What Is CAPA? Corrective and Preventive Action Explained

If you work in a regulated industry, you've heard "open a CAPA" more times than you can count. But what is CAPA, exactly, and what separates a CAPA that actually fixes a problem from one that just closes a ticket?

CAPA stands for corrective and preventive action. It's a structured process for figuring out why something went wrong (or could go wrong), removing that cause, and proving the fix worked. It sits at the center of almost every quality management system, from ISO 9001 certification to FDA-regulated drug and medical device manufacturing.

This guide covers what CAPA means in quality, how it differs from related terms like corrections and CARs, where the requirements come from in 2026 (a year that brought both a new FDA device regulation and a new edition of ISO 9001), and the step-by-step CAPA process auditors expect to see.

What is CAPA?

The simplest CAPA definition: a system for investigating quality problems, eliminating their root causes, and preventing them from happening again. A CAPA is both a process (how your organization handles problems) and a record (the documented evidence that you did it properly).

CAPAs can be triggered by almost any quality signal. The FDA's guidance on ICH Q10, the international model for pharmaceutical quality systems, describes the CAPA system as handling actions resulting from investigations of complaints, product rejections, nonconformances, recalls, deviations, audits, regulatory inspections, and trends from process and product monitoring. That list is a good starting point for any industry, not just pharma.

What makes something a CAPA rather than a quick fix is the investigation. A CAPA asks "why did this happen?" and keeps asking until it reaches a cause you can actually remove.

What does CAPA stand for?

CAPA stands for corrective action and preventive action (you'll also see "corrective and preventative action"; both mean the same thing). The two halves describe different situations, which is where a lot of confusion starts.

Corrective action vs. preventive action

The difference comes down to timing. ICH Q10 borrows its definitions from ISO 9000: corrective action eliminates the cause of a detected nonconformity to prevent it from recurring, while preventive action eliminates the cause of a potential nonconformity to prevent it from occurring in the first place.

• Corrective action example: A batch fails a viscosity spec. The investigation finds a mixer speed setting that operators could change without authorization. You lock the setting and add it to the batch record. The problem happened; you're stopping it from happening again.
• Preventive action example: Trend data shows a filling line's fill weights drifting toward the lower limit, though nothing has failed yet. You find a worn component, replace it, and add it to the maintenance schedule. Nothing failed; you acted on a risk.

Correction is not corrective action

This is the distinction auditors probe most often. A correction deals with the immediate problem: quarantining product, reworking a part, scrapping a batch, fixing a typo in a released document. A corrective action deals with the cause. If you only do the correction, you've cleaned up the spill without fixing the leak.

Most CAPAs include both. Contain first, then investigate and fix the cause.

What happened to preventive action in ISO 9001?

If you've worked with ISO 9001, you may have noticed that "preventive action" isn't a standalone clause anymore. The 2015 edition dropped the separate preventive action requirement and folded prevention into risk-based thinking across the whole management system. The idea is that a well-designed QMS identifies risks up front, so prevention happens through planning rather than as an afterthought.

The new ISO 9001:2026 continues in that direction. According to ISO, the 2026 edition provides greater clarity on how organizations consider risks and opportunities. Preventive action hasn't disappeared, though. ISO 13485 still has a dedicated preventive action clause, and ICH Q10 still names preventive action as part of the CAPA system.

How CAPA relates to NCRs, CARs, and SCARs

Quality teams use a handful of overlapping acronyms. Here's how they fit together:

• Nonconformance report (NCR): Documents that something doesn't meet a requirement. It's the record of the problem itself. Our guide to nonconforming product covers how to identify, segregate, and disposition it.
• Corrective action request (CAR): A formal request asking a person, department, or process owner to address a specific issue. See our full guide on what a CAR is and how it works.
• Supplier corrective action request (SCAR): A CAR issued to a supplier when the root cause sits outside your four walls. More on that in our SCAR overview.
• CAPA: The overarching system that takes these inputs, decides which ones warrant investigation, and tracks the corrective and preventive actions through to verified closure.

One important point: not every nonconformance needs a full CAPA. A one-off labeling error caught in-process might only need a correction and a documented rationale. A recurring defect, a customer complaint pointing to a design issue, or a failed audit finding usually does. The decision should be risk-based and written into your procedure, so the same type of event gets the same treatment every time.

Where CAPA requirements come from

CAPA isn't optional in regulated industries. The exact requirements depend on which standards and regulations apply to you, and several of them have changed recently.

ISO 9001

ISO 9001 requires organizations to react to nonconformities, evaluate the need to eliminate their causes, implement actions, and review the effectiveness of those actions (clause 10.2 in the 2015 edition). Note that the standard itself just changed: ISO published ISO 9001:2026 on September 16, 2026, and organizations certified to the 2015 edition have until September 30, 2029 to complete their transition. If your CAPA procedure cites ISO 9001 clause numbers, put a review on your transition plan.

ISO 13485 and the FDA's QMSR (medical devices)

ISO 13485:2016 addresses corrective action (clause 8.5.2) and preventive action (clause 8.5.3) separately, including requirements to determine causes, evaluate the need for action, and review the effectiveness of actions taken.

For medical device manufacturers selling in the U.S., this matters more than ever. The FDA's Quality Management System Regulation (QMSR) took effect on February 2, 2026, and incorporates ISO 13485:2016 by reference into 21 CFR Part 820. On the same date, the FDA stopped using its long-standing Quality System Inspection Technique (QSIT) for device inspections and moved to a new inspection compliance program.

In practical terms, if your CAPA SOP still points to the old Quality System Regulation's section numbers, it's referencing a framework that has been replaced. Now is a good time to update those references and confirm your CAPA records line up with ISO 13485's clauses.

Drug and biologics manufacturing (21 CFR 211 and ICH Q10)

Pharmaceutical CGMP regulations don't use the word "CAPA" in the same way, but the expectation is clearly there. Under 21 CFR 211.192, any unexplained discrepancy or batch failure must be thoroughly investigated, the investigation must extend to other batches and products that may be affected, and a written record must include the conclusions and follow-up, whether or not the batch has already shipped.

The FDA's ICH Q10 guidance goes further and names the CAPA system as one of four core elements of a pharmaceutical quality system, alongside process performance monitoring, change management, and management review. Q10 is guidance rather than regulation, but it describes what FDA and other regulators consider an effective quality system.

Other regulated industries

Food safety, cannabis, aerospace, automotive, and other regulated sectors have their own frameworks, and almost all of them require some form of documented corrective action. HACCP, for example, builds corrective actions directly into its seven principles. The terminology varies, but the core expectation is the same: find the cause, fix it, and prove it's fixed.

The CAPA process, step by step

Every organization's procedure will look a little different, but an effective CAPA process generally follows these seven steps.

1. Identify and document the problem

Capture what happened, where, when, which product or process was affected, and how it was detected. Be specific. "Labeling issue" isn't a problem statement. "Lot 2291 shipped with the previous revision of the IFU insert" is. Attach the evidence: inspection results, complaint records, audit findings, photos.

2. Evaluate the risk and contain it

Decide how serious the problem is and whether it warrants a full investigation. ICH Q10 recommends that the level of effort, formality, and documentation of an investigation be commensurate with the level of risk. This is also where containment happens: quarantining suspect product, stopping a line, or notifying customers if needed.

3. Investigate the root cause

This is the step that separates real CAPAs from paperwork. Use a structured method rather than a gut feeling. Common tools include the 5 Whys (and its more rigorous cousin, 3x5 Why analysis), fishbone (Ishikawa) diagrams, and failure mode and effects analysis (PFMEA).

Also check scope. Could the same cause affect other products, lines, sites, or suppliers? For drug manufacturers, extending the investigation to potentially affected batches is a regulatory requirement, and it's good practice everywhere.

4. Plan the corrective and preventive actions

Define what will change, who owns each action, and when it's due. Good actions target the root cause directly. Before implementing, check whether the change could create new problems. That usually means running it through change control and assessing the impact on validated processes, documents, and training.

5. Implement the actions

Make the changes: update procedures and work instructions, modify equipment or processes, adjust supplier requirements, and retrain affected staff. Document each action as it's completed, with evidence.

6. Verify effectiveness

This is the step most often skipped, and auditors know it. Implementation isn't proof that the fix worked. Define your effectiveness criteria when you plan the action (for example, "zero recurrences across the next 20 lots" or "fill weight Cpk above 1.33 for 60 days"), then go back and check. ICH Q10 is explicit that in commercial manufacturing, CAPA should be used and the effectiveness of the actions should be evaluated.

7. Close the CAPA and feed it into management review

Once effectiveness is verified, close the CAPA with an approval signature and date. Then make sure the data goes somewhere useful. CAPA trends belong in management review, where leadership can spot recurring issues, resourcing problems, or areas where the quality system itself needs work.

What goes in a CAPA report

A CAPA report is the documented record of the whole process. Whatever format you use, it should include:

• A unique CAPA number, the source (complaint, audit, NCR, trend), and the date opened
• A clear problem statement with supporting evidence
• The risk assessment and any containment or correction taken
• The root cause investigation, including the method used and the conclusion
• The CAPA plan: each corrective and preventive action with an owner and due date
• Evidence that each action was implemented
• Effectiveness criteria, the verification results, and who reviewed them
• Links to related records: NCRs, change controls, updated documents, and training records
• Approvals and the closure date

A CAPA plan is a subset of the report: it's the action section, written before implementation begins. The report is the complete story from detection to closure.

Common CAPA mistakes auditors flag

Most CAPA findings aren't about missing CAPAs. They're about CAPAs that exist on paper but don't hold up. Watch out for these:

• Stopping at the correction. The defective product was reworked, but nobody asked why it was defective.
• "Human error" as the root cause. People make mistakes, but a process that lets one person's slip reach the customer has a design problem. Retraining alone is rarely an effective corrective action.
• Closing on implementation, not effectiveness. The SOP was updated, so the CAPA was closed, and the problem came back three months later.
• Investigations that are too narrow. The fix covered one lot or one line when the cause affected others.
• A CAPA system that's either overloaded or underused. If every minor issue becomes a CAPA, the important ones get lost in the backlog. If nothing does, problems repeat. A documented, risk-based threshold solves both.
• CAPAs that stay open indefinitely. Overdue actions with no escalation are a red flag that the system isn't being managed.
• No trending. Individual CAPAs get closed, but nobody looks across them to spot the same cause showing up in different places.

Managing CAPA in an eQMS

Plenty of teams start with spreadsheets, email, and shared folders. That works until you need to show an auditor the full trail from a complaint to an NCR to a root cause to a procedure change to the training records that prove people learned the new procedure. Reconstructing that from five disconnected sources is where things fall apart.

An electronic QMS keeps the whole chain connected. In the Isolocity platform, the CAPA module puts corrective and preventive action reports at the center of the QMS, alongside deviations, nonconformances, out-of-specification results, and customer complaints. CAPA forms are customizable, so you can relabel fields, hide sections you don't use, and make key fields required to match your own procedure.

Because CAPA connects to the rest of the platform, related work stays linked rather than scattered:

• Risk management and FMEA to support risk evaluation and root cause analysis
• Change control for the procedure and process changes your actions require
• Link to Training, so retraining tied to a CAPA is assigned and tracked
• Supplier quality management and a supplier contribution portal for issues that trace back to a supplier
• Reason codes for consistent categorization and trending
• A full audit trail across every record

The goal is simple: see your compliance gaps at a glance, and stop chasing CAPAs across inboxes. Book a demo to see how the Isolocity CAPA module handles the process from first report to verified closure.

CAPA FAQs

What does CAPA mean in quality?

In quality management, CAPA means corrective and preventive action: the system an organization uses to investigate nonconformities and potential problems, remove their root causes, and verify that the actions worked.

Does every nonconformance need a CAPA?

No. Your procedure should define a risk-based threshold for when a nonconformance escalates to a CAPA. Isolated, low-risk issues can often be handled with a correction and a documented justification. Recurring, high-risk, or systemic issues should go to a CAPA.

What's the difference between a CAPA plan and a CAPA report?

The CAPA plan lists the actions you'll take, who owns them, and when they're due. The CAPA report is the complete record, covering the problem, investigation, actions, effectiveness verification, and closure.

How long should a CAPA stay open?

Most standards don't set a fixed number of days. Define target timelines in your procedure based on risk, track them, and escalate overdue CAPAs. Keep in mind that effectiveness checks often need weeks or months of data, so build that time into the plan rather than rushing to closure.

Is CAPA only for FDA-regulated companies?

No. CAPA principles apply under ISO 9001, ISO 13485, food safety schemes, and most other quality frameworks. FDA-regulated companies simply face the most direct regulatory scrutiny of their CAPA systems during inspections.

‍