Preventive action
A preventive action is action that removes the cause of a potential nonconformity, before anything has gone wrong. ISO 13485 still requires a documented procedure for it. ISO 9001 and ISO 27001 dropped the separate clause and expect risk planning to do the same job.
- Clauses
- ISO 13485:2016 8.5.3 · ISO 13485:2016 8.4
Where the term appears
ISO 13485:2016 8.5.3 asks you to find the causes of potential nonconformities, decide whether action is needed, act in proportion to the possible effects, check the action does not harm regulatory compliance or device safety, review whether it worked, and keep records. Its usual inputs are the trends you analyse under ISO 13485:2016 8.4: complaints, service reports, process data and supplier performance. ISO 13485 improvement sets out the whole of clause 8.5.
Why the other standards let it go
ISO 9001:2015 and ISO 27001, from its 2013 edition, removed preventive action as a clause and built risk-based thinking into planning instead: the whole management system is meant to prevent problems. ISO 13485 kept its older structure because medical-device regulators expect a named preventive process. An auditor checks the preventive entries are genuinely preventive, aimed at a problem that has not occurred, rather than corrective actions filed under another heading.
How Sted uses it
- Sted’s knowledge base includes a Corrective and Preventive Actions record template, under its Corrective and Preventive Action Procedure.
- Records are part of the Full Management System plan.
- The Corrective and Preventive Actions record has its own Preventive Actions section, for action against potential nonconformities in neighbouring processes, systems or products, kept apart from the corrective actions for the problem that happened.
- Records are part of the Full Management System plan.
Related terms
- CAPA: the process that holds preventive and corrective action together.
- Corrective action: the same idea for a problem that has already happened.
- Nonconformity: the thing a preventive action stops before it occurs.
- Risk register: where ISO 9001 and ISO 27001 do preventive work today.
- How to run a risk assessment: finding problems before they happen.