CAPA effectiveness checks: how to prove a corrective action worked

A CAPA effectiveness check is a planned, documented evaluation, carried out after a corrective or preventive action has been implemented, that shows with data whether the action removed the cause. In practice, that means the problem has not recurred, and the action has not created a new one. To make the check convincing, decide three things when you plan the action, not when you want to close it: what you will measure, what result counts as success, and over what period or number of opportunities you will measure it.

This guide explains the regulatory basis, how to design measurable criteria and choose timeframes, which data sources work, and what to do when a check fails. Worked examples are included, and all of them are illustrative.

What is a CAPA? Correction, corrective action and preventive action

CAPA stands for corrective action and preventive action. The three terms below are often blurred, and that confusion is the root of many weak CAPAs. ISO 13485 and the FDA’s Quality Management System Regulation (QMSR) both use the ISO 9000 definitions; the QMSR final rule confirms this for these three terms.

• Correction deals with the nonconformity itself: rework, scrap, relabelling, repair. It fixes this batch or this device.
• Corrective action eliminates the cause of a nonconformity that has occurred, so that it does not recur.
• Preventive action eliminates the cause of a potential nonconformity, so that it does not occur in the first place.

An illustrative example: a carton is printed with the wrong expiry date. Re-labelling the affected stock is a correction. Adding a second-person verification of variable data to the line clearance, after finding that the date was keyed in manually without a check, is a corrective action. Applying the same control to two other packaging lines that use the same manual entry is a preventive action.

Only the corrective and preventive actions need an effectiveness check. A correction is verified when it is done.

What the regulations require

Medical devices: QMSR and ISO 13485

Since 2 February 2026, 21 CFR 820.10 has required device manufacturers to document a quality management system that complies with ISO 13485:2016, which is incorporated by reference. Clause 8.5.2 (corrective action) requires a documented procedure that includes verifying that the action does not adversely affect regulatory requirements or device safety and performance, and reviewing the effectiveness of the action taken. Clause 8.5.3 sets out parallel requirements for preventive action. In the QMSR final rule, FDA states that manufacturers "must verify or validate corrective and preventive actions to ensure that such actions are effective and do not adversely affect the finished device". Our article on the FDA QMSR and ISO 13485 covers the wider changes.

Medicinal products: ICH Q10 and EU GMP

ICH Q10 section 3.2.2 describes a CAPA system fed by complaints, product rejections, nonconformances, recalls, deviations, audits, inspections and trends. The investigation effort should be "commensurate with the level of risk". For commercial manufacturing, the guideline adds that "the effectiveness of the actions should be evaluated".

EU GMP Chapter 1, section 1.4(xiv), requires the effectiveness of CAPAs to be "monitored and assessed, in line with Quality Risk Management principles". Section 1.10(iv) requires the product quality review to cover the effectiveness of CAPAs arising from significant deviations. Chapter 8, section 8.18, applies the same expectation to CAPAs raised from quality defects.

None of these texts prescribes a method, a timeframe or a template. That is left to your procedure. So the effectiveness check has to be justified on its own merits.

Verifying implementation is not the same as verifying effectiveness

Many CAPA records close with evidence that the action was done: the SOP was revised, the training was completed, the new sensor was installed. That is verification of implementation. It is necessary, but it does not show that the cause has gone.

Effectiveness asks a different question: given the opportunities for the problem to recur since the action, did it? Did anything else get worse? A revised SOP that nobody can follow, or a sensor that triggers false alarms every shift, passes implementation verification and fails effectiveness.

Designing effectiveness criteria up front

Write the effectiveness criteria into the CAPA plan, approved by QA, before implementation starts. If the criteria are written at closure, they tend to be shaped by whatever data happens to be available. Inspectors notice.

A good criterion answers six questions:

1. What exactly will be measured? Name the specific failure mode, not "quality improves".
2. What is the baseline? For example, the number of occurrences per 100 batches in the 12 months before the action.
3. What result counts as success? For example, zero recurrences, or a rate below a stated threshold.
4. Where does the data come from? Name the system, report or record.
5. Over what period or number of opportunities? See the next section.
6. Who evaluates it, and who approves the conclusion?

Also check for unintended consequences. Clause 8.5.2 of ISO 13485 explicitly asks whether the action adversely affects safety, performance or regulatory compliance. A useful criterion pairs "the problem did not recur" with "no new related problems appeared".

Choosing the right timeframe

The period should be long enough for the problem to have had a fair chance to recur. Count opportunities, not calendar days. Some practical rules:

• For high-frequency processes, define a number of batches, runs or units. Illustrative example: no recurrence in the next 30 packaging runs.
• For low-frequency events, extend the window, or add a targeted challenge. Illustrative example: an annual shutdown procedure can be checked with a walkthrough or simulation, then confirmed at the next real shutdown.
• For seasonal causes, such as humidity or temperature, cover the season in which the problem occurred.
• Use "whichever is later" when both conditions matter. Illustrative example: 20 batches or three months, whichever comes later.

Avoid a single default, such as "90 days" for every CAPA. Its length usually has nothing to do with how often the failure can occur. Choose a period that fits the risk and frequency of each problem, and state the reasoning in the CAPA plan.

Data sources that make good evidence

Prefer objective data that already exists and is captured independently of the CAPA owner:

• Deviation, nonconformance and complaint trends for the specific failure mode
• Batch record review findings and right-first-time rates
• In-process control and finished product test results, or process capability for the affected parameter
• Environmental monitoring data for contamination-related CAPAs
• Internal audit or targeted follow-up audit results
• Direct observation of the task, documented against a checklist
• Supplier incoming inspection results, for supplier-related CAPAs

Training records and quiz scores show that training happened and was understood. They do not show that the failure has stopped. Use them as implementation evidence, alongside a measure of the process outcome.

Worked examples (illustrative)

Environmental monitoring excursions after cleaning. Investigation links repeated action-limit excursions on a filling-room surface to an inadequate contact time for the disinfectant in the cleaning procedure. The action is to revise the procedure and the cleaning log so that contact time is recorded. Effectiveness criterion: no action-limit excursions, and no upward trend in alert-level results at the affected locations, across the next three months of routine monitoring. Data source: the environmental monitoring trend report.

Line clearance misses. Three deviations in a year show that leftover labels from the previous product were found after line clearance. Root cause: the checklist did not cover the area under the conveyor guard. The action is to redesign the checklist and add a photo reference. Effectiveness criterion: no line clearance findings in the next 40 changeovers, confirmed by QA spot checks on ten of them.

Device complaint. Complaints about a loose connector are traced to a torque setting that was not controlled in the work instruction. The action is to define the setting, verify the tool and update the instruction. Effectiveness criterion: no complaints coded to this failure mode for units built after the change, over a period based on typical time-to-complaint. In-process torque results must also stay within limits.

Why "retrain the operator" rarely passes

Retraining is the most common corrective action and the one auditors trust least. Usually it addresses the person who was there, not the conditions that made the error likely. EU GMP Chapter 1 requires that where human error is suspected or identified, the conclusion is justified, and that process, procedural or system-based errors are not overlooked.

Before choosing retraining, ask:

• Was the instruction clear, current and available where the work happens?
• Was the error easy to make, for example because of similar-looking materials, manual data entry or a confusing form layout?
• Have other people made the same error?
• Would a design change, such as an interlock, a mandatory field or a second-person check, make the error harder to commit?

Retraining is appropriate when a genuine knowledge gap is the cause. In that case, pair it with an outcome measure, and manage it within your GxP training matrix so that the training reaches everyone who does the task, not only the person involved.

When the effectiveness check fails

A failed check is useful information, not a paperwork problem. Handle it openly:

1. Record the result honestly against the original criteria. Do not redefine success after the fact.
2. Reopen the investigation, or open a new one linked to the original. The first root cause was probably incomplete or wrong.
3. Reassess the risk and containment. Has product been affected in the meantime?
4. Define a new action with new effectiveness criteria.
5. Report the failure in management review and in the trend data.

Avoid extending the monitoring period repeatedly in the hope that the numbers improve. If you need an extension, document a scientific reason for it.

Why CAPA draws so many inspection findings

FDA's published inspection observation data show how central CAPA is for device makers. In fiscal years 2024 and 2025, the most frequently cited device observation on system-generated Form FDA 483s was 21 CFR 820.100(a), the former Quality System Regulation's requirement for CAPA procedures. It was cited 254 times in FY2024 and 279 times in FY2025. FDA notes that the data does not include manually prepared 483s. Since 2 February 2026, device inspections assess CAPA against ISO 13485 clauses 8.5.2 and 8.5.3 through the QMSR, but the underlying expectation of a working, effective CAPA process is the same. On the drug side, the investigation requirement in 21 CFR 211.192 was among the most cited observations in the same years. Deviation investigations feed CAPA, so the two are closely linked. Our guide to GMP deviation management covers that side.

What auditors and inspectors look for

• Effectiveness criteria defined before implementation, and approved
• A clear distinction between correction, corrective action and preventive action in each record
• Evidence of effectiveness from outcome data, not only from completed tasks
• Timeframes justified by risk and by the number of opportunities for recurrence
• Recurrences linked back to the original CAPA rather than opened as unrelated records
• CAPA trends and effectiveness results reviewed in management review and, for medicinal products, in the product quality review
• Few CAPAs closed with "retrained" as the only action

Tracking effectiveness checks in an eQMS

On paper or in spreadsheets, effectiveness checks are the step most likely to be forgotten, because they fall due weeks or months after everyone has moved on. An eQMS can schedule them and keep them linked to the original event. In QFacts, each CAPA has an owner and a due date. It is linked to the event or deviation that triggered it and includes a structured effectiveness verification step with reminders before closure. You can try it with your own CAPA procedure during a 14-day free trial.