CAPA is one of the most-used acronyms in quality and safety — and one of the most misunderstood. Teams say “open a CAPA” when they mean a quick fix, and regulators cite “inadequate CAPA” in more than 60% of FDA warning letters. This guide gives a plain, practical definition of CAPA, the steps of the process, and the one thing that separates a process that works from one that just closes a ticket.
Summary: CAPA stands for Corrective and Preventive Action — a structured process to fix the cause of a problem (corrective) and stop similar problems from happening (preventive). The process moves through identify, investigate root cause, correct, prevent, and verify. The step most programs skip is verification: proving the action worked. CAPA is required under ISO 9001 and FDA quality regulations, and it applies equally across quality, safety, and supply chain. Make it stick with verified closure.
Why CAPA matters: by the numbers
- Inadequate CAPA appears in more than 60% of FDA warning letters — among the most-cited quality-system failures (FDA Group analysis).
- The FDA issued 303 drug warning letters in FY2025, a 59% jump over FY2024 (FDA).
- Investigations and CAPA under 21 CFR 211.192 are among the most common inspection observations of the past five years (FDA).
What is CAPA?
CAPA stands for Corrective and Preventive Action. It is a structured process for investigating a problem, fixing its root cause, and putting measures in place to stop it — or similar problems — from recurring. In short: correct what went wrong, and prevent it from happening again.
It is a cornerstone of any quality management system and a formal requirement under ISO 9001 and FDA regulations such as 21 CFR 820 and 211. But the concept is universal: any team that wants problems to stay solved runs some form of CAPA.
Corrective vs preventive action
The two halves of the process answer different questions. Corrective action asks: what caused this problem, and how do we fix it so it does not happen again? Preventive action asks: where else could a similar problem occur, and how do we stop it before it does?
Corrective is reactive to a known issue; preventive is proactive about potential ones. A mature program runs both — using the lessons from one corrective action to drive preventive measures elsewhere.
The CAPA process step by step
A sound process moves through five stages. Identify the problem from an audit finding, complaint, or incident. Investigate to find the true root cause, not just the symptom. Correct by fixing that cause. Prevent by applying the lesson wherever the risk exists. And verify that the action actually worked.
That last step is where most programs fall short. A record marked “complete” without a verified effectiveness check is an open risk wearing a closed label — the gap we cover in corrective action vs verified closure.
Standardising your CAPA process? Download our free CAPA Process Checklist — the five stages with the evidence and effectiveness-check fields built in.
CAPA across quality, safety, and supply chain
It is not just a quality term. A safety team runs one when a near miss reveals a hazard. A supply chain team runs one when a supplier audit turns up a non-conformance. The vocabulary shifts, but the discipline is identical: find the cause, fix it, prevent it, and prove the fix held.
That is why a single audit and inspection platform that manages CAPAs the same way across all three domains beats three disconnected systems — one source of truth, one closure standard.
Why CAPAs fail — and how to make them stick
CAPAs fail for predictable reasons: the investigation stops at the symptom, the action has no owner, or the record is closed without verifying the result. Each leaves the root cause alive to resurface later.
The fix is to make verification non-negotiable. Require evidence, define an effectiveness check, and reopen the CAPA automatically if the check fails. That closed loop — verified closure — is what turns CAPA from paperwork into prevention.
Key Takeaways:
- CAPA stands for Corrective and Preventive Action.
- Corrective action fixes a known cause; preventive action stops similar problems elsewhere.
- The process: identify, investigate root cause, correct, prevent, and verify.
- It is required by ISO 9001 and FDA regulations and applies across quality, safety, and supply chain.
- Most programs fail at verification — verified closure is what makes them stick.
You might also be interested in
Corrective Action vs Verified Closure
Why marking a CAPA done isn’t closure — and how to prove the fix actually worked.
FDA Warning Letters in 2026
How CAPA gaps drive enforcement — and what 2026 cases teach manufacturers.
Frequently Asked Questions (FAQs)
What does CAPA stand for?
CAPA stands for Corrective and Preventive Action. It is a structured process to fix the root cause of a problem and prevent it, or similar problems, from recurring.
What is the difference between corrective and preventive action?
Corrective action fixes the cause of a problem that has already occurred. Preventive action addresses potential problems before they happen, often by applying lessons from a corrective action to other areas at risk.
What are the steps in a CAPA process?
The five stages are: identify the problem, investigate the root cause, take corrective action, take preventive action, and verify effectiveness. Verification confirms the action worked before the record is closed.
What is an example of a CAPA?
A recurring labeling error is traced to an outdated template (root cause). The corrective action updates the template; the preventive action adds a verification step to the labeling workflow; and an effectiveness check confirms error rates drop and stay down.
Is CAPA required by ISO 9001 and the FDA?
Yes. ISO 9001 requires corrective action and continual improvement, and FDA regulations such as 21 CFR 820 (devices) and 211 (drugs) mandate a documented CAPA process. Inadequate corrective action is one of the most frequently cited findings in FDA inspections.
Run CAPAs that actually close the loop
Certainty manages corrective and preventive actions across quality, safety, and supply chain — with verified closure built in.
