EHSQ) problems, not just their symptoms. Corrective action eliminates the cause of a nonconformity that has already happened so it does not recur. Preventive action eliminates the cause of a nonconformity that has not yet happened but that the data suggest is likely.
In practice, CAPA is the link that turns an isolated event, whether a complaint, a deviation, an audit nonconformity, an incident or a near miss, into an action with an owner, a deadline, an identified root cause and verified effectiveness. Without CAPA, organisations tend to fight the same fire again and again, fixing the symptom without ever removing its source.
The concept originated in regulated industries, chiefly pharmaceuticals and medical devices, but today it is central to any management system built on the PDCA cycle (Plan, Do, Check, Act). In occupational safety, CAPA is the natural response required by clause 10.2 of ISO 45001, and it aligns directly with the EU Framework Directive 89/391/EEC obligation to continuously improve preventive measures.
CAPA is the tool that closes the loop between identifying a risk and eliminating it for good. A mature CAPA system lets you demonstrate, with documented evidence, that every incident or nonconformity triggered a root-cause action and that the action was verified for effectiveness. This is exactly what an ISO 45001 auditor looks for under clause 10.2, and what separates a reactive culture from a preventive one.
Recurring problems cost money: scrap, rework, downtime, recalls, fines and insurance premiums. Every CAPA that removes a root cause cuts a recurring cost at source instead of paying for it again and again. A low recurrence rate and a healthy closure rate are objective signals that the management system is reducing risk, not merely documenting it.
The quality of corrective actions depends on the people on the frontline. When operating teams take part in root cause analysis and see their suggestions implemented, trust in the system grows and problem reporting increases. A CAPA that ignores the knowledge of the people who run the process tends to produce shallow actions that do not survive daily reality.
This is the most confused distinction in the whole topic, and the one that generates the most audit findings. The three responses act at different moments and depths. The official vocabulary is set out in ISO 9000:2015.
The most critical distinction is between correction and corrective action. Cleaning up a spill is correction; finding out why the hose came loose and making the coupling error-proof is corrective action. A CAPA that stops at correction never reduces risk permanently, because the problem returns as soon as the conditions repeat.
CAPA appears, under different names and emphases, across the main quality and safety frameworks. Knowing the context avoids misreadings, especially around the term preventive action.
ISO 9001:2015 keeps corrective action in clause 10.2 (nonconformity and corrective action) but no longer has a separate preventive action clause, which existed in the 2008 version. Prevention was absorbed into the risk-based thinking of clause 6.1, which covers actions to address risks and opportunities. In practice, prevention is no longer a standalone procedure but a feature of the entire management system.
In occupational health and safety, clause 10.2 requires that, when an incident or nonconformity occurs, the organisation reacts and controls it, deals with the consequences, evaluates with worker participation the need for corrective action to eliminate the root cause, checks whether similar nonconformities exist elsewhere, implements actions according to the hierarchy of controls and reviews the effectiveness of the actions taken. That is the operational definition of good CAPA in OHS.
In the medical device industry, CAPA is a formal requirement of 21 CFR 820.100, which requires procedures to analyse quality data sources, investigate the cause of nonconformities, verify or validate the actions, implement the changes and submit everything to management review. In pharmaceuticals, ICH Q10 defines the CAPA system as one of the four elements of the quality system, with a level of effort proportionate to risk. Note: the FDA QMSR rule, which harmonises Part 820 with ISO 13485:2016, becomes effective in February 2026.
There is no legally mandated number of steps; the standards set requirements and organisations translate them into six-to-eight-step models. The consolidated seven-step cycle below covers what auditors and regulators expect to find.
%201.webp)
1. Identification. Record and describe the problem or nonconformity, with its source: complaint, audit, deviation, incident, near miss or inspection.
2. Assessment and triage. Size up magnitude, risk and impact to decide whether the case needs a formal CAPA. Risk-based triage avoids opening a CAPA for everything.
3. Investigation and root cause analysis. Go beyond the symptom to the real cause, using a structured methodology (see section 6).
4. Action plan. Define the corrective actions and, where applicable, preventive actions, with clear owners and deadlines.
5. Implementation. Carry out the actions and record the changes to procedures, equipment or training.
6. Effectiveness verification. Confirm, with evidence, that the cause has been eliminated and that the action introduced no new problems. This is the most neglected and the most scrutinised step.
7. Closure and documentation. Close the CAPA only after effectiveness is proven, keeping the documented information traceable.
A CAPA is only as good as its root cause analysis. If the investigation stops at the first symptom, the corrective action will be shallow and the problem returns. The four tools below are the most widely used and are chosen according to the complexity of the case.
An iterative method, created at Toyota, that asks why in succession until it reaches the fundamental cause. Simple and fast, ideal for problems with a relatively linear cause. The risk is stopping too early and mistaking an intermediate cause for the root cause.
A cause-and-effect diagram that organises potential causes into categories, typically the 6 Ms: Machine, Method, Material, Manpower, Measurement and Mother Nature (environment). Useful when a problem may have several competing causes and the team discussion needs structure.
A Ford methodology for complex, recurring problems, with eight steps that run from forming the team and interim containment to permanent corrective action and preventing recurrence. Widely used in the automotive industry and in supplier relationships.
An essentially preventive tool that anticipates failure modes and prioritises action before a problem occurs. It traditionally used the risk priority number (severity × occurrence × detection); the 2019 AIAG-VDA edition replaced it with Action Priority. It is the natural bridge between CAPA and preventive action.
A batch of parts comes out out of tolerance. The correction is to segregate and scrap the batch. The investigation shows the tool wear had no replacement plan. The corrective action introduces replacement by cycle counting; the preventive action is a process FMEA that extends the same control to similar machines.
A substation protection relay trips spuriously and interrupts supply. The correction is to restore service. The root cause is an outdated relay setting. The corrective action revises that relay's settings; the preventive action applies management of change to update setpoints across the whole fleet of equivalent equipment.
A spill occurs during a reagent transfer. The correction is to contain and clean up. The root cause is a procedure with no verification of the hose coupling. The corrective action adds a checklist and training; the preventive action replaces the couplings with error-proof (poka-yoke) fittings.
The paper machine stops due to a sheet break. The correction is to re-thread and resume. The root cause is uncontrolled humidity variation. The corrective action introduces statistical process control; the preventive action installs a closed-loop humidity sensor.
An assay returns an out-of-specification (OOS) result. The correction is to hold the batch. The structured investigation required by ICH Q10 identifies an out-of-date equipment calibration. The corrective action recalibrates and re-tests; the preventive action creates automatic calibration alerts and reviews the frequency.
A metal detector flags a foreign body. The correction is to hold and, if necessary, recall the product. The root cause is a poorly adjusted critical control point (CCP) in the HACCP plan. The corrective action re-adjusts and re-verifies the detector; the preventive action introduces per-shift verification and revises the HACCP plan.
The most frequent error: treating the symptom and considering the case closed. Without eliminating the cause, the problem returns and the history fills up with repeated occurrences.
Stopping too early in the 5 Whys or accepting human error as the final cause. There is almost always a system factor behind it: an ambiguous procedure, an unsuitable tool or missing training.
Closing the CAPA without proving the action solved the problem. It is one of the most recurring findings in FDA warning letters and a serious failing in an ISO audit.
Opening a formal CAPA for every minor deviation overloads the system, creates a backlog and causes the truly critical cases to lose priority. Risk-based triage is the antidote.
Records scattered across spreadsheets and emails make it impossible to demonstrate the full cycle to an auditor and hinder recurrence analysis across areas.
CAPA management only becomes strategic once it is measured. The most direct metric is the CAPA closure rate, which shows the organisation's ability to close the actions it opens, on time.
CAPA closure rate (%) = (CAPAs closed in the period ÷ CAPAs opened in the period) × 100
A healthy closure rate is a lagging indicator: it measures the performance of what has already happened. It should be read alongside leading indicators such as average closure time and, above all, the recurrence rate, which reveals whether actions are actually eliminating root causes or merely closing records. A high closure rate with high recurrence is a warning sign: many CAPAs are closed, but the problems come back.
For decades, CAPA lived on paper forms and, later, in spreadsheets. The model worked at low volumes but collapsed at scale: missed deadlines, scattered records, difficulty proving effectiveness and almost no visibility over recurrence across areas or sites.
Digitalisation changes the game when the whole team, from the frontline to the management, uses an integrated EHSQ system. A nonconformity, an incident or a near miss reported on the shop floor automatically opens a CAPA workflow, with risk-based triage, an owner, a deadline and reminders. Root cause analysis, effectiveness verification and closure are all recorded in one place, with a complete audit trail.
With data centralised, management shifts from reaction to anticipation: it correlates CAPA with leading indicators, detects recurrence patterns before they turn into serious incidents, and directs resources where risk is highest. CAPA stops being a compliance archive and becomes an engine of continuous improvement.
.webp)
CAPA stands for Corrective Action and Preventive Action. It denotes the structured process that eliminates the causes of nonconformities that have already occurred and of potential nonconformities.
Correction eliminates the immediate symptom of a detected nonconformity, for example segregating a defective batch. Corrective action goes to the cause of that problem to stop it recurring, for example changing the procedure that caused it.
ISO 9001:2015 no longer has a separate preventive action clause. The concept was incorporated into the risk-based thinking of clause 6.1. Corrective action remains in clause 10.2. In practice, prevention became a feature of the entire management system.
There is no fixed number mandated by a standard. The most common models have between six and eight steps. A consolidated cycle includes identification, triage, root cause analysis, action plan, implementation, effectiveness verification and closure.
Formal CAPA is a regulatory requirement in the medical device and pharmaceutical industries. Beyond them, the concept is equally required in equivalent form by ISO 45001 (clause 10.2) and ISO 9001 (corrective action), and it is good practice in any management system.
Root cause analysis is a step within CAPA, the one that identifies the origin of the problem. CAPA is the complete process, which also includes the action plan, implementation, effectiveness verification and closure.
It is the step that confirms, with evidence, that the implemented action actually eliminated the cause of the problem and introduced no new risks. Without it, there is no way to know whether the CAPA worked, and it is one of the most scrutinised points in an audit.
Directive 89/391/EEC requires employers to continuously improve preventive measures and to adapt to changing circumstances. Nonconformities, incidents and near misses feed corrective and preventive actions with owners, deadlines and effectiveness follow-up, mirroring the CAPA principle applied to occupational risk management.
The main ones are the closure rate (CAPA closure rate), average closure time, on-time closure rate and, above all, the recurrence rate, which shows whether actions are genuinely eliminating root causes.
EHSQ software such as Glartek automates the CAPA workflow end to end: it opens the action from the report, applies risk-based triage, assigns owners and deadlines, stores the root cause analysis and effectiveness verification with an audit trail, and correlates the data to reveal recurrence patterns before they turn into serious incidents.
Solicite uma demonstração
Inicie sua jornada em EHSQ (SSMA) com a Glartek e torne-se um líder no seu setor.
Agende uma demonstração.webp)
Descubra o poder da única Solução EHSQ (SSMA) nativa em IA desenvolvida para a linha de frente
.webp){kind=small}
