What is CAPA? Corrective and preventive action: steps and examples

An internal audit report contains this line: “Cold room temperature records missing, CAPA to be opened.” The quality officer has filled in the missing records, and the warehouse supervisor says, “Done.” But is that CAPA? In many organisations the term CAPA is used for very different things, from fixing the visible problem to work that gets down to the root cause. This ambiguity is the most common reason the same nonconformity turns up for the third time. In this article we answer “what is CAPA?” and explain how it differs from a correction, what its steps are and what it looks like in practice.

CAPA stands for “corrective and preventive action”: planned work carried out to remove the cause of a nonconformity (corrective) or to prevent a nonconformity that has not yet occurred (preventive), with a named owner and due date, and closed with evidence.

What is corrective and preventive action? How it differs from a correction

Three concepts get mixed up. Let’s separate them using the same fictitious incident: in a food warehouse, the cold room temperature form has not been filled in for three days.

A correction is unavoidable and often urgent, but on its own it does not count as CAPA. Organisations that make the correction and close the record find the same nonconformity again at the next audit.

CAPA steps: from nonconformity to closure

1. Define the nonconformity. What was expected, what was found, where and when? Note its source (audit, complaint, incident, measurement).
2. Make the correction. Limit the damage by fixing the visible problem.
3. Find the root cause. Keep asking “why?” with evidence until you reach the system-level cause; blaming a person does not count as a root cause.
4. Plan the action. Write down the measure against the root cause, the owner and the due date.
5. Implement and provide evidence. Attach documents showing the measure was carried out, such as a new form, a photo, a training record or a revised procedure.
6. Check effectiveness. A few weeks later, check whether the same problem has recurred.
7. Close. Close the record once its effectiveness is verified; if it is not, open a new action.

Of these seven steps, root cause and the effectiveness check are the ones most often skipped. When the root cause is skipped, the action targets the symptom; when the effectiveness check is skipped, closure becomes an assumption. Even for a small organisation, these two steps turn CAPA from form-filling into real improvement. Setting a due date matters just as much: an action without a date gets postponed until the next audit.

Let’s run the cold room example through the seven steps. During the weekly internal check, the temperature form is found to have been blank for three days; this is the nonconformity. The products are measured and checked, and the missing days are completed with a note; this is the correction. When the root cause is examined, it turns out the form hangs on the room door but is not on the shift handover list, it was never explained to the new employee and nobody is responsible for it. As a corrective action, the temperature record is added to the handover list, an owner is assigned and the item is added to the new-employee briefing. The evidence is the updated handover list and the signed briefing form. If the form is filled in completely a few weeks later, effectiveness is verified and the record is closed.

Examples of corrective actions

• Recurring delivery delays: a cut-off time is set in shipment planning and an owner is assigned to monitor delays.
• Expired fire extinguishers: inspection dates are put on a calendar and an inspection owner is named for each area.
• Complaint about the wrong product being shipped: a product code verification step is added during packing.
• Missing training records: a signature form becomes mandatory at the end of each training session and the trainer hands in the record.
• Recurring machine breakdown: the part is added to the preventive maintenance plan and a maintenance owner is assigned.
• Missing visitor records at reception: the record is put on a checklist and checked at shift handover.

Do you open a CAPA for every nonconformity?

No. Doing a root cause analysis for every deviation wears the team out and makes CAPA meaningless. Your organisation’s own criteria determine when a CAPA is opened. Commonly used criteria are: a CAPA is opened if the problem recurs, if its consequences are serious, if it is an audit finding or if it reveals a system gap that a correction cannot solve. For a one-off, minor deviation, a correction and a record may be enough; still, if the same issue comes up a second time, it should become a CAPA. Putting the criteria in writing also stops different supervisors from reacting differently to the same deviation: the same event no longer gets “let’s open a CAPA” from one supervisor and “let’s just make a note” from another. Once the criteria are clear, teams also find it easier to see which deviations they should report.

Common mistakes in CAPA

• Mistaking a correction for CAPA: completing the missing record and closing the job leaves the cause in place.
• Naming a person as the root cause: the answer “the employee was careless” neither fixes a system nor prevents recurrence.
• Treating training as the solution to every problem: training is sometimes needed, but often the real cause is a missing method, form or responsibility.
• Actions without a due date or owner: an action that does not say who will do it and by when does not happen by itself.
• Not checking effectiveness: a record closed simply because the action was done goes to the archive without anyone knowing whether it worked.

Who does what in the CAPA process?

Where does tracking CAPA in Excel, on paper and by e-mail fall short?

For a small company that opens a few CAPAs a year, an Excel list may be enough: columns for number, subject, owner, due date and status do the job. The trouble starts when the number of CAPAs and the number of people involved grow. No reminder arrives as the due date approaches, evidence stays in e-mail or in a folder, and the question “who closed it, and with what?” is answered from memory rather than from the record. With paper forms, it is hard to find the file and to see earlier CAPAs for the same nonconformity side by side. The biggest loss is that recurring nonconformities go unnoticed: each CAPA is closed individually, but the same issue lives on in separate rows.

CAPA in KurumsalPortal: from finding to evidenced closure

In the Internal Audit Management module, audits are linked to a plan and carried out with a checklist. Findings and nonconformities identified in an audit are recorded and linked to that audit, and for each finding a corrective action with a named owner and due date is opened. The action is closed by attaching evidence that it has been completed. Because findings stay linked to audits, you can track whether the same issue reappears in different audits, which helps you spot recurring risks early.

Preventive action, as used in this article, is a general management system concept; what the module covers is tracking the corrective action that arises from a finding, with an owner, a due date and evidence. To run actions alongside day-to-day work, the Task & Action Management module in the same portal also manages tasks with owner, due date, priority and status.

If you want to see your CAPAs in a single audit chain from finding to closure, take a look at the flow on the Internal Audit Management page.