capa-officer

---
name: capa-officer
description: Use when running CAPA investigations, 5-Why or fishbone root cause analysis, corrective action planning and tracking, effectiveness verification, or CAPA program metrics in a medical device QMS.
category: Regulatory & Quality
version: 1.0.0
tools: []
---

# CAPA Officer

Corrective and Preventive Action (CAPA) management within Quality Management Systems: systematic root cause analysis, action implementation, and effectiveness verification.

## CAPA Investigation Workflow

Document the trigger event with objective evidence; assess significance and determine CAPA necessity; form an investigation team with relevant expertise; collect data and evidence systematically; select and apply the appropriate RCA methodology; identify root cause(s) with supporting evidence; develop corrective and preventive actions. Validate before moving on: the root cause explains all symptoms, and if eliminated, the problem would not recur.

**CAPA necessity by trigger:** a safety-related customer complaint always requires CAPA; a quality complaint is evaluated by severity/frequency. A major internal-audit finding requires CAPA; a minor finding is recommended. A recurring nonconformance (same type 3+ times) requires CAPA; an isolated one is evaluated. Every external-audit finding, major or minor, requires CAPA. Trend analysis is evaluated by significance.

**Investigation team by severity:** Critical — CAPA Officer, Process Owner, QA Manager, Subject Matter Expert, Management Rep. Major — CAPA Officer, Process Owner, Subject Matter Expert. Minor — CAPA Officer, Process Owner.

**Evidence to collect:** a specific problem description (what/where/when/who/how much), a timeline of events, relevant records, interview notes, photos or physical evidence, related complaints/NCs/prior CAPAs, and process parameters/specifications.

## Root Cause Analysis

Select the method by problem shape: safety-critical or system-reliability issues → Fault Tree Analysis. Suspected human error as the primary cause → Human Factors Analysis. Otherwise, count contributing factors: 1–2 factors with linear causation → 5 Why; 3–6 factors, complex/systemic → Fishbone Diagram; unknown or proactive assessment → FMEA.

**5 Why** (single-cause, linear-causation issues): state the problem, then ask "why" five times, each answer backed by evidence, ending in a root cause. Example — a pH meter found 2 months overdue for calibration traced back through "not on the schedule" → "schedule not updated at purchase" → "no process requires that update" → "procedure predates the equipment-tracking system" → root cause: the procedure-review process never checks compatibility with systems introduced after the procedure was written.

**Fishbone (6M categories):** Man/People (training, competency, workload — skill gaps, fatigue, communication), Machine/Equipment (calibration, maintenance, age — wear, malfunction, capacity), Method/Process (procedures, work instructions — unclear steps, missing controls), Material (specs, suppliers, storage — out-of-spec, degradation, contamination), Measurement (calibration, methods, interpretation — instrument error, wrong method), Mother Nature (temperature, humidity, cleanliness — environmental excursions).

**Root cause validation checklist:** verifiable with objective evidence; if eliminated, the problem would not recur; within organizational control; explains all observed symptoms; no other significant cause left unaddressed.

## Corrective Action Planning

Define immediate containment; develop corrective actions targeting the root cause; identify preventive actions for similar processes elsewhere; assign responsibilities and resources; set a timeline with milestones; define measurable success criteria and a verification method; document the plan. Validate: actions directly address the root cause and success criteria are measurable.

**Action types and typical timelines:** Containment (stop immediate impact) — 24–72 hours, e.g. quarantine affected product. Correction (fix the specific occurrence) — 1–2 weeks, e.g. rework/replace affected items. Corrective (eliminate the root cause) — 30–90 days, e.g. revise procedure, add controls. Preventive (extend the fix elsewhere) — 60–120 days.

An action plan should name the CAPA number and root cause, then for each action: type, responsible owner, due date, resources, measurable success criteria, and verification method, with an implementation timeline (week 1/2/4/8 milestones) and sign-off from the CAPA owner, process owner, and QA manager.

**Effectiveness indicators:** good actions address the root cause completely (not just symptoms), carry measurable deliverables (not vague commitments), have an aggressive-but-achievable timeline with real due dates, have identified/allocated resources, and are a permanent solution rather than a temporary fix.

## Effectiveness Verification

Allow an adequate implementation period (minimum 30–90 days); collect post-implementation data; compare to the pre-implementation baseline; evaluate against success criteria; confirm no recurrence during the verification window; document the evidence; determine effectiveness. Validate: all criteria met with objective evidence and no recurrence observed.

**Verification timelines by severity:** Critical — 30-day wait, 30–90 day verification window. Major — 60-day wait, 60–180 days. Minor — 90-day wait, 90–365 days.

**Verification methods:** data trend analysis (quantifiable issues — pre/post comparison, trend charts), process audit (procedure-compliance issues — checklist, interview notes), record review (documentation issues — sample records, compliance rate), testing/inspection (product-quality issues — pass/fail data), interview/observation (training issues).

**Effectiveness determination:** if recurrence occurred during the verification period, the CAPA is ineffective — re-investigate the root cause. If not, and all effectiveness criteria were met, the CAPA is effective and proceeds to closure. If criteria weren't fully met, a minor gap can extend verification or be accepted with justification; a significant gap makes the CAPA ineffective and the actions must be revised.

## CAPA Metrics and Reporting

Key indicators: CAPA cycle time (target <60 days average, close date minus open date across CAPAs), overdue rate (target <10% of open CAPAs), first-time effectiveness (target >90% effective on first verification), recurrence rate (target <5% of closed CAPAs), investigation quality (target 100% of root causes validated).

**Aging buckets:** 0–30 days on track (monitor progress); 31–60 days monitor (review for delays); 61–90 days warning (escalate to management); >90 days critical (management intervention required).

Monthly management-review inputs: open CAPA count by severity/status, overdue list with owners, cycle-time and effectiveness-rate trends, source analysis (complaints/audits/NCs), and improvement recommendations.

## Regulatory Requirements

**ISO 13485:2016 Clause 8.5** — §8.5.2 Corrective Action (eliminate the cause of a nonconformity: review, cause determination, evaluate/implement actions, effectiveness review) and §8.5.3 Preventive Action (the same discipline applied to a potential nonconformity via trend analysis).

**FDA authority — QMSR transition (effective 2026-02-02):** FDA's Quality Management System Regulation (QMSR) final rule (89 FR 7496) amended 21 CFR Part 820 to incorporate ISO 13485:2016 by reference and removed the legacy QSR subsection structure. The old CAPA section number, 820.100, no longer exists in the CFR — it survives only as a familiar index. The current FDA authority for CAPA is ISO 13485:2016 §8.5.2/§8.5.3, with complaint-handling additions retained in 21 CFR 820.35. Cite the ISO 13485 clauses, not 820.100, in current compliance documentation and audit findings.