Every organization fixes problems. Far fewer can prove the problem is gone.
That gap is what the CAPA process exists to close. CAPA — corrective and preventive action — is the part of a quality management system that takes a problem you have already found, establishes why it happened, removes the cause, and then demonstrates with evidence that the fix held. It is the difference between a quality system that documents failures and one that eliminates them.
It is also, consistently, the part of the quality system that organizations get wrong. Not because the steps are complicated, but because the steps in the middle — the investigation and the effectiveness check — are the easiest ones to skip when a deadline is close.
This guide walks the CAPA process step by step: what each step produces, what an auditor looks for, and where the process most often breaks down.
What CAPA Is — and What It Isn’t
CAPA is two obligations packaged under one acronym.
Corrective action eliminates the cause of a nonconformity that has already happened, so it does not recur. Preventive action eliminates the cause of a nonconformity that has not happened yet, so it never occurs in the first place.
Neither one is the same as fixing the problem in front of you. That is a correction — sometimes called containment — and it is a legitimate, necessary first move. It is simply not corrective action, and treating it as though it were is the single most common reason CAPA records fail an audit.
The practical consequence is worth stating plainly: if your CAPA log is full of entries whose action field reads “replaced the part” or “reissued the document,” you do not have a CAPA process. You have a repair log with a CAPA label on it. An auditor will find that in about ten minutes.
Why the CAPA Process Is Where Quality Systems Fail
This is not a theoretical concern. It is the most reliably cited failure in regulated quality systems, and the public data is unambiguous.
In fiscal year 2025, FDA inspectors issued 2,660 device-related citations across 185 separate regulatory provisions. One provision accounted for more than a tenth of them.
Two things stand out. The first is the margin — the top finding is not marginally ahead of the others; it is a third larger than the next one down. The second is that CAPA appears twice in the top seven: once for the procedure itself and once for the documentation behind it. Roughly one in eight device citations that year traced back to CAPA.
Device manufacturers are simply the group whose inspection results are published. The failure pattern is not specific to them. In ISO 9001 certification audits, the equivalent findings look almost identical: a corrective action taken without a documented cause analysis, a root cause recorded as “human error,” a CAPA closed with no evidence that anyone checked whether it worked.
None of those are exotic problems. They are what happens when a process is followed in name and skipped in substance.
How Many Steps Are in the CAPA Process?
Search for this and you will find five-step, seven-step, and nine-step versions, all presented as definitive. They are not in conflict. The number is a packaging choice — whether containment gets its own step, whether planning and implementation are split, whether trending is counted as part of CAPA or as a separate input to it.
What does not vary is the underlying set of obligations. Every credible version requires you to find the problem, limit the damage, decide whether it warrants a formal CAPA, determine the actual cause, plan actions against that cause, carry them out, and prove they worked.
We use seven steps below because that grain maps cleanly onto both the practical work and the clauses an auditor will ask about. If your existing procedure uses five or nine, you do not need to renumber anything. Check that every obligation below is discharged somewhere in your process, and that the record proving it exists.
Step 1: Identify and Document the Problem
CAPA begins with a documented statement of what actually happened — not what someone thinks caused it.
The inputs are broader than most teams assume. Internal audit findings, customer complaints, nonconforming product, supplier failures, process monitoring data, employee observations, near misses, and management review outputs all feed the same funnel. So does trend data: a defect that is individually trivial but appearing weekly is a CAPA trigger, and failure to analyze quality data for exactly that pattern is a recurring inspection finding.
Write the problem statement in objective, measurable terms. “Batch 4471 failed dimensional inspection at 0.8mm over tolerance on 12 of 40 units, detected at final QC on March 3” is a usable problem statement. “Parts were out of spec” is not — it cannot be investigated, and it cannot be verified as resolved later.
Resist the urge to name a cause here. A problem statement that already contains a theory (“operator did not follow the work instruction”) will steer the investigation toward confirming it, and Step 4 becomes a formality.
Step 2: Contain the Immediate Damage
Before you understand why something happened, you limit what it can still affect.
Containment answers a narrow set of questions. What product, documents, or output are affected? Where are they now — in process, in finished stock, already shipped? Does anything need to be quarantined, recalled, reworked, or communicated to a customer? Who has the authority to make that call?
Containment is time-sensitive and should not wait on the investigation. It is also where the correction-versus-corrective-action confusion does real damage: containment closes the exposure, and it can feel like the problem is solved. It is not. The cause is still in place, and it will produce the same nonconformity again.
Record containment as containment. Keeping it visibly separate in the record is what lets you demonstrate later that corrective action was a distinct activity with distinct evidence behind it.
Step 3: Evaluate Risk and Decide Whether to Open a CAPA
Not every nonconformity deserves a formal CAPA, and a quality system that opens one for everything collapses under its own weight.
This step is a documented triage. Assess severity, frequency, detectability, and the consequences if the issue recurs — for the customer, for product safety, for regulatory standing, for cost. ISO 9001 frames this as proportionality: corrective action must be appropriate to the effects of the nonconformity encountered. A one-off cosmetic defect caught in process does not warrant the same machinery as a repeat failure that reached a customer.
Two rules make this step defensible. First, the criteria have to be written down in advance, so the decision is a policy being applied rather than a judgment being made under pressure. Second, the decision to not open a CAPA is itself a record. An auditor is entitled to ask why a given nonconformity did not escalate, and “we decided it was minor” is a much weaker answer than a completed risk screen with a signature on it.
Step 4: Investigate and Determine Root Cause
This is the step that separates a functioning CAPA process from paperwork, and it is the step most often cited as inadequate.
The failure mode is consistent: investigations stop at the first plausible explanation instead of continuing to the condition that allowed it. “Operator error” is the classic example. It is almost never a root cause. It is a symptom of something else — an ambiguous work instruction, training that was delivered but never verified, a process that permits the wrong action to be taken, a workload that makes the shortcut rational.
Choose the method to fit the problem rather than defaulting to the same tool every time.
Whatever method you use, the investigation has to produce a written causal chain — how the root cause led to the nonconformity — and an answer to a question teams routinely skip: does this cause exist anywhere else? The standard requires you to determine whether similar nonconformities exist or could potentially occur. That question is the bridge from corrective action into preventive action, and it is where a single investigation stops being a one-off fix and starts improving the system.
Step 5: Plan the Corrective and Preventive Actions
With a confirmed root cause, the plan writes itself in structure if not in content. Each action needs four things: what will be done, who owns it, when it is due, and how you will know it worked.
That last element is the one that gets left out, and leaving it out guarantees trouble at Step 7. Define the effectiveness criterion now, while the problem is fresh — before anyone has an interest in the answer. “Zero recurrences of this defect code across the next 90 days of production” is a criterion. “Confirm the issue is resolved” is not.
Separate the corrective actions from the preventive ones in the plan itself. Corrective actions attack the cause where it produced the failure. Preventive actions apply what you learned to the places it has not yet — the other production line, the other office, the other document that was written from the same flawed template.
Then check the plan for proportionality in the other direction. Actions that are disproportionate to the risk are as much of a problem as actions that are too weak: they consume capacity, they generate resistance, and they tend to be quietly abandoned, which leaves you with an open CAPA and no progress.
Step 6: Implement the Plan
Implementation is where CAPA meets the rest of the business, and where actions stall for reasons that have nothing to do with quality.
Most corrective actions touch controlled documents — a revised work instruction, an updated procedure, a changed inspection criterion, a modified form. That means change control, approval, distribution, and confirmation that the previous version is genuinely out of circulation. A revised procedure that lives on a shared drive while three departments still work from a printed copy is a corrective action that has not actually been implemented.
Training is the same story. Delivering training is not the action; verifying that the people doing the work can now do it correctly is. Keep the roster and the verification evidence with the CAPA record.
Track actions to completion against their due dates, and escalate the ones that slip. Overdue CAPA actions are a visible signal to any auditor that the process is not being managed — and management review is where that pattern is supposed to surface.
Step 7: Verify Effectiveness, Then Close
A CAPA is not finished when the actions are done. It is finished when there is evidence the actions worked.
Effectiveness verification means going back to the criterion you defined in Step 5 and testing it against real data after enough time has passed for the process to have had the opportunity to fail again. That interval depends on the process. For a daily production step, 30 days of clean data may be sufficient. For a quarterly reporting process, you need to have completed at least one full cycle — and closing before then proves nothing.
The evidence should be quantitative wherever possible: defect rates before and after, audit results, complaint volumes, process capability data. Re-inspecting one batch and declaring success is not verification.
If the criterion is not met, the CAPA does not close. It goes back to Step 4 — because a failed effectiveness check usually means the root cause analysis was wrong, not that the action was executed badly.
When it does close, the closure record should let someone who was not involved reconstruct the entire history: the problem, the containment, the risk decision, the investigation, the actions, the evidence, and the approval. That record is your proof of compliance, and it needs to still be findable three years later when an auditor asks for it — which is a document management problem as much as a quality one. Organizations running CAPA records through shared drives and email chains routinely find that the work was done and the evidence cannot be produced.
Finally, feed what you learned back into the system: update the risk register, revise the FMEA, and check whether the cause you found suggests a change to the quality management system itself.
What the Standards Require
The core obligations are consistent across frameworks, even where the clause numbers differ.
ISO 9001:2015 covers this in Clause 10.2, Nonconformity and corrective action. Clause 10.2.1 sets out what you must do; Clause 10.2.2 requires you to retain documented information evidencing the nature of the nonconformities, the actions taken, and the results of the corrective action.
One point about ISO 9001 catches organizations out. The 2015 revision removed preventive action as a standalone clause. Preventive action did not disappear — it moved, and is now carried by the risk-based thinking requirements in Clause 6.1. If you run a combined CAPA procedure, that is entirely acceptable, but be ready to show an auditor how your risk and opportunity work actually produces preventive actions rather than a register that gets refreshed annually and never acted on.
Other frameworks layer additional requirements on the same foundation. AS9100D carries ISO 9001’s Clause 10.2 and adds requirements at 10.2.1, including explicit attention to human factors as a cause. IATF 16949 requires documented problem-solving methodology at 10.2.3 and error-proofing at 10.2.4. For medical device manufacturers, the FDA’s Quality Management System Regulation took effect on February 2, 2026, restructuring 21 CFR Part 820 to incorporate ISO 13485:2016 by reference — which places corrective action at Clause 8.5.2 and preventive action, still a separate clause in that standard, at 8.5.3.
A note on timing: ISO 9001 is being revised, with the sixth edition scheduled for publication on September 16, 2026 and a three-year transition period expected to follow. ISO 9001:2015 remains the certifiable standard until that transition completes. Nothing in this guide depends on which edition you are certified to — the seven steps discharge the obligations either way — but if you are building or rebuilding a CAPA procedure this year, it is worth knowing the revision is imminent. Our guide to ISO 9001 requirements covers the current clause structure in detail.
Right-Sizing CAPA for a Small Quality Team
Most published CAPA guidance is written for large regulated manufacturers with dedicated quality departments. If you are a 120-person company where the quality manager also owns supplier relationships and internal audits, applying that guidance verbatim produces a process nobody can sustain.
Three adjustments make CAPA workable at that scale without weakening it.
Set the triage threshold deliberately. The risk criteria in Step 3 are what protect a small team from CAPA overload. Set them so that genuinely significant issues escalate and routine nonconformities are handled through nonconformance control — then apply them consistently. A team drowning in twenty open CAPAs investigates none of them properly.
Standardize the record, not the effort. One form, one place, consistent fields. The investigation depth should scale with risk; the structure of the record should not. Consistency is what makes the file auditable and what lets someone else pick up a CAPA when the owner is out.
Put the records somewhere they can be found and controlled. This is the practical failure we see most often at Abel Solutions — the process is sound and the evidence is scattered across personal drives and inboxes. A structured document management system with version control, approval workflows, and retention rules turns CAPA evidence from something you have to reconstruct into something you can produce on request.
Frequently Asked Questions
What are the steps in the CAPA process?
The CAPA process has seven steps: identify and document the problem, contain the immediate damage, evaluate risk and decide whether to open a CAPA, investigate and determine root cause, plan the corrective and preventive actions, implement the plan, and verify effectiveness before closing. Some procedures package these as five or nine steps, but the underlying obligations are the same.
What is the difference between correction, corrective action, and preventive action?
A correction fixes the nonconformity itself — reworking a batch, reissuing a report. Corrective action eliminates the cause of a nonconformity that has already occurred so it does not recur. Preventive action eliminates the cause of a nonconformity that has not occurred yet so it never happens. Confusing the first with the second is the most common reason CAPA records fail an audit.
How long should a CAPA stay open?
There is no universal figure, and setting an arbitrary deadline tends to produce premature closures. What matters is that the effectiveness verification period is long enough for the process to have had a real opportunity to fail again — typically at least 30 days of data for a high-frequency process, or a full cycle for a periodic one. Actions should have due dates and be tracked; the verification window should be set by the process, not by the calendar.
What is required for CAPA effectiveness verification?
Objective evidence, measured against a criterion defined before implementation, collected after enough time has passed to be meaningful. Quantitative measures are strongest: defect rates before and after, complaint volumes, audit results, process capability data. If the criterion is not met, the CAPA returns to root cause analysis rather than closing.
Does ISO 9001 still require preventive action?
Not as a standalone clause. ISO 9001:2015 removed the separate preventive action requirement and distributed it into the risk-based thinking requirements of Clause 6.1. The expectation still exists — you are required to determine and address risks that could cause nonconformities — but it is assessed through your risk and opportunity process rather than a dedicated preventive action clause.
Do we need CAPA software?
Not necessarily, and not first. A small organization can run a compliant CAPA process on well-designed forms in a controlled document repository. Software helps when volume, trending, and automated escalation become genuine constraints — but software applied to an unclear process reliably produces an expensive unclear process. Get the procedure, the triage criteria, and the record structure right, then decide whether tooling is the bottleneck.
Build a CAPA Process Your Auditor and Your Team Can Both Live With
The seven steps are not difficult. What is difficult is designing them so they get followed under real conditions — when the quality manager is stretched, the customer is waiting, and containment already made the symptom go away.
That is the part we help with. Abel Solutions has spent 30 years building quality and document systems for growing businesses in Atlanta and across the Southeast, and as part of SGS/ATS — a global testing, inspection, and certification organization — we bring the standards expertise alongside the systems that actually hold the evidence.
Whether you are building a CAPA procedure from scratch, cleaning up one that is not surviving audits, or preparing for ISO 9001 certification, our QMS consulting team can help you get there without enterprise complexity you do not need.
