CAPA: corrective and preventive action, meaning, process and a worked example

Correction vs corrective action vs preventive action

Three terms get mixed up on almost every audit. Take one problem, loose bolts on an assembly, and the difference is plain.

What is a corrective action?

A corrective action is a change that removes the cause of a nonconformity so it does not recur. The test is simple: if the same conditions came back tomorrow, would the problem happen again? If yes, the action was a correction. Good corrective actions change the process, the equipment, the method or the check, not only the people. An error-proofing device, a changed fixture or a gauge that stops the line are corrective actions. A reminder at the shift huddle is not.

What is a preventive action?

A preventive action removes the cause of a potential problem. It comes from looking forward: a trend on a control chart heading for a limit, a high risk line in the FMEA, a near miss, or a fix on one line that should be copied to the lines that have the same weakness. The most useful source in a plant is the last one. Every corrective action should end with the question: where else could this happen?

Corrective and preventive actions often sit in the same CAPA record. The corrective part fixes the line that failed; the preventive part spreads the fix to the lines that have not failed yet.

The CAPA process in eight steps

Companies number the steps differently, five, seven or eight, but the content is the same. These are the eight a plant can audit against.

1. 1

   Describe the problem

   Write what is wrong, on which part and line, since when, how many, and how it was found. Say what it is and what it is not: which shift, which tool, which lot is affected and which is not. A vague problem statement produces a vague cause.

2. 2

   Contain it

   Protect the customer first. Hold suspect stock, sort or check it, add a temporary inspection, post a quality alert at the station. Record what was checked and what was found, because those counts are evidence later.

3. 3

   Set the scope and the team

   Judge the risk: how bad, how often, how far it may have spread. Name an owner and the people who know the process, usually the supervisor, an operator from the station, quality and maintenance or engineering.

4. 4

   Find the root cause, twice

   Find why it happened (the occurrence cause) and why it was not caught before it left the station (the escape cause). Use the 5 Whys, a fishbone or an is/is not comparison, and test the cause: can you switch the problem on and off with it?

5. 5

   Plan the corrective action

   For each cause, choose an action that removes it. Prefer changes to the process or the equipment over instructions. Write the plan with an owner, a date and the measure that will show it worked.

6. 6

   Implement and update the documents

   Make the change, then update what describes the process: the work instruction or SOP, the control plan, the PFMEA, the check sheet, and the training records of the people affected.

7. 7

   Verify that it worked

   After a set period, check the measure chosen at step 5. Done is not the same as effective. If the problem has come back, the cause was wrong or the action was too weak: go back to step 4.

8. 8

   Close and spread

   Close the CAPA with the evidence attached. Then take the fix to every line, product and site with the same weakness. That spread is the preventive action, and it is where most of the value is.

Step 7 is the step auditors look at hardest and plants skip most often. A CAPA closed the day the action is done has not been verified. Decide at step 5 what effective will look like and when it will be checked, and put the date in the CAPA log.

A CAPA example from a plant, step by step

This example is illustrative, not from a real plant. A plant builds a steel bracket assembly held by two M8 bolts, tightened at station 3 with a nutrunner that monitors torque and stops on a reject. Output is 1,150 assemblies a day.

Two things in this example are worth copying. The team found an escape cause as well as an occurrence cause, so a future tool failure would be caught at the station even if the first rule were broken. And the preventive action went to the four stations that had not failed, which is where the next complaint would have come from.

CAPA in ISO 9001, IATF 16949, ISO 13485 and FDA 21 CFR 820

This section names the requirements without quoting them. Wording and numbering depend on the edition, so check the current text of the standard that applies to you.

Why did ISO 9001 drop preventive action as a clause? The 2015 edition built thinking about risk into the whole system, from planning onward, so preventing problems became the job of every process rather than a separate form filled in afterwards. Many plants still keep a preventive action field on the CAPA, and it is still good practice; it just is not a clause on its own in ISO 9001.

Common CAPA mistakes

• Closing on implementation. The action is done, so the CAPA is closed. Without step 7 nobody knows if it worked.
• Root cause: operator error. People make mistakes in every process. Ask what made the mistake possible and why it was not caught.
• Retraining as the corrective action. Training fixes a gap in knowledge. If the operator already knew the method, retraining changes nothing; change the process or add an error-proofing check.
• Only the occurrence cause. If the escape cause is left alone, the next different failure will also reach the customer.
• A CAPA for everything. When every minor NCR opens a CAPA, the list grows past what the team can work and the important ones wait. Use a written rule.
• Preventive action that never leaves the line. The same weakness is usually on the next line, the sister product or the other site.
• Documents left behind. The fix lives in the team's heads, and the SOP, control plan and PFMEA still describe the old process.