Corrective and preventive action (CAPA)

CAPA brings together two ISO 13485 clauses: corrective action for problems that already happened (8.5.2) and preventive action for problems that could happen (8.5.3). Both ask for the cause to be found, for an action that is proportionate to the effect, for a check that the action does not harm safety, performance or compliance, and for a review of whether it worked. Auditors usually look first at whether the real cause was found and whether anyone checked the effectiveness afterwards.

The organization shall take action to eliminate the cause of nonconformities in order to prevent recurrence.

ISO 13485:2016, clause 8.5.2

The organization shall determine action to eliminate the causes of potential nonconformities in order to prevent their occurrence.

ISO 13485:2016, clause 8.5.3

The EU MDR requires the quality management system to cover the management of corrective and preventive actions and the verification of their effectiveness (Article 10(9), point (l)), and its definition of corrective action already includes potential nonconformities. Under the FDA's QMSR, the CAPA requirements are ISO 13485 clauses 8.5.2 and 8.5.3, which took the place of the former 21 CFR 820.100.