Updated 25 September 2026

Quality buyer guide

Nonconformance and CAPA software: from NCR to effectiveness review

A closed task is not the same as an effective corrective action. Evaluate the whole loop: the nonconformance record and its authorised disposition, the decision to open a CAPA, investigation and action ownership, and a later effectiveness decision, including the evidence retained when the first action fails. Action tracking is the part of that loop that keeps owners, deadlines and closure evidence honest.

Jump to the 34 products

Editorial responsibility: Dimitris Mitsios (Founder of The QHSE Standard; product marketing at Tekmon) · Tekmon pays for sponsored placements on this site (disclosure) · How pages are made · LinkedIn

On this page (13 sections)

What the requirement text asks a CAPA record to prove

Most quality standards now share one clause for this loop. The ISO/IEC harmonized structure (the common text ISO management system standards are written to, with identical clause numbers and titles) puts it in 10.2, Nonconformity and corrective action, and ISO 9001:2026, the sixth edition published in September 2026, is one of those standards. Clause 10.2 has five lettered steps, a proportionality rule and an evidence rule, and each maps to something the software must store as its own field or record rather than a comment on a task.

The harmonized structure's own guidance separates correction, which removes a detected nonconformity (the ISO 9000 definition), from corrective action, which removes its cause and prevents recurrence. It also notes that the structure does not use the term preventive action: actions on risks and opportunities under 6.1 play that role. A product that keeps both ideas in one status field cannot show an auditor which of them happened.

Clause by clause: what the record has to hold

Requirement	What it says	What to see in the software
HS 10.2 a)	React to the nonconformity: take action to control and correct it, and deal with the consequences	Containment and correction logged as separate entries with an owner, before any cause analysis
HS 10.2 b)	Evaluate the need to eliminate the causes so it does not recur or occur elsewhere, by reviewing it, determining the causes and determining whether similar nonconformities exist or could occur	A recorded yes/no decision on cause action, the cause analysis itself, and a search of other sites, lots or products for the same failure
HS 10.2 c) and d)	Implement any action needed, then review the effectiveness of any corrective action taken	Action tasks with acceptance criteria, and a later effectiveness decision by a named reviewer that can be negative
HS 10.2 e)	Make changes to the management system if necessary	Links from the CAPA to the revised procedure, risk entry or training assignment it caused
HS 10.2, proportionality	Corrective actions shall be appropriate to the effects of the nonconformities encountered; the HS guidance adds that identifying or fully eliminating the cause is not required in all cases	A severity or risk field that sets how deep the investigation goes, and a recorded reason when a minor finding stops at correction
HS 10.2, documented information	Evidence of the nature of the nonconformities, any subsequent actions taken and the results of any corrective action	One export that holds the finding, every action attempt (rejected ones included) and the effectiveness result
ISO 13485:2016 8.5.2 and 8.5.3	Corrective action and preventive action are separate clauses, as FDA's QMSR preamble points out	Preventive actions on potential nonconformities reported apart from corrective actions on actual ones
21 CFR 820.10(a)	A device manufacturer must document a quality management system that complies with the applicable requirements of ISO 13485, incorporated by reference in 820.7(b)	Your ISO 13485 CAPA procedure configured and approved by you; a vendor's QMSR statement is not that evidence

Medical devices: 21 CFR 820.100 is no longer the CAPA section

FDA's Quality Management System Regulation took effect on 2 February 2026. On eCFR (current to 23 September 2026) Part 820 now runs from 820.1 to 820.45, and 820.10 requires a documented quality management system that complies with the applicable requirements of ISO 13485:2016. The old 820.100, Corrective and preventive action, is no longer there; a requirement list that still cites it predates the change.

In the final rule's preamble FDA answered a request to keep 820.100(a)(6) and (a)(7), which required quality-problem information to reach the people responsible and CAPA information to reach management review. FDA replied that the substance of those provisions is accounted for in ISO 13485, pointing to clauses 8.2.2, 8.5.2 and 8.3.1. For a buyer that means two tests: can the CAPA record feed management review without a manual summary, and can a nonconformity raised from a complaint keep its link to the complaint investigation?

The corrective and preventive action life cycle

The figure follows one corrective and preventive action from the first report to closure, and shows the two points where the record is sent back.

Roles and the order of the middle steps vary by organisation. Dashed arrows are return paths; a closed status is a separate decision from the effectiveness check.

Text version of this diagram

Step 1. Raise the issue. Owner: Raiser. Source record, scope and evidence attached. Then step 2.
Step 2. Contain and correct. Owner: CAPA owner. Correction logged apart from cause work. Then step 3.
Step 3. Decide if a CAPA is needed. Owner: Quality reviewer. Decision, risk level and reason, including a decision not to act. Then step 4.
Step 4. Find the root cause. Owner: CAPA owner. Method, evidence and a search for similar cases. Then step 5.
Step 5. Plan corrective and preventive actions. Owner: CAPA owner. Actions, owners, dates and acceptance criteria. Then step 6.
Step 6. Approve the plan. Owner: Quality reviewer. Approver, date and any returned drafts. Then step 7.
Step 7. Carry out the actions. Owner: CAPA owner. Completion evidence and linked procedure or training change. Then step 8.
Step 8. Check effectiveness. Owner: Quality reviewer. Criterion set earlier, date read, result and reviewer. Then step 9.
Step 9. Close the record. Owner: Quality reviewer. Closure decision and the whole history in one export. End of the sequence.

Feedback loops

From step 6 (Approve the plan) back to step 5 (Plan corrective and preventive actions): Plan returned.
From step 8 (Check effectiveness) back to step 4 (Find the root cause): Not effective.

What to demonstrate from NCR to closure

Stage	Proposed test	Evidence to retain
Identify	Record specification and observed result	Revision, lot or asset identifier and supporting evidence
Contain	Separate affected material or work	Scope, responsible person and review status
Disposition	Choose the approved treatment	Authorised decision, rationale and linked execution record
Escalate	Assess recurrence or significance	Reason for opening CAPA or recording another follow-up
Ownership	Owner leaves or changes role	Reassignment history and an accountable replacement
Due date	Extension requested after a missed deadline	Original date, reason, reviewer and revised date retained
Effectiveness	Problem recurs after closure	Reopening or a linked follow-up preserves the earlier decision

Nonconformance and CAPA products to test against the loop

Their documented quality applications are a reason to shortlist, not proof that every proposed workflow is included. Preserve separate decisions for task completion, effectiveness and record closure, and ask which applications and licences each step of 10.2 needs.

Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

Same rule for every product: tagged “CAPA Management”, with a sourced nonconformance or CAPA capability in its record, or one the vendor stated to us, labelled as vendor-stated. 34 qualify; the first 8 are shown here. The directory below continues with the other 26 tagged profiles, 26 of which also meet the rule.

EHS Insight
Documented: Quality management and CAPA. Source: ehsinsight.com
Effivity
Documented: Nonconformity to corrective action. Source: effivity.com
Q-Hub
Documented: CAPA workflows. Source: q-hub.app
SimplerQMS
Documented: CAPA follow-up. Source: simplerqms.com
Synergi Life (DNV)
Documented: Quality management and CAPA. Source: dnv.com
Tekmon
Documented: Cross-discipline quality and safety CAPA. Source: tekmon.com
1factory
Manufacturing buyers should test how 1factory QMS connects the relevant source record. 1factory licenses Quality Control, Supplier Collaboration and QMS as separate units, and its document, training and audit records sit in the QMS scope. A CAPA that starts from an out-of-tolerance measurement can therefore cross licence units; ask for the quote to name each one the loop uses (1factory supplier quality). Source: 1factory.com
Cority
Cority describes corrective and preventive action tracking within incident investigation, and its compliance management solution holds permits and compliance obligations (Cority permits and compliance obligations). Where actions must remain linked to site obligations, ask for a demonstration of that link and the full module quote, because presence in the CorityOne portfolio does not establish inclusion in one purchased package. Source: cority.com

One demo scenario: a rejected batch from NCR to a reopened CAPA

Record the nonconformance

Bring a rejected incoming batch with two deliveries from the same supplier. Link both findings without merging their individual traceability, and record immediate containment separately.

Restrict the disposition

Limit disposition to the approved role, record a rejected rework result, and record why a CAPA is or is not opened.

Assign and extend the action

Attach investigation evidence and assign an action with a named owner and acceptance criterion. Request a deadline extension and check that the original date, reason and reviewer are retained.

Return inadequate evidence

Submit incomplete evidence and have a reviewer return the action without losing the submission. Add a supplier response and check that its author can see only their own records.

Decide effectiveness, then let it fail

At the agreed review point, record the effectiveness decision. When the finding recurs, show how the record is reopened or linked to further work without losing the earlier decision.

Tests tied to the requirement text

10.2 a): log a correction on a rejected batch and close it without a CAPA; show where the decision not to act on the cause is recorded and who made it.

10.2 b): before accepting a cause, ask the system to find the same defect code on other lots, lines or sites, and keep the search result on the record.

10.2 d): try to close a CAPA with the effectiveness result blank. It should refuse, or record the exception with a named approver.

10.2 e): link the CAPA to a revised procedure and a new risk entry, then open each and navigate back.

ISO 13485 8.5.3: raise a preventive action on a potential failure and run a report that separates it from corrective actions.

Management review: produce the CAPA status and effectiveness summary the review needs straight from the records, with no spreadsheet in between.

Separate correction from effectiveness

The tests above are proposed demonstrations, not results from testing done for this guide. Run them on a copy of one of your real nonconformities, with the actual reviewer and supplier roles, and write down which configuration the vendor used and what stayed unresolved.

An effectiveness check needs a criterion set when the action is approved, not when it is closed: the defect rate, audit result or complaint count that should change, and the date it will be read. Ask the vendor to show where that criterion lives, whether the reviewer can differ from the action owner, and what the record looks like when the answer is no.

Questions to include in your RFP

Can duplicate reports be linked while preserving each original record?

Can disposition authority differ by site, product or risk class?

What happens if an offline observation uses an obsolete specification?

Can a reporter or supplier see status and attach evidence without seeing unrelated records or gaining internal review permissions?

Can an action be closed while a critical prerequisite remains open?

Does an API update preserve the responsible user, timestamp and source identifier?

Can you export attachments, deadline changes and verification decisions together?

Official sources and scope

20 sources, checked 17–25 Sep 2026

Selected product pages checked 19 September 2026; Cority's profile sources were checked 17 September 2026 and the Intelex application catalogue on 25 September 2026. Requirement text was read on 25 September 2026. Pricing, offline limits and each product's research dates are on its profile (the cards of the list above): EHS Insight, Effivity, Q-Hub, SimplerQMS, Synergi Life (DNV), Tekmon, 1factory, Cority. No new price verification, rating or hands-on test is claimed.

Product sources

Requirement sources

Use the demo checklist and total-cost worksheet to keep unresolved requirements visible.

More researched products for this process (26)

The rest of the list above: every other catalogue profile meeting the same tag-and-capability rule, in the same order, checked against the vendor's own documentation on the date shown. Not a recommendation or a complete market map; confirm the module and workflow with the vendor.

Software categories to explore

Use this Process to define the work, then explore these software types. Confirm the exact workflow and module with each vendor.

See all software categories

Nonconformance Report (NCR) Template
Free template for a nonconformance report.
Supplier Quality Scorecard Template
Free template for a supplier quality scorecard.
Incident Investigation Best Practices: Root Cause to Action
Article on incident investigation.
CAPA (Corrective and Preventive Action) — definition, software & FAQs
Definition of corrective and preventive action.
Root Cause Analysis (RCA) — definition, software & FAQs
Definition of root cause analysis.

Frequently Asked Questions

What is the difference between an NCR and a CAPA?

The NCR records the nonconformity and its handling. CAPA can provide a separate structured investigation and follow-up where your process requires it. Preserve links between them so closure of one record does not hide unfinished work in the other.

Should every NCR generate a CAPA?

Use your approved escalation criteria to decide. The software should record the decision and rationale rather than silently converting every report into the same investigation. Demonstrate both a simple correction and an escalated recurring problem.

Who can raise an NCR?

This depends on permissions, user roles and the purchased application. Ask each vendor to demonstrate operator, auditor and supplier access separately. Do not assume that mobile access means anonymous reporting or free external accounts.

What is verification of effectiveness?

It is a recorded check that the chosen action addressed the defined problem. Decide the method, reviewer and timing according to the issue. Finishing the assigned task and demonstrating effectiveness are separate decisions.

Does 21 CFR 820.100 still apply to medical device CAPA?

Not as a section of its own. Since the QMSR took effect on 2 February 2026, 21 CFR 820.10 requires a quality management system that complies with the applicable requirements of ISO 13485:2016, whose clauses 8.5.2 and 8.5.3 cover corrective and preventive action. Update RFP questions that still cite 820.100.

Does ISO 9001:2026 still require preventive action?

The harmonized structure that ISO 9001:2026 follows has no preventive-action clause; its guidance says actions on risks and opportunities under 6.1 are preventive in nature. ISO 13485:2016 keeps preventive action as clause 8.5.3, so device manufacturers still need it as a distinct record type.

Does a configured CAPA workflow make us compliant?

No. Clause 10.2 asks for decisions and evidence your people produce: the cause analysis, the effectiveness review and any change to the system. Software can hold them and block a closure without them; your procedure, reviewers and auditors decide whether they are adequate.

How should CAPA software prices be compared?

Quote the same record types (NCR, CAPA, supplier corrective action, change and training links), the same reviewer and supplier roles, and validation support where devices are in scope. Each product's profile records its published price conditions; one licence amount is not an implementation price.

Can CAPA work be done offline?

Treat capture and review as separate questions. The profiles record each product's documented offline limits; test a disconnected nonconformity capture separately from disposition, approval and effectiveness review, and ask which of those steps the proposed application supports without a connection.