What Is CAPA (Corrective and Preventive Action)?
Also known as: corrective action, preventive action, corrective and preventive action
Definition
CAPA is a closed-loop quality process: investigate a problem, find its root cause, implement corrective action to remove it and preventive action to stop similar problems, then verify the actions were effective. Required by ISO 13485 and FDA rules, expected under AS9100.
CAPA (Corrective and Preventive Action) Explained
Corrective action removes the cause of a nonconformity that has already happened. Preventive action removes the cause of a potential one. Together they form the CAPA system, which is triggered by NCR trends, customer complaints, audit findings, supplier failures or process data. The lifecycle is: raise and triage, contain, investigate root cause, plan actions, implement, verify effectiveness, close.
The step most often done badly is effectiveness verification. Closing a CAPA because the corrective action was implemented is not the same as proving the problem stopped. A sound CAPA defines in advance what evidence will show success, for example no recurrence of the defect across the next three production lots or 90 days, and a named person checks it before closure.
In regulated manufacturing the requirements are explicit. FDA 21 CFR 820 (and the QMSR that aligns it with ISO 13485) and ISO 13485 clause 8.5 require documented CAPA procedures. ISO 9001:2015 dropped the term preventive action as a separate clause and folded it into risk-based thinking, but AS9100 and customer-specific requirements still expect corrective action with root cause evidence.
ERP support varies. Infor SyteLine has corrective action tracking tied to quality records, Infor LN links quality problems to its quality management sessions, and many shops run CAPA in a dedicated QMS and reference the ERP part, lot and supplier. Whichever system holds it, linking the CAPA to the originating NCRs, the item master and the supplier record is what makes trend reports possible.
Why It Matters
- Auditors and customers read the CAPA log first. Late, repeated or poorly closed CAPAs are a common source of audit findings.
- Without CAPA, the same defect is dispositioned again and again, and scrap and rework cost keeps repeating.
- FDA warning letters regularly cite inadequate CAPA procedures, so it is a regulatory risk for medical device makers.
- Linking CAPA to NCRs and suppliers turns anecdotes into measurable defect trends by cause code.
In Practice
Six NCRs in a quarter show burrs on the same flange at deburr. Quality opens a CAPA, contains by adding 100 percent inspection, and runs a five whys analysis: the tool life counter was not enforced at the machine. The corrective action adds a tool change at a fixed part count in the CNC program and a work instruction update. Effectiveness check: zero burr NCRs on that part across the next 12 lots. Only then is the CAPA closed.
Frequently Asked Questions
What are the steps of a CAPA process?
Raise and triage the issue, contain it, investigate the root cause, define corrective and preventive actions, implement them, verify effectiveness against a pre-set criterion, then close with records.
Is preventive action still required in ISO 9001?
ISO 9001:2015 removed it as a separate clause and covers it through risk-based thinking and actions to address risks. ISO 13485 and many customer requirements still call for it.
When should an NCR escalate to a CAPA?
When severity is high, when the same cause recurs, when a customer or auditor raises it, or when the NCR count on one cause crosses a threshold you define.
Can the ERP run CAPA or do I need a separate QMS?
Some ERP quality modules handle basic corrective action tracking. Regulated companies often prefer a validated QMS for workflow, e-signature and audit trail, linked to the ERP by part, lot and supplier.
Related Terms
Non-Conformance Report (NCR)
A non-conformance report (NCR) is the formal record that a part, material, process or document failed a specified requirement. It captures what failed, how many, where, and the disposition decision (use as is, rework, repair, scrap or return to supplier).
Root Cause Analysis and the 8D Report
Root cause analysis finds the underlying reason a defect occurred, not just the symptom. The 8D report (eight disciplines) is the structured format automotive and aerospace customers use to document team, containment, root cause, corrective action and prevention.
ISO 9001
ISO 9001 is the international standard specifying requirements for a quality management system, enabling an organization to consistently provide products and services that meet customer and regulatory requirements and to improve through a process-based, risk-aware approach.
ISO 13485
ISO 13485 is the international quality management system standard for organizations involved in the design, production, installation, or servicing of medical devices, emphasizing regulatory compliance, risk management, and documented traceability throughout the product lifecycle.
FMEA (Failure Mode and Effects Analysis)
FMEA (Failure Mode and Effects Analysis) is a structured risk assessment that identifies how a product or process can fail, the effects and causes of each failure, and existing controls, then prioritizes actions to prevent the highest-risk failures.
Go Deeper
How to Manage Corrective Actions (CAPA) in SyteLine
Complete guide to managing CAPA (Corrective and Preventive Actions) in Infor SyteLine. Configure root cause analysis workflows, action tracking, effectiveness verification, and 8D problem-solving integration.
SyteLine Quality Management System Setup
Configure the SyteLine Quality Management System module for manufacturing compliance. Set up inspection plans, NCR tracking, and CAPA workflows in CloudSuite.
Infor LN Quality Management Module Guide
Infor LN Quality Management module guide: inspection orders, sampling, non-conformance and MRB flows, and AS9100D-aligned quality data manufacturers can audit.
Working with CAPA (Corrective and Preventive Action) in a live environment? Our engineers do this every day - and our AI agents automate most of it.