CAPA — corrective and preventive action — is the documented process for investigating a nonconformity, eliminating its cause, and acting on the same failure mode where it has not yet appeared. For medical device manufacturers the ground moved on 2 February 2026, when the Quality Management System Regulation took effect. This page covers what actually changed, the distinctions that show up in inspection findings, and a free CAPA form you can use today.
Download the CAPA form
Nine sections, built around the distinctions the rest of this page explains: correction separated from corrective action, preventive action as its own step, and an effectiveness check with the acceptance criterion written down before the check happens. No signup, no email.
CAPA Form — Excel (.xlsx)
Editable worksheet, one sheet per record. Works in Excel, Google Sheets and LibreOffice.
Download .xlsxCAPA Form — Word (.docx)
For quality systems where the record is a controlled document inside a larger report.
Download .docxCAPA Form — PDF (print)
Printable A4 for filling in by hand on the floor, then transcribing into the QMS.
Download .pdfWhat changed on 2 February 2026
The FDA’s Quality Management System Regulation (QMSR) took effect that day. It amends the device CGMP requirements of 21 CFR Part 820, retitles the part, and incorporates ISO 13485:2016 by reference. Four consequences matter for anyone who writes or reviews CAPA records:
1. CAPA is no longer one requirement
The old 820.100 held corrective and preventive action in a single section, which is why the industry says “CAPA” as one word. ISO 13485:2016 splits them: corrective action sits in clause 8.5.2, preventive action in 8.5.3. The acronym survives in daily use and in most QMS software, but the underlying requirements are now two, and a record that treats them as one leaves half of the second clause unevidenced.
2. Management review and audit records are inspectable
This is the change most likely to surprise a quality team. The FDA’s own QMSR FAQ answers it directly:
“Yes. The QMSR gives the FDA the authority to inspect management review, quality audits, and supplier audit reports. The exceptions that existed in the QS regulation at § 820.180(c) are not maintained in the QMSR.”
CAPA sits directly in that blast radius. Effectiveness reviews are typically discussed in management review; internal and supplier audits are among the most common CAPA sources. Records that used to be internal-only are now part of the conversation.
3. The inspection process itself is different
On the same date the FDA moved to the inspection process described in Compliance Program 7382.850 and retired the two documents that preceded it (7382.845 and 7383.001). The Quality System Inspection Technique — QSIT, the four-subsystem model many teams trained against, with CAPA as one of the four — is no longer the framework being used.
4. Old records are still fair game
The FAQ also confirms that investigators may review records created before the effective date, and suggests manufacturers may find it useful to complete “some type of comparative analysis” showing that pre-QMSR documents meet QMSR requirements. A CAPA opened in 2025 and closed in 2026 will be read against the current rules.
The three distinctions that show up in findings
Most weak CAPA records fail on vocabulary rather than effort. Three pairs are worth getting right in the record itself, because a reviewer reads the record, not your intent.
| Pair | What it means | Typical mistake in the file |
|---|---|---|
| Correction vs corrective action | Correction fixes the instance: quarantine the lot, rework the units, credit the customer. Corrective action removes the cause so the next lot is unaffected. | The containment step is written into the corrective action field. The record then shows no systemic change at all. |
| Corrective vs preventive | Corrective responds to what happened. Preventive addresses the same failure mode where it has not happened — another line, product, or supplier. | The preventive section repeats the corrective action in different words, satisfying neither clause. |
| Cause vs root cause | A cause explains this occurrence. A root cause names the system, process or missing control that allowed it — something you can change. | “Operator error” is entered as the root cause. It names a person, so the only available action is retraining, and the defect returns. |
What a defensible CAPA record contains
The form above follows this sequence. Nothing here is exotic — the value is in keeping the steps separate so each one can be evidenced on its own.
- Problem description. Factual only: what was observed, when, how many units, which product and lot. No cause, no proposed fix. If you cannot write it without naming a culprit, you are not ready to open the record. Our problem statement generator flags blame and hidden solutions as you type.
- Immediate correction and containment. What stopped the bleeding, and when. Labelled as correction so nobody mistakes it for the fix.
- Investigation and root cause. Which method you used, what evidence you examined, and the cause you verified — not the first plausible one. This is where root cause analysis lives inside CAPA.
- Risk assessment. Impact on product and patient, and whether this triggers a reporting or field-action decision. Risk before and after the action.
- Corrective action (8.5.2). The action that eliminates the cause, with an owner and a date, proportionate to the risk.
- Preventive action (8.5.3). Where else could this occur? A separate answer, or an explicit statement that you checked and found no other exposure — which is itself a valid entry.
- Change control. Which SOPs, work instructions, drawings, risk files and training records changed, with the change request reference.
- Effectiveness verification. The acceptance criterion, written before the check. What you will measure, over what period, and what result counts as effective.
- Closure and approval. Who closed it, when, and the management review reference — now an inspectable link, per the FAQ quoted above.
Where root cause analysis fits
Sections 3 and 5 are the ones that decide whether the CAPA holds. Everything else is administration around them. Match the method to the problem rather than defaulting to whichever one your template mentions:
| Situation | Method | Why |
|---|---|---|
| Single clear failure, short causal chain | 5 Whys | Fast, needs no data set, produces a chain a reviewer can follow |
| Many candidate causes, cross-functional group | Fishbone / Ishikawa | Surfaces causes across categories before anyone commits to one |
| Recurring defects, need to pick what to fix first | Pareto analysis | Ranks by frequency or cost so the CAPA targets the vital few |
| Customer complaint needing a formal audit trail | 8D process | Contains its own containment, corrective and preventive steps — a CAPA with a customer-facing wrapper |
| Risk before the failure happens | FMEA | Feeds preventive action directly: it is a list of nonconformities that have not occurred yet |
Not sure which fits? The RCA method selector asks four questions and names one.
Three ways CAPAs fail after they are closed
The record documents a correction. Containment is real work and it feels like action, so it gets written in the corrective action field. Six weeks later the defect returns, because nothing upstream changed. Read your own section 5 and ask: if this action is implemented perfectly, can the same cause still produce the same defect? If yes, it is a correction.
The root cause is a person. “Operator did not follow the SOP” terminates the investigation one step too early. Why was the SOP not followed — was it wrong, unavailable at the station, contradicted by a supervisor, or impossible at the required takt time? Each of those has a different fix, and none of them is retraining.
No acceptance criterion. The effectiveness check says “monitored, no further occurrences” without stating what was monitored, for how long, or what would have counted as failure. That sentence cannot be evaluated by anyone, including you. Decide the criterion when you plan the action, not when you close the file — the corrective action plan guide covers how to write one that holds.
FAQ
What is CAPA in quality management?
Corrective and preventive action: a documented process for investigating a nonconformity, eliminating its cause so it does not return, and acting on similar problems that have not happened yet. In practice it is a record — a numbered file showing what went wrong, what the investigation found, what changed, and evidence that the change worked.
What changed for CAPA under the FDA QMSR in 2026?
The QMSR took effect on 2 February 2026. It retitles 21 CFR Part 820 and incorporates ISO 13485:2016 by reference, so the single CAPA requirement of the old 820.100 becomes two clauses: corrective action in 8.5.2 and preventive action in 8.5.3. The FDA also began a new inspection process under Compliance Program 7382.850 and stopped using the Quality System Inspection Technique.
Can the FDA now inspect management review and internal audit records?
Yes. The FDA’s QMSR FAQ states that the regulation gives the agency authority to inspect management review, quality audits and supplier audit reports, and that the exceptions which existed at § 820.180(c) are not maintained. This matters for CAPA because effectiveness reviews are usually discussed in management review, and audits are a common CAPA source.
What is the difference between a correction and a corrective action?
A correction fixes the instance — quarantine the batch, rework the units, credit the customer. A corrective action removes the cause so the next batch is unaffected. Logging a correction in the corrective action field is one of the most common weaknesses in a CAPA file, because the record then contains no evidence that anything systemic changed.
What is the difference between corrective and preventive action?
Corrective action responds to a nonconformity that already occurred. Preventive action addresses a potential one — typically the same failure mode on a different line, product or supplier. Under ISO 13485:2016 these are separate clauses, 8.5.2 and 8.5.3, so a preventive section that repeats the corrective action satisfies neither.
How do you verify CAPA effectiveness?
State the acceptance criterion before the check, not after. Define what you will measure, over what period, and what result counts as effective — for example zero recurrences of the defect code across a defined number of production runs. Then attach the evidence. A CAPA closed without a stated criterion is the one most likely to reopen.
Which root cause analysis method should I use inside a CAPA?
Match the method to the problem. Single clear failure with a short chain: 5 Whys. Many candidate causes and a group in the room: fishbone. Customer-facing complaint needing an audit trail: 8D, which contains its own corrective and preventive steps. The method matters less than whether you verified the cause with evidence before writing it into the record.
Related
- Corrective action plan — owners, dates and verification that hold up
- RCA report template — the investigation behind sections 3 and 5
- 8D report template — when the customer wants the audit trail
- FMEA template — feeds preventive action
- Root cause analysis: complete guide
- RCA method selector — four questions, one method