CAPA Process: 15 Step-by-Step Instructions for Pharma QA

In short: CAPA (corrective action and preventive action) is a structured way to fix a confirmed quality problem and stop it coming back. This article gives a 15-step workflow, from raising the request to checking effectiveness. It is a general guide for QA staff and students, to be adapted under your own quality system.

Where CAPA fits

ICH Q10 (Pharmaceutical Quality System) lists a corrective action and preventive action (CAPA) system as one of the core elements of a pharmaceutical quality system. It expects CAPA to use investigation of complaints, rejections, non-conformances, recalls, deviations, audits, inspections and trends, with root cause analysis and an effectiveness check.

CAPA should be kept for systemic issues. Not every issue needs a CAPA; a minor, one-off event may be fixed by a simple correction or a deviation closure.

A note on regulations: for finished pharmaceuticals, the US GMP regulations are in 21 CFR Parts 210 and 211, and EU GMP is in EudraLex Volume 4. The term “CAPA” as a named subsystem comes from the US medical device rules (formerly 21 CFR 820.100). Since 2 February 2026 those device requirements sit in FDA’s Quality Management System Regulation (QMSR), which incorporates ISO 13485:2016 by reference; none of this applies to drug products. Pharma readers should treat it only as a reference model and follow the investigation and record requirements in 21 CFR 211 (for example 211.192, production record review and investigations), EU GMP Chapter 1 and ICH Q10.

The 15-step CAPA process

Phase A: Request and acceptance

1. Create the CAPA request and submit it for review. Identify and record the source of the issue, such as an audit, a customer complaint or a non-conformance. Corroborate the need and state clearly what the issue is and how it was found.
2. Review the request with the right people. Quality usually plays a key role (for example the quality manager), but other functions can take part. Many companies use a Management Review Board (MRB) or Quality Review Board (QRB). Holding such reviews at a regular frequency, for all quality events, helps you keep control.
3. Accept or reject the request. If rejected, document the reason and keep it with the records. If accepted, go to step 4.
4. Formally initiate the CAPA. Assign a unique tracking number and keep a clear trail so progress can be monitored. Inspection findings have been raised where CAPAs were not tracked and were left open indefinitely.

Phase B: Scoping and containment

5. Finalise the CAPA sources. List all products, processes, quality events and other inputs that contribute, so the investigation is complete and covers everything once.
6. Set up a cross-functional team. Treat the CAPA as a project. Once the sources, products and processes are clear, choose the functions needed, for example engineering, manufacturing, QC or regulatory affairs.
7. Identify immediate actions (corrections). Decide whether anything must be done at once, such as quarantining affected stock or, in an extreme case, considering a recall. This step is about containment: prevent the issue from continuing or spreading.

Phase C: Investigation and action plan

8. Investigate and capture findings. Look at product, process, people, and the what, where, when, why and how of the issue. Record all findings as you go.
9. Determine the root cause. Do not jump to this step before the investigation is done, or the “root cause” will only restate the problem. A wrong root cause leads to actions that do not fix anything. Use suitable root cause tools such as 5 Whys or fishbone (Ishikawa) analysis.
10. Develop an action plan. List the corrective and preventive tasks, with owners and deadlines. The plan is only as good as the root cause found in step 9. Do not drag the CAPA out longer than necessary.
11. Implement the action plan. Carry out the actions, such as updating procedures, redesigning a process or adding an inspection step. Document everything and make sure the changes will be sustained. Handle any change through change control.

Phase D: Approval and effectiveness

12. Review the CAPA for completeness. The cross-functional team and the MRB/QRB check whether the CAPA has been completed satisfactorily. If yes, move to step 13.
13. Approve the CAPA actions. Those with oversight (including QA) sign off the investigation and outcomes.
14. Define the effectiveness verification steps. Many companies skip this, but it is essential. Decide how you will prove that the actions worked, for each action taken. For example, if you added an inspection step, confirm it is controlling the issue as intended.
15. Verify the effectiveness of the CAPA. Carry out the planned checks and conclude whether the CAPA was effective, then close it. If not effective, reopen or raise a new CAPA.

Managing CAPAs

Tracking CAPAs on paper becomes hard as numbers grow: each is at a different stage, the log is easily buried, and management loses visibility. An electronic quality management system, or at least a controlled tracker with owners, due dates and status, helps to keep oversight and close CAPAs on time.

Sample SOP

An example SOP for CAPA is available for download: SOP for CAPA (Corrective and Preventive Action). It is an illustrative template only. Adapt it under your own quality system.

Frequently asked questions

What is the difference between correction, corrective action and preventive action? A correction fixes the immediate problem (for example quarantining a batch). A corrective action removes the cause of an existing problem. A preventive action removes the cause of a potential problem before it happens.

Does every deviation need a CAPA? No. Use CAPA for systemic or recurring issues, or where the risk justifies it. Minor, isolated events may need only a correction.

Is 21 CFR 820.100 applicable to medicines? It applies to medical device manufacturers. Drug manufacturers follow 21 CFR 210 and 211, and use ICH Q10 for the CAPA system concept.

How do I check CAPA effectiveness? Define measurable criteria and a time frame at planning, for example no recurrence of the same event over a set period, then review trend data and record the conclusion.

References

1. ICH, Q10 Pharmaceutical Quality System, Step 4, 4 June 2008 — section 3.2.2, Corrective Action and Preventive Action (CAPA) System.
2. US FDA, 21 CFR Part 211, Current Good Manufacturing Practice for Finished Pharmaceuticals — §211.192 Production record review.
3. US FDA, 21 CFR Part 820, Quality Management System Regulation (medical devices only; effective 2 February 2026, incorporating ISO 13485:2016) — shown for context.
4. European Commission, EudraLex Volume 4, EU GMP Guidelines, Part I, Chapter 1: Pharmaceutical Quality System (in force since 31 January 2013).