Corrective and Preventive Action (CAPA)

Not all nonconformities are equal. An effective CAPA system uses a risk matrix to evaluate the severity and probability of harm, ensuring resources are focused on issues with the highest patient safety impact. This aligns directly with ISO 14971 risk management principles.

• High-risk issues (e.g., a diagnostic false-negative) trigger immediate action.
• Low-risk issues (e.g., a cosmetic UI glitch) follow a standard workflow.
• Prioritization prevents resource drain on trivial problems.

Correcting a symptom without addressing the source guarantees recurrence. A strong CAPA process mandates formal root cause analysis (RCA) using structured methodologies to drill down to the fundamental process or design failure.

• 5 Whys: Iterative questioning to peel back layers of symptoms.
• Fishbone/Ishikawa Diagram: Categorizing causes into groups like methods, materials, and machinery.
• Fault Tree Analysis (FTA): A top-down, deductive failure analysis for complex systems.

Every CAPA must define a concrete action plan with assigned owners and due dates. Critically, it must also include pre-defined effectiveness checks to verify that the implemented action actually solved the problem and did not introduce new ones.

• Actions are specific, measurable, and time-bound.
• Effectiveness is verified with objective data, not anecdotal evidence.
• A closed CAPA without a verified effectiveness check is a latent risk.

A CAPA is not an isolated event; it's a nexus connecting multiple QMS subsystems. An effective system maintains bidirectional traceability to the source nonconformance, related risk management files, and updated design history documents.

• Links to the Design History File (DHF) for design changes.
• Links to the Risk Management File to update hazard analyses.
• Provides a complete audit trail for regulatory inspectors, proving the loop was closed.

The 'P' in CAPA stands for Preventive. A mature system aggregates data from Post-Market Surveillance (PMS) , complaints, and service records to identify negative trends before they become widespread failures. This shifts the organization from a reactive to a proactive quality posture.

• Statistical process control on complaint data.
• Analysis of service and nonconformance records for weak signals.
• Initiating preventive actions based on trend thresholds, not just single events.

A corrective action often results in a design or process change. An effective CAPA system is seamlessly integrated with the change control process to ensure the fix is properly documented, verified, and validated before deployment, especially for SaMD where a software update is the deliverable.

• CAPA output feeds directly into a change order.
• Ensures changes are reviewed by the same cross-functional team.
• Prevents unauthorized 'quick fixes' that bypass design controls.

A formalized system documenting processes, procedures, and responsibilities for achieving quality policies. For SaMD, this is typically structured around ISO 13485. CAPA is a mandatory subsystem within the QMS that ensures feedback from post-market surveillance and audits results in measurable product or process improvements.

The non-fulfillment of a specified requirement. In the CAPA context, this is the triggering event.

• Sources: Audit findings, customer complaints, service records, or manufacturing deviations.
• Grading: Nonconformities are graded by risk (major/minor) to determine the urgency of the investigation.
• Distinction: A nonconformity is the problem; CAPA is the process to fix it and prevent recurrence.

A systematic problem-solving method used during the 'Investigation' phase of CAPA to identify the fundamental origin of a nonconformity, not just its symptoms.

• Common Tools: Fishbone (Ishikawa) diagrams, 5 Whys, Fault Tree Analysis (FTA).
• Goal: Distinguish between special cause variation (a one-off error) and common cause variation (a systemic process flaw) to determine if a preventive action is required.

The international standard for the application of risk management to medical devices. CAPA and risk management are deeply intertwined.

• Risk-Based CAPA: The severity of the risk associated with a nonconformity dictates the rigor of the CAPA investigation.
• Feedback Loop: If a CAPA reveals a previously unidentified hazard or an unacceptable residual risk, the Risk Management File must be updated immediately to reflect the new benefit-risk analysis.

The proactive, systematic process of collecting and analyzing real-world data on a device's performance after release. PMS is the primary input source for CAPA in the post-production phase.

• Data Sources: Complaints, Medical Device Reporting (MDR), and scientific literature.
• Trend Analysis: Statistical analysis of PMS data often reveals latent nonconformities that trigger a preventive action before a serious incident occurs.

A compilation of records that describes the design history of a finished medical device. When a CAPA identifies a design flaw, the DHF must be updated to reflect the design change.

• Traceability: The CAPA provides the justification for the design change, linking the identified nonconformity to the updated design outputs and verification/validation records.
• Audit Trail: Regulators inspect the DHF to ensure CAPA-driven changes were properly documented and re-verified.