Corrective and Preventive Action, commonly referred to as CAPA, is a controlled quality process for investigating a quality problem, eliminating its cause, and preventing its recurrence or comparable problems. CAPA therefore combines root cause analysis, risk-based measures, documented implementation, and effectiveness verification within a quality management system.
Triggers and structured investigation
A CAPA may result from deviations, complaints, trends, audits, self-inspections, monitoring, supplier problems, or regulatory inspections. Not every individual error necessarily requires an extensive CAPA. First, the event is described, its scope and potential risk are assessed, and a decision is made as to whether a formal investigation is required. This decision must itself be traceable.
At the center is Root Cause Analysis, meaning the investigation of the underlying cause. It must not stop at an observable consequence or an individual error. Process design, responsibilities, training, system configuration, documentation, resources, and interfaces should be examined, for example. Data and evidence should support the chain of causation. Only when the cause is sufficiently understood can a measure be selected that genuinely addresses the underlying risk.
Correction, corrective action, and preventive action
A correction immediately eliminates a detected error, for example by correcting an incorrect entry or supplementing an incomplete document. It restores the target state in the individual case, but does not yet answer why the problem arose. A corrective action, by contrast, eliminates the cause of an identified nonconformity so that it does not recur.
A preventive action addresses a potential nonconformity or a comparable risk before an error has occurred. In current CAPA practice, preventive elements may also arise from trend data and risk assessments. ICH Q10 requires a CAPA system that identifies causes, establishes appropriate measures, and evaluates their effectiveness. Measures should be proportionate to the risk and must not create new, unassessed effects on quality or safety.
A robust CAPA record defines the problem, risk, cause hypothesis, measures, responsible persons, deadlines, and required approvals. Implementation may include changes to SOPs, training, systems, contracts, or controls. A deadline is not evidence of effectiveness. Delays, deviations from measures, and interactions with Change Control must be managed transparently.
Effectiveness verification takes place only at an appropriate point in time and on the basis of predefined criteria. It examines whether the cause has been eliminated and whether the problem remains absent under comparable conditions. Suitable approaches may include a repeat process review, metrics, sampling, audit follow-up, or trend analyses. If the effect is not achieved, the CAPA is not merely closed administratively but is reassessed and, where appropriate, expanded.
Distinction from deviation and audit finding
A deviation describes noncompliance with a requirement or the difference between the planned and actual process. It is often a trigger for an investigation, but is not the same as CAPA. An audit finding is the documented observation by an auditor based on audit criteria. A finding may also require CAPA, but the finding itself is neither a root cause analysis nor a measure.
CAPA is therefore the subsequent, controlled improvement process. It is intended not to replace a deviation or audit finding in wording, but to address its cause and risk of recurrence. Field safety corrective actions, by contrast, specifically concern the safety of products that have already been supplied and are subject to their own regulatory framework.
The decision on measures also takes possible secondary effects into account. A new additional control may, for example, extend processing times or shift errors to another interface. A good CAPA system therefore links measure planning with risk management and, where appropriate, with Change Control. Management needs information from CAPA trends on whether resources, processes, or training concepts need to be adjusted. Clear documentation also shows the difference between an merely overdue task and a nonconformity that has actually been investigated, justified, and effectively resolved. CAPA thus becomes a management tool for continuous improvement rather than a list of formal outstanding items.
The CAPA record must link the confirmed root cause, risk-based measures, responsibilities, deadlines, and effectiveness verification criteria. Only documented verification that the measure has eliminated the cause and prevented recurrence justifies closing the respective CAPA.
Relevance for clinical trials
In clinical trials, CAPA links quality problems with a verifiable improvement pathway. Relevant triggers include recurring protocol violations, delayed safety reporting, inadequate data reviews, or systemic deficiencies at service providers. ICH E6(R3) requires strategies to prevent, detect, correct, and prevent the recurrence of serious violations. The sponsor retains responsibility even when activities are delegated.
Full-service CROs such as Mediconomics support the triage of findings, the coordination of root cause analyses and risk-based CAPA plans, as well as the documentation and follow-up of measures. They can bring together monitoring, pharmacovigilance, data management, quality management, and project management so that effectiveness verifications are based on reliable data and open items remain transparent for audits or inspections.
Frequently Asked Questions (FAQ)
Is a correction already a CAPA?
No. A correction remedies the individual error. CAPA additionally investigates the cause and, where appropriate, establishes corrective or preventive actions with effectiveness verification.
When may a CAPA be closed?
Only when measures have been implemented, their effects have been assessed, and the predefined effectiveness verification criteria have been met, or when the reassessment has been justifiably documented.
Must every audit finding lead to a CAPA?
No. The risk and significance of the finding determine whether a formal CAPA is required. The decision must be documented with justification.
Regulatory references
- ICH Q10 Pharmaceutical Quality System – describes CAPA as an essential quality system element.
- ICH Q9 Quality Risk Management – requires a scientifically and risk-based approach to decision-making.
- ICH E6(R3) Good Clinical Practice – requires problems to be corrected and their recurrence to be prevented.