Skip to main content
    QHSEtech
    Updated
    All glossary terms
    Content date: · No individual check logged· AI use

    CAPACorrective and Preventive Action

    Definition

    Corrective and Preventive Action — a process for investigating actual or potential problems, assigning actions and checking their effectiveness.

    Editorial definition: The QHSE Standard, updated 3 October 2026 · https://qhsetech.com/glossary/capa

    Scope: A correction resolves an immediate problem; corrective action addresses its causes. The applicable quality system determines terminology and required records.

    Example for your evaluation: Follow a sample defect from correction to cause analysis, action owner and effectiveness review.

    What the sources say about corrective and preventive action

    CAPA is shorthand for a cycle that most quality, safety and environmental systems share: deal with the problem in front of you, find out why it happened, act on the cause, and check that the action worked. ISO's page for ISO 9001:2026 (Edition 6, published 16 September 2026) describes improvement as continually increasing the effectiveness of the quality management system based on the results of performance evaluation and other data. This page names standards by edition only and does not reproduce their clause text.

    OSHA's Recommended Practices for Safety and Health Programs put the same cycle in workplace terms. Whenever a problem is identified in any part of a programme, employers, with supervisors, managers and workers, should take prompt action to correct the problem and prevent its recurrence, and an evaluation should verify that actions are being taken that will prevent recurrence. OSHA's incident investigation page adds that investigations should focus on identifying and correcting root causes rather than finding fault, because that is what lets employers identify and implement the corrective actions needed to prevent future incidents.

    Where a product is regulated, the wording of the rule matters. For medical devices in the United States, FDA's final rule amending 21 CFR Part 820, effective 2 February 2026, works mainly by incorporating ISO 13485:2016 by reference. In its preamble FDA discussed whether the former section 820.100 requirements, to pass quality-problem information to those responsible and to submit corrective and preventive action information for management review, had been lost, and said it disagreed that their substance is not accounted for in ISO 13485. A device maker should read the current regulation and the incorporated standard, not an older checklist numbered after the former section. This is general information, not regulatory advice.

    Sources opened :

    What a CAPA record holds in software

    • The trigger and its source (audit finding, complaint, incident, inspection result or trend), linked to the original record rather than retyped.
    • The correction: what was done immediately to contain the problem and who approved it, kept apart from the corrective action so one cannot stand in for the other.
    • The cause analysis: the method used, the people who took part, the evidence examined and the cause or causes concluded, with room for the diagram or notes.
    • Actions with an owner, a due date and a type (corrective for an existing problem, preventive for a potential one), each extendable only with a recorded reason.
    • An effectiveness check defined at the planning stage (what will be looked at, by whom, when, and what result counts as success), followed by a recorded outcome that can reopen the record.

    CAPA, nonconformance report and complaint

    A nonconformance report (NCR) records that something did not meet a requirement and what was done with it. A complaint records a customer's report. A CAPA is the follow-on process that asks why it happened and what will stop it recurring. One NCR may need no CAPA, for instance a one-off slip whose cause is understood and contained, while a trend of similar NCRs, a serious complaint or an audit finding about the system itself may justify one. Write the opening criteria down.

    A hypothetical example: a labelling error that came back

    This case is invented to show the shape of a record and describes no real organisation. A small food packer finds at the end of a shift that a batch of jars carries last month's allergen statement. The line is stopped, the affected pallets are held and the labels are replaced. That is the correction, and it is recorded on the nonconformance report with the quantity, the lot numbers and the person who released the rework. The same error appeared twice earlier in the year and each time was closed as a one-off, so the quality lead opens a CAPA.

    The cause analysis finds that label files sit on a shared drive with no revision control and that operators choose the newest by date. One action moves label artwork under document control with an approval step and removes the shared copies; a second adds a line-clearance check at each changeover. Both have owners and due dates. The effectiveness check, written when the actions were planned, is to review every changeover for the next ten production runs and the label audit at the end of the quarter. Only when those show no repeat is the CAPA closed, and the closure note states what was looked at.

    Common misunderstandings about CAPA

    • Not every nonconformity needs a CAPA. Opening one for each small slip floods the process and hides the ones that matter, while opening none leaves trends unexamined. A written rule for when one is opened, applied consistently, serves better than either.
    • Completing the action is not the same as showing it worked. An action can be finished on time and still leave the cause in place, which is why the effectiveness check is a separate step with its own date and reviewer.
    • Retraining is a weak default. HSE's HSG245 notes that investigations concluding operator error was the sole cause are rarely acceptable, so ask what made the error likely, such as unclear instructions, layout or workload, before assuming that telling people again will hold.
    • Preventive action is not a second corrective action. It addresses a problem that has not yet happened, for example by learning from a near miss or a risk review, so it needs a trigger that is not a failure.

    How CAPA relates to other glossary terms

    CAPA sits downstream of detection and upstream of review, so its neighbouring terms mostly describe the step before or after it.

    • Root cause analysis: the cause-finding step inside a CAPA, with methods that range from a short chain of questions to a structured investigation.
    • Management review: where open and recurring CAPAs, trends and effectiveness results are examined by top management.
    • ISO 9001: the quality standard whose nonconformity and corrective-action records are the usual home of the term.

    Records and evidence that usually exist for CAPA

    • The written procedure that says when a CAPA is opened, who may open and close one, and how risk sets the depth of analysis.
    • For each record, the original finding, the correction, the cause analysis with its evidence, the planned actions and proof that they were completed.
    • The effectiveness check: the criteria set in advance, what was reviewed, the date, the reviewer and the result.
    • Decisions not to open a CAPA, with the reason.

    What a software tool needs to capture for CAPA

    • Separate fields for correction, cause and action, so that a containment step cannot be mistaken for a fix.
    • Linked records, namely the source finding, related CAPAs and the documents or training changed, that can be followed in both directions.
    • Effectiveness criteria entered when the action is planned, with a different person able to record the outcome and reopen the record.
    • Approval and closure steps with a named person and a time stamp, and a visible history of every status change, extension and reassignment.

    Catalog profiles documenting corrective and preventive action workflows

    Same rule for every product: tagged “CAPA Management”, with a sourced nonconformance or CAPA capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 34 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.

    Related software

    Frequently asked questions

    How is correction different from corrective action?

    Correction addresses the immediate problem. Corrective action addresses its causes to prevent recurrence.

    When should effectiveness be checked?

    Choose the method and timing based on the issue, risk and applicable process. Record the evidence and reviewer rather than assuming a fixed number of days.

    Which investigation method should I use?

    Choose a method proportionate to the problem and available evidence. A completed diagram alone does not validate a cause.

    Does every CAPA need a full root cause analysis?

    The depth should follow the risk and the evidence. A simple, well-understood cause may need a short written analysis, while a recurring or serious problem warrants a structured method. Record the reasoning either way.

    More quality terms

    Related guides