CAPA (Corrective And Preventive Actions) are the process that distinguishes a QMS that learns from a QMS that goes round in circles. ISO 13485 auditors know this and systematically devote time to it. A poorly run CAPA is often the symptom of an organisation that addresses problems at the surface without understanding their causes.
What clauses 8.5.2 and 8.5.3 require
Corrective actions (8.5.2): the organisation must take action to eliminate the causes of identified nonconformities in order to prevent their recurrence. The procedure must cover the review of nonconformities, the determination of causes, the evaluation of the need for action, implementation, the recording of results and the review of effectiveness.
Preventive actions (8.5.3): the organisation determines the actions to eliminate the causes of potential nonconformities in order to prevent their occurrence. The same structure as corrective actions, applied to risks identified upstream.
The 6 mistakes that generate nonconformities in an audit
Mistake 1: treating the symptom rather than the cause. The corrective action addresses the nonconforming product — scrap, rework, redesign of the IFU — without identifying why the problem occurred. The auditor systematically asks for the root cause analysis. If it does not exist or is limited to “operator error”, that is a finding.
Mistake 2: a root cause analysis that uses the tool without doing the work. An Ishikawa diagram filled in within ten minutes with generic causes, a “5 whys” analysis that stops at the second level: the tool does not replace the reasoning. The auditor reads the analysis and assesses its coherence. A superficial analysis is immediately apparent.
Mistake 3: no verification of effectiveness. This is the most frequent finding. A CAPA closed without evidence that the action has actually eliminated the cause is incomplete. The verification of effectiveness must be planned before implementation (with defined acceptance criteria), then carried out after a sufficient period with measured results.
Mistake 4: deadlines missed without justification. CAPA that have been open for 12 or 18 months with no visible progress are a strong signal of malfunction. Deadlines must be set, monitored, and delays explained. A justified delay is acceptable. An ignored delay is not.
Mistake 5: CAPA do not feed into the management review. The CAPA process must feed into the management review. Trends, the overall effectiveness of the process, the number of CAPA opened and closed: these data must be presented to management. A CAPA process disconnected from the management review does not close the loop.
Mistake 6: confusing immediate action with corrective action. Immediate action (containment) consists of blocking nonconforming products, recalling suspect lots, informing customers. It is necessary and urgent. But it is not a corrective action within the meaning of clause 8.5.2. Documenting an immediate action as a closed CAPA is a recurring mistake that auditors flag without hesitation.
What auditors systematically ask for
In practice, the ISO 13485 auditor selects two or three recent CAPA and asks to see them end to end: from triggering through to the verification of effectiveness. They check that the root cause analysis is documented and consistent with the nonconformity, that the action implemented addresses the identified cause (and not some other problem), and that the verification of effectiveness has been carried out with objective data.
A robust CAPA is built upstream, not in response to an auditor’s request.