Corrective and Preventive Actions (CAPA)

Abstract

Corrective and Preventive Actions (CAPA) are procedures designed to handle nonconformity and other undesirable situations. In this context is corrective actions is defined as actions set in motion to eliminate an occurred nonconformities or unwanted situations, and preventive actions as actions set in motion to eliminate potential nonconformities or unwanted situations . CAPA is a mandatory part of the Quality Management System (QMS) for any pharmaceutical or medical device manufacturer reporting to the U.S Food and Drug Administration (FDA). CAPA is also an integrated part of ISO:13485 and Good Manufacturing Practice (GMP) for medical products. The FDA defines the purpose of a CAPA procedure as: collecting and analyzing information, identifying and investigating product and quality problems, and taking appropriate and effective corrective and/or preventive action to prevent their recurrence

The purpose of this article is to give the reader an overview on how to perform a CAPA and which risk to be aware of. In this article a 7 step framework is presented. The steps include 1) Identification; 2) Evaluation; 3) Investigation; 4) Analysis; 5) Action Plan; 6) Implementation; 7) Follow-up.

CAPA in quality management

Quality management is the coordinating of activities to control an organization with regard to quality. A typical way of controlling quality is through a QMS. A QMS consists of procedures, instructions, forms, and documentation for the organizations activities to ensure conformity.

Project quality management

CAPA projects are related to quality management of a product/system. Project quality management includes the processes for incorporating the organization’s quality policy regarding planning, managing, and controlling project and product quality requirements in order to meet stakeholders’ objectives. In the guide to the Project Management Body of Knowledge (PMBOK), project quality management is divided into three categories. 1) Plan Quality Management; 2) Manage Quality; 3) Control Quality. The CAPA process can be used as a quality management approach when working with project management. A quality management approach is a procedure that describes how quality will be managed in a given project and is categorized under plan quality management in PMBOK.

Continuous improvement

Project Quality Management also supports continuous process improvement activities</ref> and is categorized under plan quality management in PMBOK. CAPA is categorized under the section measurement, analysis and improvement in ISO:13485 and closely related to continues improvement processes. CAPA can be an alternative to processes such as the plan-do-check-act (PDCA) by Shewhart (modified by Deming), or other quality improvement initiatives such as total quality management (TQM), Six Sigma, and Lean .

Regulatory authorities

CAPA is most commonly used in highly regulatory industries and is a mandatory part of a Quality Management System (QMS) for any pharmaceutical or medical device manufacturer reporting to the U.S Food and Drug Administration (FDA) or who is compliant with ISO:13485 Medical Devices as well as European Pharmaceutical GMP and IATF. Procedures for corrective actions is also mandatory to include in the QMS for the majority of ISO management systems.

Table 1: The Regulatory context of CAPA

	Corrective Action	Preventive Action
Type of activity	Reactive	Proactive
Role in ISO 13485, FDA, IATF 16949, European Pharmaceutical GMP	Assessment of root cause and action plan to prevent recurrence	Assessment of root cause and action plan to prevent recurrence
The majority of ISO management system standards	Assessment of root cause and action plan to prevent recurrence	Replaced by risk-based thinking and improvement.

The FDA require that CAPA procedure includes:

• identifying existing and potential causes of nonconforming product, or other quality problems;
• identifying the cause of nonconformities relating to product, processes, and the quality system;
• identifying action(s) necessary to correct and prevent a recurrence of the problem(s);
• verifying/validating the corrective and/or preventive action(s);
• implementing and recording change needed to correct and prevent the identified problem(s);
• ensuring information related to the problem is shared with those directly responsible for assuring the quality;
• summitting relevant information for the management review;
• all activities above and their results, shall be documented .

The ISO:13485 requirements is somewhat similar to the FDA. The CAPA should system includes procedures for: reviewing nonconformities, finding the root cause of the problem or determining potential nonconformites, evaluate the need for action to eliminate the nonconformity, plan and document action implemented, verifying the action does not adversely affect the ability to meet applicable regulatory requirements or the safety and performance of the product, and reviewing the effectiveness of corrective or preventive action taken.

The purpose of an efficient CAPA process

CAPA is designed to ensure quality and continuous improvement, which is especially important in the pharmaceutical and medicine device industry since lack of control can have fatal consequences. CAPA is one of the most essential regulatory area for both the FDA and ISO in pharmaceutical quality systems and industries producing medical devices , . The CAPA system is practically always a part of the regulatory compliance audit and around 30-50 percent of nonconformance cited by the FDA is due to inadequate performance of CAPA. In the worst case can the FDA withdraw their certification, which is necessary to sell production on the U.S market. The CAPA process is more demanding and rigid than other similar approaches such as the PDCA. This is to ensure that all regulatory demands are fulfilled .

The 7 steps of CAPA

The CAPA process is typically divided into 5-9 steps depending on the scope of the steps. In this article a 7 step framework is introduced. The steps include 1) Identification; 2) Evaluation; 3) Investigation; 4) Analysis; 5) Action Plan; 6) Implementation; 7) Follow-up. When CAPA is performed as a part of a regulatory requirement such as FDA or ISO:13845 documentation through each step is crucial.

Step 1: Identification

The first step of the CAPA process is to identifying, describe and document the problem. A nonconformity incident does not necessarily trigger a CAPA. However it is necessary to evaluated every nonconformance and assess what action is appropriate. Nonconformance can be identified from both internal and external sources, including, but not limited to:

• service request;
• internal quality audits;
• costumer complaints;
• quality assurance inspections;
• staff observation;
• trending data;
• risk assessment;
• management review;
• failure mode analysis;
• Audit findings . .

When a problem is discovered, a clear problem statement should be written. It is important to precisely and completely describe the situation. The problem statement should include the source of the information, evidence of the problem and a detailed explanation of the problem . Here answering the following questions can be helpful.

Table 2: How to identify the problem

What	When	Where	Who	How much
Explain what happened or what you want to happen.	When did the problem occur/was discovered	Where was the problem found? (process, region, department, etc.)	Who is the problem affecting?	How much of a process, product, batch, etc. is affected?

Information about the problem will often be provided form different parts of the organization, and it can therefore be helpful to develop a standard procedure for collecting this data, and trying to reduce the work load for the employees. A well-defined problem statement is essential for the later work and the effectiveness of the CAPA process . As the cited quote from Charles Kettering emphasizes “a problem well-stated is a problem half-solved”.

Step 2: Evaluation

In step 2 the problem is evaluated to determine why the problem is a concern, and the impact and risk associated with the problem. This can be the possible impact on costs, function, product quality, safety, reliability, customer satisfaction, etc. . The risks can be evaluated based on the probability/impact matrix.

Figure 3: The probability/impact matrix </ref>,

The evaluation is used to decide the priority of the actions as well as the level of investigation. It makes it possible for management to better prioritize encountered complaints, deviations, nonconformance, corrections, and removals . In some cases immediate corrective action is necessary until a thorough investigation have been conducted and permanent solutions have been implemented. The immediate corrective actions can in some cases be enough to correct the problem which eliminate the need for step 5 and 6 . In other cases, it is assessed that no action is required. If this is the conclusion a justification must be documented.

Read more about impact and probability in risk assessment here

Step 3: Investigation

In step 3 a procedure for the investigation (analysis) if formulated. High-risk investigations will have priority over low-risk situations . The purpose of the procedure is to ensure that noting is overlooked in the investigation. The procedure should include information about, but not limited to: the objective for the actions, which resources is required (money, time, testing equipment, personnel, etc.), who is responsible for conducting the investigation, which data is collected, and instructions for determining the causes of the problem including a timeline , . The procedure require a review of all circumstances related to the problem and must consider the following:

• External factors
• Software
• Training
• Design
• Procedures
• Personnel
• Materials
• Equipment

The level of investigation is determined based on the risk evaluation results or trend analysis results .

Step 4: Analysis

In step 4 the investigation procedure is used to investigate the root cause of the problem as well as other contributing factors. This is done by collecting all relevant data and investigating all possible causes through a Root Cause Analysis (RCA). A RCA is a systematic approach to finding the underling (main) cause of a problem. When a root cause is proper managed the problem stops recurring . Different tools can be used to support this step. The most typical tools include, 5xwhy and fishbone diagram.

Figure 4: The 5xwhys & fishbone diagram.

Five whys is a simple and very popular tool for RCA. To find the root cause one has to ask what cause the problem, and question the answer five times. The five whys approach can quickly be adapted and applied to most problems. There are three fundamental elements to effectively using the five whys: 1) a good clear statement; 2) honesty and competencies to answer the questions; 3) determination to find the problem. The second method is the fishbone diagram (also known as the cause and effect diagram), which can be used by itself or together with the five whys. The fishbone diagram is used to identify different elements that could be the root cause, divided into different areas. The fishbone diagram are useful if many factors affect the problem .

Step 5: Action plan

When the root cause is identified an action plan needs to be developed. The action plan determine what actions will be initiated, how, by who, when and so on. The documentation of that actions are initiated is important to have an effective follow-up . Examples of actions that can be initiated includes: documentation/forms/instruction changes; procedure changes; employee training; or new equipment. A monitoring system or controls also need to be implemented to prevent the problem for recurrent.

Figure 6: corrective/preventive action plan

The degree of corrective and preventive action taken to eliminate or minimize actual or potential non-conformities must be appropriate to the magnitude of the problem and commensurate with the risks encountered . It is necessary to validate that the proposed corrective and/or preventive actions will achieving the desired results.

Step 6: Implementation

In step 6 the action plan is implemented. Documentation of each implementations is important to ensure all actions are completed. The documentation should be attached to a final report of this CAPA action. When a plan has been completed all activities should be verified by ta independent party from the individual having completed the task . A frequent problem observed by the FDA is that the corrective and preventive actions were not implemented. It is therefore important to appoint to define clear responsibility’s and apply a tracking system that can verify the implementation .

Step 7: Follow-up

The last step of the CAPA process is a follow-up where the corrective or preventive actions is evaluated. The purpose of this step is to check that all changes have been implemented and verified .

Figure x: Overview of each steps and important deliverables

Limitations

• Resource demanding process: The CAPA process is a resource demanding process and is most suited for highly regulatory industries where documentation, validation and procedures is extremely controlled.

• The success of the CAPA depends on a lot of different factors: The success of the process is depending on a lot of other procedures in the company. This means that even if a suitable CAPA procedure is in place the outcome is not always useful.

• Correcting the symptoms instead of the cause: A typical problems in the CAPA process is that a symptom is fixed instead of the real root cause. A common mistake is to point to a human error as the root cause when this is merely a symptom.

• Root cause identified but not corrected: Another typical mistake is that a root cause is identified but not corrected. This can be due to lack of control and follow-up. The problem can also arise by following the Pareto principle and only fixing the prominent cause and not solving the problem.

Other relevant Wiki articles

How to create a working CAPA team: Roles and responsibilities in project team.

How to control the scope of the CAPA project: Project Scope Management.

How to ensure control of the CAPA process: Project Control.

How to improve your CAPA processes: Lessons learned.

Annotated Bibliography

• CAPA for the FDA Regulated Industry, José Rodríguez-Pérez, 2011. This book contains a guidance to execute and improve the CAPA system. The book have focus on the FDA regulatory requirement, but include other regulatory areas such as ISO.

• CAPA in the Pharmaceutical and Biotech Industries – How to Implement an Effective Nine Step Program, Jackelyn Rodriguez, 2016. This book contains information on how to implement, develop and maintain an effective CAPA system and investigation program using a 9-step for medical device, pharmaceutical and biologic manufacturers, as well as any company or institution, which has to maintain a quality system.

• FDA website Corrective and Preventive Actions (CAPA). The FDA website have public information about what elements should be included in the CAPA process.

• Root Cause Analysis – The core of Problem Solving and Corrective Action, Duke Okes 2019. In this book different methods to identifying and execute corrective actions is described.