Corrective Action (CAPA)

Correction vs corrective action

The pair that trips up half of new implementers: correction deals with the symptom (rework the defective batch, retrain the one operator); corrective action deals with the cause (why did the process allow the defect — and change that). Auditors deliberately check whether your 'corrective actions' are actually just corrections wearing a bigger name.

Where did 'preventive action' go? The 2015-generation standards absorbed it into risk-based thinking — instead of a separate reactive procedure, prevention now lives up front in planning. The CAPA acronym survives in regulated industries (ISO 13485, FDA 21 CFR 820) where preventive action remains explicit.

The corrective action loop

The sequence every standard expects: react (contain and correct the instance) → evaluate (does the cause need eliminating? how far does it extend — could it be happening elsewhere?) → analyze the root cause → act on the cause → verify the action actually worked → update risks and the system if needed. Retained records of the whole loop are mandatory.

The most audited step is verification: an action closed the day it was assigned, with no evidence anyone checked it worked, is a finding waiting to happen.

Common audit findings about corrective action

The classics: root cause recorded as “human error” (that's a symptom — why did the error happen and propagate?); the same nonconformity recurring audit after audit with a fresh corrective action each time (proof the causes were never addressed); extension never evaluated (the cause was fixed on line 2 but lines 3 and 4 run the same process); and effectiveness verified by the same person who implemented the action on the same day.