What is CAPA? Corrective and preventive action, explained
CAPA stands for Corrective and Preventive Action — the structured process an organisation uses to fix a problem, find and remove the cause that let it happen, and prevent it recurring. It is the difference between wiping up the spill and finding the leak.
A correction fixes the immediate problem: rework the part, re-issue the drawing, ship the replacement. A corrective action removes the cause so the same problem does not come back. A preventive action removes a cause before a problem occurs at all.
A CAPA process runs through eight stages — identify, contain, investigate, analyse root cause, plan, implement, verify effectiveness, and close with lessons learned. It is required by ISO 9001 clause 10.2, ISO 13485, IATF 16949 and FDA 21 CFR Part 820, and it is the clause auditors most often raise findings against.
- 01CAPA = Corrective and Preventive Action; correction, corrective action and preventive action are three different things.
- 02No root cause, no CAPA — a fix without a verified cause is just a correction.
- 03Effectiveness verification, not implementation, is what closes a CAPA.
- 04Most CAPA systems fail on volume and evidence, not on intent.
What CAPA means
CAPA is an acronym for Corrective and Preventive Action. In a quality management system it is the formal process for responding to nonconformities, complaints, audit findings, deviations and adverse trends: you record what happened, contain the immediate impact, investigate until you can state why it happened, act on that cause, and then prove the action worked.
The term is used across ISO 9001, ISO 13485, IATF 16949, AS9100 and FDA 21 CFR Part 820. The wording differs — ISO 9001:2015 dropped the standalone "preventive action" clause and folded prevention into risk-based thinking under clause 6.1, while keeping corrective action in clause 10.2 — but the intent is identical everywhere: stop the problem, stop the cause, and show evidence that you did.
Correction vs corrective action vs preventive action
These three terms are used interchangeably in practice, and that confusion is why audit findings on CAPA are so common.
| Term | What it does | Worked example | Timing |
|---|---|---|---|
| Correction | Eliminates the detected nonconformity itself. No cause analysis. | Twelve welds failed radiography; the welds are cut out and re-welded, then re-shot. | Immediate — after the problem is found. |
| Corrective action | Eliminates the cause of the detected nonconformity so it does not recur. | Investigation shows the WPS allowed a preheat range the shop could not hold in winter. The WPS is revised, welders re-qualified to it, and preheat is added to the ITP hold points. | After root cause is established. |
| Preventive action | Eliminates the cause of a potential nonconformity before it occurs. | The same preheat risk is identified on three other projects using outdoor fabrication, and the WPS review is applied across all of them before any weld fails. | Before the problem occurs — driven by risk assessment or trend data. |
The eight stages of a CAPA
Whatever template you use — 8D, DMAIC, a CAPA form or a CPAR — the underlying sequence is the same.
- Step 01Inputs: NCRs, complaints, audit findings, deviations, trends
Identify and record
Capture the issue with facts: what, where, when, how many, detected by whom, against which requirement. A vague problem statement guarantees a vague root cause.
- Step 02Hours, not weeks
Contain
Protect the customer and the process while you investigate — quarantine suspect stock, check work in progress and delivered product, add temporary inspection.
- Step 03Decides CAPA vs correction-only
Assess risk and triage
Grade the issue on severity, frequency and detectability. Not everything deserves a full CAPA; a graded system keeps effort where the risk is.
- Step 04Typically 1–3 causes: occurrence, detection, systemic
Investigate root cause
Use a structured method — 5 Whys, fishbone/Ishikawa, fault tree — and test each candidate cause against the evidence. Stop when removing the cause would demonstrably have prevented the event.
- Step 05Hierarchy: eliminate > engineer > procedure > training > awareness
Plan the action
Define actions against each cause, with a named owner and a due date. Prefer controls that engineer the error out over controls that ask people to be more careful.
- Step 06Change control applies
Implement
Execute the actions and update everything they touch: procedures, control plans, ITPs, FMEAs, training records, drawings and supplier requirements.
- Step 0730/60/90 days is a common cadence
Verify effectiveness
Return after a defined interval and check the data — recurrence rate, audit sampling, process performance. Implementation is not effectiveness.
- Step 08Horizontal deployment is where the value multiplies
Close and share
Close with evidence attached, then apply the lesson horizontally to similar processes, products, sites and suppliers.
One nonconformity, followed through
A vendor surveillance inspector rejects a batch of coated spools: dry film thickness readings below specification on 9 of 40 units. Here is what each stage produced.
| Stage | Output |
|---|---|
| Problem statement | 9 of 40 spools on PO 4501 measured 180–210 µm DFT against a 250 µm minimum, detected at final inspection on 3 March. |
| Containment | Batch quarantined; previous two shipments recalled for DFT verification; 100% DFT inspection added pending closure. |
| Occurrence root cause | Spray operator worked to a wet-film target converted from an outdated volume-solids figure after the coating supplier reformulated the product. |
| Detection root cause | The ITP called for DFT at final inspection only — no in-process check after the first coat, so a whole batch could be coated wrong before anyone measured. |
| Systemic root cause | No process existed to review coating parameters when a supplier notifies a reformulation. |
| Corrective actions | Recalculate and re-issue the wet-film chart; add an in-process DFT hold point to the ITP; add supplier change notifications to the document control procedure with a mandatory parameter review. |
| Effectiveness verification | At 90 days: 6 subsequent batches, zero DFT nonconformities, in-process hold point signed on 100% of travellers sampled. |
Why CAPA systems stop working
- Everything becomes a CAPA. With no triage, the register fills with low-risk items and the serious ones get the same 20 minutes as the trivial ones.
- Root cause stops at the operator. "Human error" is a symptom; the cause is the condition that made the error possible or undetectable.
- Retraining as the default action. Training an operator on a procedure they already knew changes nothing about the system that allowed the failure.
- Closure on implementation. The action was done, the box was ticked, and nobody went back to see whether the problem recurred.
- No horizontal deployment. The fix lands on one line, one site or one supplier while the identical exposure sits untouched elsewhere.
- Evidence lives in email. When the auditor asks for the CAPA record, the story is reconstructed from threads rather than pulled from a register.
Ageing
Percentage of CAPAs open beyond their due date. Rising ageing means capacity, not commitment, is the constraint.
Recurrence rate
Nonconformities recurring after a closed CAPA. The single best measure of root-cause quality.
Effectiveness pass rate
CAPAs passing verification at first check. A low rate points at weak cause analysis upstream.
CAPA is a discipline, not a form
Most organisations already have a CAPA template. What separates a system that reduces failure cost from one that generates paperwork is discipline in three places: honest root-cause analysis, actions that change the process rather than the people, and effectiveness verification with real data before closure.
Need CAPA run to verified closure?
We run root-cause investigations, design the corrective actions and verify effectiveness independently — so closure means the problem stopped, not that the form was signed.
Already know the theory?
Our practitioner's guide covers CAPA at the working level — triage rules, investigation depth, action hierarchy and closure evidence.
Questions we get on this topic
What is CAPA?
CAPA stands for Corrective and Preventive Action. It is the structured quality-management process used to respond to a nonconformity or potential nonconformity: record the issue, contain its impact, investigate the root cause, act to remove that cause, verify the action was effective, and close with documented evidence. It is required by standards including ISO 9001, ISO 13485, IATF 16949 and FDA 21 CFR Part 820.
What does CAPA stand for?
CAPA stands for Corrective and Preventive Action. Corrective action removes the cause of a problem that has already occurred; preventive action removes the cause of a problem that could occur.
What is the difference between correction and corrective action?
A correction fixes the nonconformity itself — reworking a part, re-issuing a document, replacing a shipment. A corrective action removes the underlying cause so the same nonconformity does not recur. Reworking a failed weld is a correction; revising the welding procedure that allowed the failure is a corrective action.
What are the steps in the CAPA process?
A typical CAPA runs through eight stages: identify and record the issue, contain the immediate impact, assess risk and triage, investigate root cause using a structured method, plan actions with owners and dates, implement and update affected documents, verify effectiveness against data after a defined interval, then close and deploy the lesson horizontally.
Is CAPA required by ISO 9001?
Yes. ISO 9001:2015 clause 10.2 requires organisations to react to nonconformities, evaluate the need for action to eliminate their causes, implement that action, review its effectiveness and retain documented information as evidence. Preventive action is addressed through the risk-based thinking requirements in clause 6.1 rather than as a separate clause.
How long should a CAPA take to close?
There is no fixed rule, but most organisations set targets by risk grade — containment within 24 to 48 hours, root cause and action plan within 30 days, and effectiveness verification 30 to 90 days after implementation. What matters to an auditor is that target dates exist, are risk-based and are actually met.
What is a CAPA report?
A CAPA report is the record of a single corrective and preventive action: the problem statement, containment taken, the investigation and root-cause conclusion, the planned and implemented actions with owners and dates, the effectiveness verification evidence, and the closure approval. It is the document an auditor will ask for when sampling clause 10.2.
Turn your CAPA register into measurable improvement
We run independent root-cause investigations, design actions that change the process, and verify effectiveness before closure.