In supporting medical device manufacturers through ISO 13485 audits, MDR technical file reviews, and post-market investigations, one pattern recurs with remarkable consistency: the Corrective and Preventive Action process is present in every quality management system, and it works correctly in almost none of them.

Not because the requirement is misunderstood: most quality managers can cite ISO 13485 clause 8.5.2 from memory.
Not because the tools are missing: most companies have CAPA forms, trackers, and review meetings.
The problem is structural: CAPA processes in medical device companies are almost universally designed to document responses to quality events. They are rarely designed to eliminate the conditions that produce them.

The numbers confirm this. In FDA fiscal year 2024, CAPA deficiencies ranked among the top two cited violations in medical device Warning Letters appearing in 47 Warning Letters issued to device manufacturers, nearly double the prior year’s 24.

Across fiscal years 2022–2024, CAPA deficiencies featured in approximately 60–64% of all enforcement actions.

CAPA has been a front runner in FDA deficiency rankings every year since 2015. (Source: ECA Academy Medical Device Warning Letter Statistics, FY2023/2024; FDA Warning Letter database: fda.gov/inspections-compliance-enforcement/warning-letters)

This article offers a practical framework for building a CAPA process that actually closes the loop and, equally importantly, one that knows when not to open a CAPA at all.

The most underaddressed question in CAPA management is not how to run the process. It is whether to run it at all. CAPA is a powerful instrument. Applied to events that do not warrant it, it consumes investigative capacity, creates regulatory commitments that cannot be fulfilled, and dilutes the system’s ability to respond meaningfully where it matters.

The core question before every CAPA decision: Is there a systemic cause at large that a corrective action could address? If the honest answer is no, the appropriate response is a correction with monitoring - not a CAPA.

A practical tiering framework helps:

Four criteria determine whether escalation to full CAPA is warranted:

• Criteria 1: Recurrence potential: Is there a plausible systemic cause that would produce the same event again?
• Criteria 2: Safety or regulatory significance: Does the event affect patient safety, product performance, or compliance?
• Criteria 3: Trend indication: Is this event part of an identifiable trend, even if individually minor?
• Criteria 4: Audit or regulatory origin: Was it identified by an internal audit, notified body, or regulatory authority?

Apply the four criteria independently to each quality event. If none of the criteria apply, corrective action with monitoring is sufficient. If even one of the criteria applies, a full CAPA process should be seriously considered. If two or more criteria apply to the same event simultaneously, a full CAPA process is mandatory without room for discretion.

Expert’s Secret #1: Document your triage criteria in your QMS procedure and require a triage decision record for every quality event including those that do not result in a CAPA.

A well-reasoned documented decision showing that a correction was sufficient demonstrates a more mature system than one that routinely escalates every minor event to full CAPA status.

One important caveat: the possibility to not open a CAPA must never become a convenient excuse to avoid one! The triage framework above is a decision tool, it is not an escape route. In practice, the temptation to classify a quality event as “isolated” or “random” is strongest precisely when the event is uncomfortable, the root cause is inconvenient, or the workload is high. These are exactly the conditions under which a genuine systemic problem is most likely to be lurking.

The appropriate safeguard in these situations is the documented triage decision with explicit and named criteria, conducted by someone with the authority and the independence to call it either way.

Every effective CAPA begins with a problem statement specific enough to be investigated: what happened, where, when, how often, what the impact is, and whether there is evidence of a pattern. If two investigators could reach two different root causes from the same problem statement, then the problem statement is not specific enough.

Once the problem is defined, the ensuing investigation must operate at three distinct levels. The level most consistently neglected being the third:

Cross-functional investigation is mandatory for systemic CAPAs. The cause of a quality event rarely sits within a single function. Investigating a product failure solely within the production function produces a production-level fix for a potentially multi-function problem.

Expert’s Secret #2: Structure your investigation record around three explicit sections (immediate cause, systemic cause, and detection failure) and require a named investigator from each relevant function to contribute and sign off on the respective section. This distributes accountability and prevents single-function cognitive bias.

Correction vs. Corrective Action?

A correction addresses the specific nonconforming item or event, and results are solving this specific nonconformity only, e.g. by reworking a defective part, re-releasing a document, or quarantining a batch. It fixes what went wrong this time. It can be done without asking why it went wrong this time, and it does not care about next time.

A corrective action addresses the root cause of the nonconformity like e.g., a process gap, a design weakness, a training deficiency, or a system failure that allowed the problem to occur in the first place. The purpose of a corrective action is to prevent recurrence.

Once the root cause is established at all three levels, corrective actions must address each level directly. A single action that addresses only the immediate cause without modifying the system that allowed it, is a correction (not a corrective action) regardless of what the CAPA record calls it.

For the immediate cause: What specific change to the product, process, or component will eliminate the detected failure mode?

For the systemic cause: What change to the management system prevents this class of failure from recurring in the future? This typically involves revising a procedure, redesigning a process control, or updating a training program, owned at the level of the process owner, not the operator.

For the detection failure: What monitoring or verification activity will catch this type of failure earlier if it occurs again?

Corrective actions must be specific, measurable, assigned to named individuals with defined completion dates, and connected explicitly to the cause they address. An action described as “sensitize staff on the importance of following procedures” addresses no documented cause and produces no verifiable outcome.

Expert’s Secret #3: For every corrective action, require the owner to document one sentence connecting it explicitly to the cause: “This action addresses [systemic cause] by [specific change], preventing [failure mode] from recurring because [mechanism].” If this sentence cannot be written, the action is not yet sufficiently defined.

Effectiveness Verification: Evidence, Not Optimism

Effectiveness verification is the step that distinguishes a CAPA process from a documentation exercise. Three things must be defined before implementation: what evidence will demonstrate the root cause is eliminated, how that evidence will be collected, and over what time period or sample size the evidence collection will span.

The verification method must match the action. If the corrective action is a procedure revision, effectiveness is not demonstrated by confirming the procedure was updated. It is demonstrated by evidence that the revised procedure is being followed and producing the intended outcome. Time horizons must be proportionate to risk level and process frequency. And the verification decision must be reviewed independently, not by the person who implemented the action.

Absence of evidence is not evidence of absence. A CAPA marked ‘effective’ because no further complaints were received in the following thirty days cannot be considered verified.

A mature CAPA process uses aggregated data as a signal about the health of the quality management system itself.

Three analyses are particularly productive:

1. Recurrence analysis: how many CAPAs address a root cause category that has appeared before? High recurrence signals that corrective actions are not reaching the systemic cause.
2. Detection stage analysis: at what stage are quality events being caught? Later detection suggests that upstream controls are deteriorating.
3. Function and process clustering: which areas generate disproportionate shares of the CAPA load? This reveals where systemic investment will produce the greatest return.

These analyses belong in the management review. Not as process compliance metrics, but as inputs to resource allocation: where to invest in process improvement, where to increase supplier oversight, where to revise training programs etc..

The preventive action half of CAPA (ISO 13485 clause 8.5.3) is almost universally the most neglected element. Preventive action requires prospective risk thinking and data sources that many organizations do not systematically exploit: near-miss reports, process monitoring trends, audit observation patterns, and post-market surveillance signals. The most productive single source is the internal audit program.

An audit observation that does not rise to the level of a nonconformance - a process showing signs of drift, a control that works but has never been tested under boundary conditions - is precisely the signal a preventive action process is designed to address.

Expert’s Secret #4: Report CAPA trends to management review in a format that answers one question: where should we invest in systemic improvement? Root cause category distribution, recurrence rate, and detection stage distribution are system health indicators. Closure rate and on-time completion are process metrics. Both are necessary; only the former drives improvement decisions.

ISO 13485:2016 clause 8.5.2 requires corrective actions appropriate to the effects of nonconformities, without undue delay, with documented procedures covering review, cause determination, action implementation, and effectiveness review. The standard does not prescribe methodology; it requires evidence of a functioning system.

EU MDR Article 10(9)(a) requires the QMS to include CAPA procedures addressing analysis of quality data and implementation of improvements. Notified bodies evaluate CAPA system functioning during conformity assessment. CAPA findings are among the most common sources of major nonconformances in MDR surveillance audits.

The common thread: a CAPA process must be demonstrably effective, not merely demonstrably present. The question a regulatory assessor asks is not “Does this company have a CAPA process?” but “Does this company’s CAPA process actually prevent recurrence?” Only the second question matters for patient safety.

A CAPA process that closes the loop does three things well and one thing wisely.

• It investigates at three levels: immediate cause, systemic cause, and detection failure.
• It defines corrective actions explicitly connected to the causes they address, and verifies effectiveness with real evidence against pre-defined criteria.
• It uses aggregated data to identify where systemic improvement is most needed.

Remember: The wise thing is knowing when not to open a CAPA at all.

A quality system that calibrates its responses adequately (applying corrections where sufficient, improvement actions where drift is the issue, and full CAPAs where systemic causes require elimination) will successfully direct its capacity where it has the greatest impact. Proportional responses using resources efficiently is the ultimate a sign of a mature CAPA system.

A CAPA process that only documents events is a cost. A CAPA process that eliminates their causes is an asset.

Dr. Hilke Sudergat is an independent consultant for Quality Management in medical devices and combination products, and the founder of Unternehmensberatung Dr. Hilke Sudergat (est. 2015). She holds a doctorate in chemistry (magna cum laude) from the University of Mainz, where she specialized in analytical chemistry and high-performance liquid chromatography under Prof. Klaus K. Unger.

Her professional career spans laboratory and departmental leadership roles as well as deep hands-on experience in quality management across IVDs, medical devices, and combination products - including CAPA management, complaint handling, change management, risk management (ISO 14971), technical documentation, design verification and validation, and usability engineering (IEC 62366). She is a certified ISO 13485 auditor (TÜV Süd) and holds a Green Belt in Lean Six Sigma.

In 2022, Hilke founded Sudergat QM Projects GmbH, built around her registered concept Audit ohne Drama® - a structured, practical approach to audit preparation and audit culture that helps medical device manufacturers face inspections with confidence, clarity, and without the organizational disruption that audits so often produce.

Hilke's consulting philosophy is direct and practical: quality management systems should work for the people who use them, not the other way around. She has a particular passion for designing QMS structures and procedures that are genuinely fit for purpose - lean where lean is appropriate, rigorous where rigor is required - and for helping quality teams build the skills and confidence to make their systems their own.

She is based in Germany and works with medical device and combination product manufacturers across the DACH region and beyond.