Corrective and Preventive Actions (CAPA)

Abstract

Corrective and Preventive Actions (CAPA) are processes designed to improve quality and handle nonconformity as well as other undesirable situations. The CAPA processes should be well defined to support an effective and efficient project management process. When working with CAPA, corrective actions are defined as actions set in motion to eliminate a nonconformity or other unwanted situations which have already occurred, and preventive actions as actions set in motion to eliminate potential nonconformities or unwanted situations. CAPA is a mandatory part of the Quality Management System (QMS) for any pharmaceutical or medical device manufacturer reporting to the U.S. Food and Drug Administration (FDA). CAPA is also an integrated part of ISO:13485 and Good Manufacturing Practice (GMP) for medical products. The FDA defines the purpose of a CAPA procedure as: collecting and analyzing information, identifying and investigating product and quality problems, and taking appropriate and effective corrective and/or preventive action to prevent their recurrence. There are not a regulatory defined framework for the CAPA process only different requirements.

The purpose of this article is to give the reader an overview of the context in which CAPA is used, how to perform a CAPA, and which risks to be aware of. In this article a 7-step framework is presented. The steps include:

1. identification of the problem;
2. evaluation of the risk;
3. preparation of a procedure for the investigation;
4. analysis of the root cause(s);
5. action plan for corrective and/or preventive actions;
6. implementation of action;
7. follow-up.

CAPA in quality management

Quality management is the coordination of activities to control an organization with regard to quality. A frequently used definition of quality is defined by ISO 9000 as the degree to which a set of inherent characteristics of an object fulfils requirements. Quality is usually controlled through a QMS. A QMS consists of procedures, instructions, forms, and documentation for the organization’s activities in order to ensure quality goals and conformity. It is the QMS that dictates how the project quality management is handled.

Project quality management

CAPA projects are related to quality management of a product/system. Project quality management includes the processes for incorporating the organization’s quality policy regarding planning, managing, and controlling project and product quality requirements in order to meet stakeholders’ objectives. In the guide to the Project Management Body of Knowledge (PMBOK), project quality management is divided into three categories.

• Plan Quality Management
• Manage Quality
• Control Quality

The CAPA process can be used as a quality management approach when working with project management and is categorized under Plan Quality Management in PMBOK.

Continuous improvement

Project Quality Management also supports continuous process improvement activities. CAPA is categorized under the section Measurement, Analysis and Improvement in ISO:13485 and is closely related to continuous improvement processes. CAPA can be an alternative to processes such as the plan-do-check-act (PDCA) by Shewhart (modified by Deming), or other quality improvement initiatives such as Total Quality Management (TQM), Six Sigma, and Lean.

Regulatory authorities

CAPA is most commonly used in highly regulated industries and is a mandatory part of a QMS for any pharmaceutical or medical device manufacturer reporting to the U.S Food and Drug Administration (FDA) or who is compliant with ISO:13485 Medical Devices as well as European Pharmaceutical GMP and IATF. Procedures for corrective actions are also mandatory in the QMS for the majority of ISO management systems.

Table 1: The Regulatory context of CAPA

	Corrective Action	Preventive Action
Type of activity	Reactive	Proactive
Role in ISO 13485, FDA, IATF 16949, European Pharmaceutical GMP	Assessment of root cause and action plan to prevent recurrence	Assessment of root cause and action plan to prevent occurence
The majority of ISO management system standards	Assessment of root cause and action plan to prevent recurrence	Replaced by risk-based thinking and improvement.

The FDA require that CAPA procedure includes:

• Identifying existing and potential causes of nonconforming product, or other quality problems
• Identifying the cause of nonconformities relating to products, processes, and the quality system
• Identifying action(s) necessary to correct and prevent a recurrence of the problem(s)
• Verifying/validating the corrective and/or preventive action(s)
• Implementing and recording change(s) needed to correct and prevent the identified problem(s)
• Ensuring information related to the problem is shared with those directly responsible for assuring the quality
• Summitting relevant information for management review
• All activities above and their results, must be documented

The ISO:13485 requirements are somewhat similar to the FDA requirements. The CAPA procedure should include:

• Procedures for reviewing nonconformities
• Finding the root cause of the problem or determining potential nonconformites
• Evaluating the need for action to eliminate the nonconformity
• Planning and documenting action implemented
• Verifying the action does not adversely affect the ability to meet applicable regulatory requirements or the safety and performance of the product
• Reviewing the effectiveness of corrective or preventive action taken

The purpose of an efficient CAPA process

CAPA is designed to ensure quality and continuous improvement, which is especially important in the pharmaceutical and medical device industry since lack of process can have fatal consequences. CAPA is one of the most essential regulatory areas for both the FDA and ISO in pharmaceutical quality systems and for industries producing medical devices. The CAPA system is, in practical terms, always a part of the regulatory compliance audit and around 30-50 percent of nonconformances cited by the FDA are due to inadequate implementation of CAPA. In the worst case, the FDA can withdraw the certification that’s necessary to be able to sell on the U.S. market. The CAPA process is more demanding and rigid than other similar approaches, such as the PDCA. This is to ensure that all regulatory demands are fulfilled.

Due to the high level of regulatory requirements, the CAPA process can sometimes seem like a burden for the company. However, an efficient CAPA process can also help create value for the company, as it is effective in uncovering and solving quality problems. Solving the wrong problem or having recurring quality problems can be expensive for a company.

An efficient CAPA is a comprehensive procedure that collects and monitors information about existing and potential quality problems and allows for analysis and investigation of issues to identify root causes, and initiate actions to fix the problem..

The 7 steps of CAPA

To ensure that the CAPA process meets the regulatory requirements, different guides have been developed. The CAPA process is typically divided into 5-9 steps depending on the scope of each step. In this article, a 7-step framework is introduced. The steps include 1) Identification; 2) Evaluation; 3) Investigation; 4) Analysis; 5) Action Plan; 6) Implementation; 7) Follow-up. When CAPA is performed as a part of a regulatory requirement documentation of each step is crucial. When the CAPA is closed a report is written to ensure that the process is recorded. The CAPA process is typically managed by the Quality Assurance or Regulatory Affairs manager.

Step 1: Identification

The first step of the CAPA process is to identify, describe and document the problem. A nonconformity incident does not necessarily trigger a CAPA. However, it is necessary to evaluate every nonconformance and assess what actions are appropriate. Nonconformances can be identified from both internal and external sources, including, but not limited to:

• Service requests
• Internal quality audits
• Customer complaints
• Quality Assurance inspections
• Staff observations
• Trending data
• Risk assessment
• Management review
• Failure Mode Analysis
• Audit findings

When a problem is discovered, a clear problem statement should be written. It is important to precisely and completely describe the situation. The problem statement should include the source of the information, evidence of the problem and a detailed explanation of the problem. In this process, answering the following questions can be helpful.

Table 2: How to identify the problem

What	When	Where	Who	How much
Explain what happened or what you want to happen	When did the problem occur/was discovered?	Where was the problem found? (process, region, department, etc.)	Who is affected by the problem?	How much of a process, product, batch, etc. is affected?

Information about the problem will often be provided by different people in the organization, and it can be helpful to develop a standard procedure for collecting this data, and trying to reduce the workload for the employees. A well-defined problem statement is essential for the later work and the effectiveness of the CAPA process. As Charles Kettering, an American engineer and longtime director of research for General Motors Corp, emphasizes “a problem well-stated is a problem half-solved.”

Step 2: Evaluation

Here we evaluate the problem to determine why it’s of concern, and the impact and risk associated with the problem. This can be the possible impact on costs, function, product quality, safety, reliability, customer satisfaction, etc. The risks can be evaluated based on the probability/impact matrix which can be seen in Figure 1.

Figure 1: The probability/impact matrix.

This evaluation is used to decide the priority of the actions as well as the level of investigation. It makes it possible for management to better prioritize complaints, deviations, nonconformances, corrections, and removals. In some cases immediate corrective action is necessary until a thorough investigation has been conducted and permanent solutions can be implemented. The immediate corrective actions can, in some cases, be enough to correct the problem which eliminates the need for step 5 and 6. In other cases, it may be assessed that no action is required. If this is the conclusion, the justification must be documented.

Read more about impact and probability in risk assessment here.

Step 3: Investigation

Step 3 involved the formulation of a procedure for the investigation (analysis). High-risk investigations will have priority over low-risk situations. The purpose of the procedure is to ensure that nothing is overlooked in the investigation. The procedure should include information about, but not limited to:

• The objective for the actions
• Which resources are required (money, time, testing equipment, personnel, etc.)
• Who is responsible for conducting the investigation
• Which data is collected
• Instructions for determining the causes of the problem including a timeline.

The procedure requires a review of all circumstances related to the problem and must consider the following: external factors, software, training, design, procedures, personnel, materials and equipment. The level of investigation is determined based on the risk evaluation results or trend analysis results.

Step 4: Analysis

In this step, the investigation procedure is used to determine the root cause of the problem as well as any contributing factors. This is done by collecting all relevant data and investigating all possible causes through a Root Cause Analysis (RCA). A RCA is a systematic approach to finding the underlying (main) cause of a problem. When a root cause is properly managed, the problem doesn’t recur. In many pharmaceutical processes determining the actual cause of a problem can be a very demanding exercise. This is often due to a significant number of interacting issues. Different tools can, therefore, be helpful in supporting this step. The most typical tools include, 5xwhy and the fishbone diagram.

Figure 2: The 5xwhys & fishbone diagram.

5xwhy is a simple and very popular tool for RCA. To find the root cause, one has to ask what caused the problem, and question the answer five times. The 5xwhy approach can quickly be adapted and applied to most problems. There are three fundamental elements to effectively using the 5xwhy: 1) a clear statement; 2) honesty and the competencies for answering the questions; 3) determination to find the problem. The second method is the fishbone diagram (also known as the Cause and Effect Diagram), which can be used by itself or together with the 5xwhy. The fishbone diagram is used to identify different elements that could be the root cause, including sub-elements. The fishbone diagram is useful if many factors affect the problem. Here the investigation team can brainstorm contributing factors to the problem within each category. Human factors should not be identified as a root cause, rather as a symptom of an underlying problem.

Step 5: Action plan

When the root cause is identified, an action plan needs to be developed. The action plan determines which actions will be initiated, how, by whom, when and so on. The documentation of the actions that are initiated is important in order to have an effective follow-up. Examples of actions that can be initiated include: documentation/forms/instruction changes; procedural changes; employee training; or new equipment. A monitoring system or controls also need to be implemented to prevent the problem from recurring. An example of a CAPA action plan can be seen in table 3.

Table 3: corrective/preventive action plan

Root cause #	Action type (CA/PA)	Action/task to be completed	Action owner	Target completion date

One corrective action should be defined for each root cause. Actions such as: evaluate, analyse or assess are not adequate.[1] The degree of corrective and preventive actions taken to eliminate or minimize actual or potential non-conformities must be appropriate to the magnitude of the problem and proportional with the risks identified. It is necessary to validate that the proposed corrective and/or preventive actions will achieve the desired results. To review the action plan, the team should ask whether or not the proposed CAPA will address the associated root cause and if the CAPA plan provides sufficient detail of required actions, responsibilities, and realistic timescales.

Step 6: Implementation

In this step we implement the action plan. Documentation of each of the determined actions is important to ensure all actions are completed. When a plan has been completed, all activities should be verified by a party independent of the individual who has completed the task. A frequent problem observed by the FDA is that the corrective and preventive actions were not implemented. It is therefore important to define clear responsibility and apply a tracking system to verify the implementation.

Step 7: Follow-up

The last step of the CAPA process is a follow-up where the corrective or preventive action are evaluated. In the evaluation, the following questions need to be assessed:

• Have all changes been implemented and verified?
• Did the action correct or prevent the problem(s)?
• Have appropriate communication and training been implemented?
• Is there a chance that the actions have led to any additional adverse effects?

If the problem is still recurring the team has to go back to the analysis step, if the problem is lack of implementation this step needs to be repeated. When the CAPA is closed a CAPA Report should be written with records of each steps.

Summary

I figure 3 a simplified overview of each step and some of the most important deliverables are presented.

Figure 3: Overview of each step and important deliverables

Limitations and common problems

• Resource demanding process: The CAPA process demands a lot of resources and is best suited for highly regulatory industries where documentation, validation and procedures are extremely controlled. However, the process can be adjusted for other industries.

• The success of the CAPA depends on many different factors: The success of the process is dependent on a many other procedures within the company. This means that even if a suitable CAPA procedure is in place the outcome is not always useful. Good monitoring systems and process documentation is key for a successful CAPA.

• Correcting the symptoms instead of the cause: A typical problem in the CAPA process is that a symptom is fixed instead of the real root cause. A common mistake is to point to a human error as the root cause when this is merely a symptom. This can lead to overuse of retraining as a corrective action instead of correcting the underlying problem.

• Using “analyse,” “evaluate,” “assess,” or other synonyms as preventive actions: When using these phrases in the action plan, the process is postponed and often leads to that no real corrective and/or preventive action is implemented.

• Root cause identified but not corrected: Another typical mistake is that a root cause is identified but not corrected. This can be due to lack of control and follow-up. The problem can also arise from following the Pareto Principle and only fixing the prominent cause and not solving the problem.

• Lack of effective verification of the actions taken: It is important to make sure that the actions initiated actually will solve the problem. It can be expensive for a company to spend time and resources on implementing a solution that is not effective. Validation is also especially important to regulatory authorities.

• Time vs. adequate completion: The CAPA process can be time-consuming but many companies want the process to be done quickly. This contributes to ineffective CAPA systems. When planing the process time should given to complete each step thoroughly.

Other relevant Wiki articles

How to create a working CAPA team: Roles and responsibilities in project team.

How to control the scope of the CAPA project: Project Scope Management.

How to ensure control of the CAPA process: Project Control.

How to improve your CAPA processes: Lessons learned.

Brainstorming techniques for finding root cause: Brainstorming technique

How to perform a risk assessment: Impact and Probability in Risk Assesment

Annotated Bibliography

• CAPA for the FDA Regulated Industry, José Rodríguez-Pérez, 2011:This book contains a guidance to execute and improve the CAPA system. The book have focus on the FDA regulatory requirement, but include other regulatory areas such as ISO. The book also provide different forms that can be used in the CAPA process.

• CAPA in the Pharmaceutical and Biotech Industries – How to Implement an Effective Nine Step Program, Jackelyn Rodriguez, 2016: This book contains information on how to implement, develop and maintain an effective CAPA system and investigation program using a 9-step for medical device, pharmaceutical and biologic manufacturers, as well as any company or institution, which has to maintain a quality system.

• FDA website Corrective and Preventive Actions (CAPA): The FDA website have public information about what elements should be included in the CAPA process and which objectives the FDA is examines in a inspection.

• Root Cause Analysis – The core of Problem Solving and Corrective Action, Duke Okes 2019: In this book different methods to identifying and executing corrective actions is described. The book is especially helpful in the analysis step.