GMP ConsultantNL
Independent GMP Advisory
Quality · Quality system

CAPA

CAPA is the system for correcting the cause of a problem that has occurred (corrective action) and for preventing one that has not yet occurred (preventive action) — judged not by closure but by whether the problem stopped.

In one line

CAPA is the system for correcting the cause of a problem that has occurred (corrective action) and for preventing one that has not yet occurred (preventive action) — judged not by closure but by whether the problem stopped.

Plain-English explanation, then the primary regulation it comes from.

Explanation

Understanding capa

Three things get confused and are worth separating. Correction fixes the immediate instance: reject the batch, replace the gasket. Corrective action removes the cause so it does not happen again. Preventive action addresses a cause that has not yet produced a failure, usually identified from trending or from a problem seen elsewhere. Most sites do correction well, corrective action inconsistently, and preventive action rarely.

The step that decides everything is the effectiveness check, and it has to be defined before implementation rather than reverse-engineered at closure. 'Effectiveness confirmed' with no pre-defined measurable criterion is not evidence, and it is straightforward for an inspector to test: ask what the criterion was, when it was set, and what data was compared against it.

Retraining as a corrective action deserves particular scrutiny. Where a process invites an error, training a person not to make it is a delay rather than a correction. A deviation log where retraining appears repeatedly against similar events is a documented pattern of ineffective CAPA — which is read as a statement about the quality system, not about the individual events.

Backlogs are an arithmetic problem, not a discipline problem. Events arrive faster than they close, and teams then close the easiest items to show progress, leaving the queue weighted towards the difficult, high-exposure items that should have gone first. Triage by regulatory exposure before touching anything.

What it requiresThe substance of the requirement, stated plainly.
Correction ≠ corrective action
Fixing the instance is not the same as removing the cause.
Root cause first
A CAPA built on an unconfirmed cause is a guess with a due date attached.
Effectiveness criteria set in advance
Measurable, defined before implementation, checked against real data after it.
Proportionate to risk
The depth of investigation and action should track the exposure, not the paperwork template.
Visible to management
Overdue CAPAs and their ageing are reported into management review.
Where it goes wrongThe part a definition alone will not tell you.

Common failure modes

  • Closing on retraining without a confirmed root cause, which guarantees recurrence and documents the pattern.
  • Effectiveness checks written at closure to match whatever happened.
  • Clearing the backlog without repairing the intake process that produced it — which buys eighteen months at most.
  • Over-committing in a regulatory response, converting a quality problem into a missed commitment.
Primary sourcesAlways verify against the primary source before acting; guidance is revised.

Where this is written down

One GMP problem. Multiple perspectives.

CAPA seen from four accountabilities

Corrective and preventive action is where a quality system either learns or repeats itself. Its failure looks technical, reads financial, and lands operationally.

Quality

Effectiveness, not closure

“Did the action actually remove the cause?”

A CAPA is judged on whether the problem stopped, which requires a measurable effectiveness criterion defined before implementation rather than reverse-engineered at closure. Where the process invites an error, retraining a person not to make it is a delay rather than a correction.

Audit your own closed CAPAs for pre-defined criteria. Where retraining recurs against similar events, you have a documented pattern rather than a set of unrelated incidents.

GMP for Quality
CEO

Recurrence is a statement about the system

“What does a recurring failure say about the organisation?”

A repeat finding is treated far more seriously by an inspectorate than a first one, because it demonstrates the previous correction did not work. At executive level the signal is not the event but the pattern: an organisation that cannot make its own corrections hold is one whose assurances about anything else carry less weight.

Ask for recurrence rate and closure quality, not CAPA volume. Volume tells you about activity; recurrence tells you whether the system learns.

GMP for CEO
CFO

The same problem, paid for twice

“What is a backlog of open corrective actions costing?”

Each unclosed action carries QA oversight and management attention while it ages, and each recurrence costs the full investigation again. The cost is distributed across operational labour rather than appearing as a line item, which is why it is rarely totalled and rarely funded against.

Model the carrying cost of the current backlog against the remediation budget being proposed. The comparison is not spend against zero.

GMP for CFO
COO

Investigation is production time

“How much capacity is this consuming?”

Deviation and CAPA work draws on production, engineering and technical staff as well as QA. A backlog forms when events arrive faster than they close, and once it exists every hour spent on the queue is an hour not spent on the intake feeding it.

Triage by exposure rather than by ease, and repair the intake process — clearing a queue without fixing what produced it buys eighteen months at most.

GMP for COO
Recommended next stepsCAPA in the knowledge baseDeviationsGMP Readiness ScoreCost of Inaction Model
Related

Read next

Quality

Deviations

ReadQuality

OOS — out of specification

ReadQuality

Quality management system (QMS)

ReadQuality

Quality risk management (QRM)

Read

Looking for a definition rather than an explanation? The GMP glossary covers the abbreviations in one line each.

Applying this to your site

Knowing the requirement is not the same as closing the gap

If you want to know where your site actually stands against this, the readiness score covers seven quality-system domains in twenty questions, and takes about ten minutes.

Score your readinessDiscuss it with us