Corrective and preventive action (CAPA)
Corrective and preventive action (CAPA) is the process for dealing with a problem: contain and correct it, find its root cause, remove that cause so it does not come back, and act on similar problems before they happen. Quality and security teams run it from one record per problem, which an auditor traces from trigger to closure.
- Short form
- CAPA
- Clauses
- ISO 13485:2016 8.5.2 · ISO 13485:2016 8.5.3 · ISO 9001:2015 10.2 · ISO 27001:2022 10.2 · ISO 9001:2015 6.1 · ISO 27001:2022 6.1
Where the term appears
ISO 13485:2016 is the one standard here that still names both halves as separate clauses: 8.5.2 requires a documented procedure for corrective action and 8.5.3 another for preventive action, each with records of what was found and done. ISO 9001:2015 10.2 and ISO 27001:2022 10.2 ask for corrective action only. Their preventive work moved into risk planning (ISO 9001:2015 6.1 and ISO 27001:2022 6.1), so a CAPA procedure written for them keeps the name without a preventive clause behind it.
Relabelled corrective actions
Medical-device auditors check that a preventive action is genuinely preventive: aimed at a potential nonconformity somewhere else, before it occurs. Retraining the person involved in last month’s failure is corrective, whichever box it sits in. The ISO 27001 improvement page walks through clause 10 in full.
How Sted uses it
- Sted’s knowledge base includes a Corrective and Preventive Actions record template, under its Corrective and Preventive Action Procedure.
- Records are part of the Full Management System plan.
- The Corrective and Preventive Actions record has ten sections, from describing the problem through containment, root cause, corrective and preventive actions and their effectiveness, to a review for closure.
- Records are part of the Full Management System plan.
Sted holds the CAPA record and tracks it to closure. Finding the cause and judging whether the action worked is your work, and the auditor tests it.
Related terms
- Corrective action: the half every standard requires.
- Preventive action: the half only ISO 13485 keeps as its own clause.
- Correction: the immediate fix, often confused with corrective action.
- Nonconformity: what usually starts a CAPA.
- Root cause: what the investigation has to find.
- Root-cause analysis for a CAPA: the task, step by step.