Corrective and preventive action (CAPA) management

Problem class

CAPA violations appear in over 60% of FDA enforcement actions and warning letters. Between 2008 and 2025, FDA 21 CFR 820.100(a) alone accounts for 4,085 citations out of 5,783 total CAPA citations. This is the single most scrutinized quality system element.

Non-routine quality events cost the medical device industry $7.5–$9 billion per year (FDA observations, recalls, warning letters, consent decrees, warranties, lawsuits) plus $1–$2 billion in lost sales. Approximately 50% of medical device firms inspected between 2013 and 2019 received at least one CAPA-related FDA finding.

Mechanism

Systematic investigation of nonconformances through structured root cause analysis (8D, Ishikawa, 5-Why, Fault Tree Analysis), corrective action assignment, verification of effectiveness, and preventive action deployment. The 8D methodology originated at Ford Motor Company; OEMs including Ford, VW, Stellantis, BMW, and Toyota demand formal 8D reports from suppliers.

AI transformation. Causal AI for root cause analysis is the most significant advance. Databricks published an approach using the DoWhy library that distinguishes true root causes from correlational symptoms — revealing factors like worker skill levels and machine settings versus misleading dimensional check failures. QualityLine provides automated AI root cause analysis for IATF 16949 CAPA documentation, claiming to reduce compliance preparation time by up to 80%. NLP combined with Latent Dirichlet Allocation (LDA) can analyze free-text nonconformance reports to identify recurring patterns — one study applied this to Toyota Camry consumer reports, clustering complaints into actionable categories. CausaLens (decisionOS) uses Human-Guided Causal Discovery combining domain knowledge with causal discovery algorithms. Predictive CAPA — AI analyzing deviation, complaint, and audit data to predict emerging quality trends before they require CAPA — aligns with ICH Q9(R1) proactive risk management.

Required inputs

• Document Control
• Nonconformance Management
• Complaint Handling
• Training in RCA tools
• Risk Management framework

Produced outputs

• Formal CAPA records with root cause analysis and corrective action plans
• Effectiveness verification records
• Upstream trigger for Management Review
• Supplier Corrective Action Requests (SCARs)
• Design Control updates
• Regulatory reporting inputs

Industries where this is standard

• Medical devices (most scrutinized element globally)
• Pharmaceuticals (ICH Q10 cornerstone)
• Automotive (IATF 16949 Clause 10.2, 8D mandatory from OEMs)
• Aerospace (AS9100D Clause 10.2)
• Food safety (FSSC 22000 corrective actions)

Counterexamples

• CAPA overload — opening a formal CAPA for every minor issue rather than resolving at process level.
• Superficial root cause analysis — "8D reports built on assumptions solve the symptom, not the process."
• Verification of effectiveness failures — implementing corrective actions without confirming recurrence prevention.
• Siloed CAPA applied to one product line without extending to similar products/processes (IATF 16949 specifically requires systemic corrective actions).
• Disconnect from risk management — not driving updates to FMEAs and control plans from CAPA findings, which is the top IATF 16949 audit finding.

Representative implementations

• Cook Medical (FDA warning letter) — scrapped 545,914 in-process medical devices over two years without including in CAPA analysis; 236,706 production units scrapped due to foreign matter; 3,066 complaints for foreign matter in sterile devices — all without opening a CAPA.
• Medline Industries (FDA citation) — failing to implement risk-based CAPA for angiographic syringes disconnecting due to excess silicone.
• QualityLine — automated AI root cause analysis, claiming up to 80% reduction in IATF 16949 CAPA compliance preparation time.
• Medical device warning letters rose 96% from FY2023 to FY2024, reaching 47 warning letters.

Common tooling categories

Enterprise QMS platforms with CAPA module, root cause analysis tools (8D, Ishikawa, 5-Why software), causal AI platforms (DoWhy, CausaLens/decisionOS), NLP text analytics for nonconformance pattern mining.

Regulatory anchors

FDA 21 CFR 820.90/820.100 (medical devices), ISO 9001:2015 Clause 10.2, IATF 16949 Clause 10.2 (with 10.2.3 for Problem Solving), ISO 13485:2016, ICH Q10. The new FDA QMSR effective February 2, 2026 aligns 21 CFR Part 820 with ISO 13485.