CAPA in Pharma: Complete Guide to Root Cause and Effectiveness

In short: CAPA (corrective and preventive action) is the part of the quality system that makes sure a problem is fixed, and that it does not come back or appear somewhere else. A sound CAPA starts from a real root cause, is sized to the risk, is carried out through change control where needed, and is closed only after you have shown that it worked. This guide takes QA officers, production and QC staff and students through the whole cycle, with a fictional worked example, a form template and example KPIs.

What is CAPA?

CAPA is the system by which a company investigates the causes of existing or potential non-conformities and takes action to remove those causes. ICH Q10 (§3.2.2) describes it as a system to improve products and processes, built on the results of investigation and the understanding of root cause, with the amount of effort, formality and documentation matching the level of risk.

Three terms are often mixed up, so keep them apart:

A correction is not a CAPA. If the only response to an event is “batch rejected, operator retrained”, the cause is still there.

For the step-by-step procedure written as an example SOP, see CAPA process: step-by-step instructions. This guide is the wider view: where CAPAs come from, how to choose and judge them, and how to prove they worked.

Where CAPA comes from

ICH Q10 §3.2.2 expects the CAPA system to draw on a broad set of inputs. Typical sources, in practice, are:

• Deviations and investigations, including planned deviations and repeat events. See the deviation management guide.
• Out-of-specification (OOS) and out-of-trend results. See the OOS investigation guide.
• Customer complaints and quality defect reports. EU GMP Chapter 8 expects complaints and quality defects to be recorded, investigated and followed by appropriate action.
• Internal audits and self-inspections, supplier audits.
• Regulatory inspections and their findings, which ICH Q10 names specifically as an input.
• Trends from process performance and product quality monitoring, which ICH Q10 §3.2.2 also names as trends from process performance and product quality monitoring. In practice this includes stability trends and environmental monitoring trends.
• Annual product quality review (APQR) conclusions.
• Management review outcomes and risk assessments.

The same event can feed more than one source. Link the records, but run one investigation and one coordinated CAPA.

The CAPA process end to end

The process below is written so that it fits any site. The names of forms and the timelines will differ in your own quality system.

1. Initiation

A CAPA is opened when an investigation or review shows that action beyond correction is needed. Each CAPA needs a unique number, a clear problem statement, its source record (deviation, audit finding and so on), the date, the owner and the department. A good problem statement says what happened, where, when and how it was found, with no cause assumed. Compare:

• Weak: “Operator error during sampling.”
• Better: “On 12 March, three of ten sterile sampling bags in the QC micro lab were found with seal breaches at the time of use.”

Not every deviation needs a CAPA. A one-off event that is fully explained and has no systemic cause can be closed with correction alone, provided the reasoning is written down.

2. Risk-based prioritisation

ICH Q9(R1) Section 3 says the effort, formality and documentation of the quality risk management process should be commensurate with the level of risk. For CAPA this means the depth of investigation, the level of approval and the deadline should depend on the risk.

A simple scheme many sites use (example in-house criterion):

Choose targets your site can meet; a routinely missed target teaches people to ignore deadlines. For more on risk tools, see quality risk management in the pharmaceutical industry.

3. Root cause analysis

ICH Q10 §3.2.2 says the investigation should determine the root cause, and that the effort should match the risk. This is where most CAPAs succeed or fail: an action built on the wrong cause cannot work.

Tools that cover most cases:

• 5 Whys. Ask “why” repeatedly, each time answering from facts you can show, until you reach a cause that your organisation can control. Stop when the next “why” leaves your control or has no evidence. A single straight chain is a weakness.
• Fishbone (Ishikawa) diagram. Group possible causes under headings such as Man, Machine, Method, Material, Measurement and Environment. It is mainly a way to organise ideas, so each branch still has to be tested against evidence.
• Fault tree analysis. Start from the failure event and work downward through “and/or” logic to the combinations of causes that produce it. It suits complex or multi-factor failures, such as an equipment fault combined with a procedure gap.

The deviation management guide covers how to use these tools inside an investigation, and the example failure investigation SOP shows a typical structure.

Whatever the tool, test the conclusion. Ask: if this cause were removed, would the event have been prevented? Does the cause explain every observation, including why it happened on that day and not earlier?

4. Action plan

Write each action so that it can be checked. A useful test is SMART:

• Specific: what exactly will change.
• Measurable: how you will know it is done.
• Assigned: one named owner, not a department.
• Realistic: resources and approvals exist.
• Time-bound: a due date.

Separate the types of action: containment and correction (immediate), corrective actions (remove the cause) and preventive actions (extend to similar processes, products, lines or sites). Rank actions by strength. Changing the equipment, the process design or the system (for example a hard stop in the electronic batch record, or a physical poka-yoke that makes a wrong assembly impossible) is generally stronger than rewriting an SOP, and rewriting an SOP is stronger than retraining. Training alone should rarely be the whole CAPA.

5. Implementation and change control

Many CAPAs change something regulated: a procedure, a specification, a validated process, equipment or a computerised system. Those changes go through change control with impact assessment, and validation or qualification where needed, before they take effect. Link the CAPA record to the change control number so both can be traced. Track overdue actions, and if a due date must move, record who approved the extension and why.

Reference the evidence (approved documents, training and qualification records) in the CAPA record.

6. Effectiveness check

Completing the actions is not the same as solving the problem. The effectiveness check asks one question: did the problem stop? ICH Q10 Table II includes evaluation of the effectiveness of corrective and preventive actions as an element of the CAPA system in commercial manufacturing. Revised Schedule M (G.S.R. 922(E), Part I §1.5(s)) likewise expects deviations to be reported and investigated, the root cause determined, CAPA taken, and the effectiveness of that CAPA monitored.

How to design a good effectiveness check:

1. Define it when you write the plan, not at the end. Decide the measure, the period and the success criterion before the actions start.
2. Use objective data. Counts, rates, trend charts, audit results. “No recurrence observed” with no data is thin.
3. Allow enough time and batches. The check period must be long enough for the problem to show again if it is going to. A fault seen once a quarter cannot be judged in two weeks.
4. Match the check to the cause. If the cause was a procedure gap, check that the procedure is followed (observation, record review). If the cause was a design weakness, check the failure rate.
5. Decide in advance what happens on failure. A failed check reopens the root cause analysis; it does not trigger another round of training by default.

Examples (all example in-house criteria):

7. Closure

Close the CAPA only when all the actions are complete, the effectiveness result is recorded and QA has reviewed the evidence. The closure should state the outcome plainly: effective, not effective (reopened or new CAPA raised), or effective with a follow-up. Quality Assurance approves closure. The CAPA owner should not be the only person to close their own CAPA.

8. Trending and management review

Look at CAPAs as a population, not only one by one. Trend by source, area, product, root cause category, age and recurrence. Recurring root cause categories (for example “procedure unclear” or “equipment maintenance”) show where the system itself needs work. ICH Q10 §3.2.4 includes in management review of process performance and product quality the effectiveness of changes arising from CAPA, and also mentions commitments made to regulatory authorities (which is why missed commitments are worth tracking). The APQR is also a regular point to review the effectiveness of earlier actions. For a regulator or auditor, a trend report that shows the company noticed its own pattern is a strong sign of control.

Record retention. Keep CAPA records, investigation reports and their supporting evidence for at least 1 year after the expiry date of the respective product batch (EU GMP Chapter 4 §4.11, which sets 5 years after certification if longer; 21 CFR 211.180(a)), and longer if local law or the marketing authorisation requires.

“Human error” as a root cause

“Human error” is the most common root cause on CAPA forms and the one inspectors challenge most. EU GMP Chapter 1 §1.4 (xiv) asks that where human error is suspected or identified as the cause, this is justified, with care taken that process, procedural or system-based errors are not overlooked. Where the true root cause cannot be found, the most likely root cause(s) should be identified and addressed, and the effectiveness of CAPA should be monitored and assessed.

People do make mistakes, but a mistake is rarely the end of the chain. Ask what made the error easy and likely:

• Was the instruction unclear, long or contradicting another document?
• Was the layout, labelling or equipment design confusing?
• Was the operator overloaded, rushed or working with too few staff?
• Was training based only on reading, or was competence assessed?
• Could a check (second person, system block, barcode) have caught the error?

If the same type of error has happened with different people, the cause is not the people. Replacing “operator did not follow SOP” with “SOP step 7 allows two interpretations and the layout invites skipping the verification” gives you something that can be fixed and checked. Retraining alone, repeated for the same issue, is a typical sign of an unfinished investigation.

Common CAPA failures seen at inspection

The US 21 CFR Part 211 does not use the word “CAPA”, but its requirements for investigation and the quality unit lead directly to it. Under 21 CFR 211.192, any unexplained discrepancy or failure of a batch or its components to meet specification must be thoroughly investigated, whether or not the batch has already been distributed; the investigation must extend to other batches of the same drug product and other drug products that may have been associated with the failure or discrepancy; and a written record must include the conclusions and follow-up. Under 21 CFR 211.22(a), the quality control unit has the responsibility and authority to review production records to assure that no errors have occurred or, if they have, that they have been fully investigated.

Recurring weaknesses that auditors and inspectors write up, and the requirement they relate to:

• Investigation stops at the first plausible cause, often “human error” (211.192; EU GMP Ch. 1 §1.4 (xiv)).
• The investigation is not extended to other batches or products that may share the cause (211.192).
• CAPA is narrow and addresses only the single batch or line, without considering similar processes (preventive action in ICH Q10).
• CAPA is late, repeatedly extended or closed without evidence (21 CFR 211.192 follow-up; ICH Q10 §3.2.2).
• No effectiveness check, or a check that cannot fail (ICH Q10 Table II).
• Quality unit reviews that do not challenge the conclusions, or investigations closed by the same department that caused the event (211.22(a)).
• Repeat deviations with the same root cause and no link to earlier CAPAs.
• Inspection or audit commitments missed without notification.

Worked example (fictional)

This example is invented to show the flow. The product, dates and numbers are not from any real company.

Event. During packing of a fictional tablet, QA finds two cartons of Product X in a batch carrying a different strength label. The deviation investigation confirms the labels were issued from the wrong roll after a changeover.

Correction. The batch is placed on hold, 100% re-inspection is done, mixed cartons are segregated and destroyed, and the line is cleared again.

Root cause (5 Whys, summarised).

1. Why was the wrong label used? The roll from the previous batch stayed at the packing station.
2. Why was it there? The line clearance checklist asked “label area cleared” but not “unused rolls returned and reconciled”.
3. Why did the checklist not ask? It was written years ago for a single-strength line; strengths were added later and the checklist was not reviewed.
4. Why was it not reviewed? The change control for adding strengths did not include a review of line-clearance documents.

Root cause: the line clearance checklist and the change control template did not cover multi-strength packing. A fishbone confirmed no equipment or material cause. Operator fatigue was considered and rejected because the error occurred at the start of the shift after a normal changeover.

Actions (example in-house criterion).

Effectiveness check. Over the next 6 months, 100% of line clearance records for strength changeovers are reviewed by QA, and the number of label mix-up deviations is counted. Success criterion: zero label mix-ups and zero checklist non-compliances; any recurrence reopens the root cause.

Closure. After 6 months the data show no label mix-ups across 48 changeovers and complete checklists. QA closes the CAPA as effective and records the result in the quarterly trend report.

CAPA form template (example in-house criterion)

A simple record layout that can be adapted:

CAPA KPIs

Measure the system, not only individual CAPAs. Examples (all example in-house criteria; set your own targets):

Watch for gaming, such as splitting CAPAs to close them early or setting weak effectiveness criteria.

Frequently asked questions

What is the difference between corrective action and preventive action?

See the table in “What is CAPA?”: corrective action removes the cause of a problem that has happened, preventive action removes the cause of one that has not yet, and a correction only fixes the immediate result.

Does every deviation need a CAPA?

No. A fully explained one-off event with no systemic cause may be closed with correction only if that decision is justified in the record. Repeat events, events with product impact and systemic gaps normally need one. See the deviation management guide.

How long should a CAPA take?

Regulations do not fix a number of days. Set achievable targets by priority (see step 2); actions that need validation or a regulatory variation may legitimately take longer, but the plan should say so.

Is retraining a valid CAPA?

Only as part of one, when a knowledge or skill gap is evidenced (see the human-error section).

Can the same person own, approve and close a CAPA?

That is poor practice. Quality Assurance should independently approve the plan and the closure. Under 21 CFR 211.22(a) the quality control unit has authority to review production records to assure that, if errors have occurred, they have been fully investigated. Do not let the department that caused the event approve its own closure.

How is CAPA related to change control and risk management?

CAPA triggers change control when it alters a procedure, process or system, and quality risk management (ICH Q9(R1)) sets how deep the investigation goes and how fast action is needed.

References

1. ICH Q10, Pharmaceutical Quality System (2008), §3.2.2 Corrective Action and Preventive Action (CAPA) System and Table II. ich.org.
2. ICH Q9(R1), Quality Risk Management (adopted 18 January 2023), Section 3: Principles of Quality Risk Management. ich.org.
3. European Commission, EudraLex Volume 4, EU GMP Part I Chapter 1: Pharmaceutical Quality System (in operation from 31 January 2013), §1.4 (xiv).
4. European Commission, EudraLex Volume 4, EU GMP Part I Chapter 8: Complaints, Quality Defects and Product Recalls (in operation from 1 March 2015).
5. European Commission, EudraLex Volume 4, EU GMP Part I Chapter 4: Documentation, §4.11.
6. US FDA, 21 CFR 211.192, Production record review. ecfr.gov.
7. US FDA, 21 CFR 211.22(a), Responsibilities of quality control unit. ecfr.gov.
8. US FDA, 21 CFR 211.180(a), General requirements for records. ecfr.gov.
9. Ministry of Health and Family Welfare, Government of India, Drugs Rules 1945, revised Schedule M (G.S.R. 922(E), 28 December 2023), Part I §1.5(s). cdsco.gov.in.