This article is written for quality directors, regulatory affairs managers, and design assurance leads at U.S. medical device manufacturers, contract manufacturers, IVD companies, and combination product developers — plus anyone comparing ISO 13485 against ISO 9001 for the first time. CAPA touches device safety, product performance, regulatory standing, and how your organization performs in front of an auditor.
Here's the problem: CAPA gets referenced constantly but misunderstood operationally. Teams blur correction with corrective action, skip preventive action entirely, or close out CAPAs without ever proving the fix worked. This piece breaks down the requirements, the process, and exactly how ISO 13485 differs from ISO 9001.
Key Takeaways
- ISO 13485:2016 requires documented procedures and retained records for corrective action (Clause 8.5.2) and preventive action (Clause 8.5.3)
- Effective CAPA runs trigger, containment, root cause, action, effectiveness verification, and controlled closure
- ISO 13485 ties CAPA more explicitly to device safety, complaints, and regulatory obligations than ISO 9001 does
- Not every nonconformity needs a formal CAPA, but skipping one requires a documented, risk-based rationale
What Is CAPA Under ISO 13485 and Why Is It Used?
Three terms get used interchangeably, and that's where most CAPA programs go wrong:
- Correction fixes the immediate, detected problem
- Corrective action addresses the root cause of a nonconformity that already happened
- Preventive action addresses the root cause of a nonconformity that hasn't happened yet, but could
ISO 13485 places corrective action and preventive action in Section 8.5, Improvement, specifically Clauses 8.5.2 and 8.5.3. Always check exact wording against an authorized copy of the current standard, since summaries (including this one) shouldn't be treated as verbatim clause text.
The purpose of CAPA is straightforward even when the execution isn't: eliminate causes, prevent recurrence or occurrence, protect device safety and performance, and improve the QMS over time.
Why CAPA Carries More Weight in Medical Devices
Quality signals for a device manufacturer come from more places than most generic QMS programs account for:
- Customer complaints
- Nonconforming product
- Internal and external audits
- Supplier issues
- Production deviations
- Service records
- Post-market surveillance
- Risk management outputs
A real-world example from GHTF guidance illustrates this well: two raw tubing lots get mixed during a supplier's finishing process. The immediate response is supplier notification, operator-awareness training, and controlling the affected components.
The investigation traces the actual cause to inadequate line-clearance procedures at the supplier, and the corrective action adds line-clearance requirements to the documented procedure, not just a training reminder (GHTF guidance).
CAPA isn't a form the quality department fills out alone. It's a cross-functional investigation that needs objective evidence, an accountable owner, documented decisions, and visibility at the management-review level.
How the ISO 13485 CAPA Process Works
The flow runs from quality signal to closure. The exact workflow should flex based on your organization's QMS, product risk, and regulatory obligations, but the backbone stays the same.
Step 1: Identify and Screen the Trigger
Complaints, audit findings, nonconforming product, supplier issues, recurring deviations, and trend data can all open a CAPA review. Document the source, scope, severity, recurrence, and initial risk at this stage, before anyone decides what to do about it.
Step 2: Contain the Immediate Problem
Containment might mean segregating suspect stock, quarantining affected lots, stopping an operation, or correcting records. If customer or regulatory escalation applies, that happens here too. Containment evidence needs to live in the CAPA record itself, not in a side email.
Step 3: Decide Whether Formal CAPA Is Required
Not every blip needs a full investigation. Frequency, severity, recurrence, systemic reach, patient risk, and regulatory impact all factor into the decision. Even when you decide not to open a formal CAPA, document why. An auditor will ask.
Step 4: Investigate and Determine Root Cause
This is where a precise problem statement, a cross-functional team, and the right root-cause method matter most. "Operator error" is rarely a root cause; it's usually a symptom of a missing procedure, inadequate training design, or a tool that lets the wrong input through.
| Method | Best suited for |
|---|---|
| 5 Whys | Straightforward, single-path problems |
| Fishbone (Ishikawa) | Complex issues with multiple possible categories |
| FMEA | Prospective risk on potential failure modes |
| Fault Tree Analysis | Combinations of hardware, software, and human error |
A root-cause record should show what happened, what's known, the possible explanations, and how each one gets tested, keeping a cause unconfirmed until evidence rules out the alternatives. An out-of-tolerance bore appearing on three lots from one supplier, for instance, gets traced through the applicable requirement, measurement results, affected lots, dates, and measurement-system checks before anyone signs off on a cause.
Step 5: Plan and Implement Actions
Assign an owner, a due date, and the resources needed. Update documents, train affected staff, validate or verify the change, and link it to change control. Critically for medical devices: assess whether the action affects regulatory compliance, device safety, or performance.
Step 6: Verify Effectiveness and Close
Define effectiveness criteria (the measure, sampling period, and conditions) before you implement the action, not after. A few good parts right after an adjustment isn't effectiveness evidence; it's a snapshot. If the action doesn't hold up over the observation period, escalate or reopen rather than closing on good faith.
At closure, your records should cover:
- Investigation and root cause
- Containment and action implementation
- Impact assessment
- Training or document evidence
- Effectiveness results and approval
- A link to management review
ISO 13485 CAPA Requirements and How It Differs from ISO 9001
Clause 8.5.2 (corrective action) requires manufacturers to:
- Review nonconformities, including complaints
- Determine causes and evaluate the need for action
- Implement the action and assess effects on regulatory compliance and device safety/performance
- Review effectiveness
Clause 8.5.3 (preventive action) requires:
- Identifying potential nonconformities and their causes
- Evaluating the need for action and implementing it
- Assessing adverse effects and reviewing effectiveness as appropriate
Both clauses require documented procedures and retained records of investigation results and actions taken.
Where ISO 9001 Diverges
| Comparison point | ISO 13485:2016 | ISO 9001:2015 |
|---|---|---|
| Corrective action location | Clause 8.5.2 | Clause 10.2 |
| Preventive action | Separate Clause 8.5.3 | Removed as standalone; addressed through risk-based thinking in Clause 6.1 |
| Focus | Complaints, product/process conformity, device safety and performance, regulatory requirements | Generic quality management and continual improvement |
ISO 9001:2015 didn't abandon prevention: it folded it into risk-based thinking under Clause 6.1. ISO 13485:2016 kept prevention as its own standalone clause. That's an architectural difference, not a statement that one standard cares more about prevention than the other.
A practical comparison: say a supplier ships a batch of defective fasteners. Under a general ISO 9001 QMS, the response is corrective action: find the cause, fix the supplier relationship, close it out. Under ISO 13485, the same defect also triggers a check of affected devices already in the field, a review of complaint trends tied to that component, a look at the risk file, and an assessment of whether regulatory reporting is triggered. Same defect, broader obligation.
One more point worth being blunt about: ISO 9001 certification doesn't demonstrate conformity with ISO 13485 or with FDA requirements, even when both QMS programs use similar root-cause tools. FDA has said directly that ISO 13485 certification by itself doesn't ensure compliance with its Quality Management System Regulation, and the agency doesn't accept certification as a substitute for its own inspection (FDA's QMSR webinar).
Treat the standard and your regulatory obligations as two separate boxes to check. This article isn't a substitute for legal or regulatory advice on QMSR or 21 CFR Part 820 specifics.
Where CAPA Applies and What Affects Its Outcome
CAPA draws from across the QMS, not just the finished-product inspection line:
- Complaints and customer feedback
- Nonconforming product
- Internal and external audits
- Supplier controls
- Production and process controls
- Service records
- Design and development
- Post-market surveillance and risk management
CAPA can be reactive (an existing nonconformity) or proactive (a trend, a near-miss pattern, or a risk analysis flagging something before it becomes a failure).
Factors that shape scope and priority:
- Product, patient, user, and regulatory risk
- Frequency and recurrence
- Severity and detectability
- Recurrence risk in other products, sites, or suppliers
- Quality-data completeness and cross-functional participation
- Ability to define measurable effectiveness criteria up front
The scale of the investigation should match the scale of the actual or potential harm. A minor packaging label typo and a leaching component in a dialysis device don't belong in the same investigation tier, and regulators expect that distinction to show up in how you scope the response.
Common Issues and When CAPA May Not Be Appropriate
A few patterns show up again and again in CAPA programs that struggle:
- Treating symptoms as root causes
- Defaulting to retraining as the corrective action
- Opening a formal CAPA for every minor event, regardless of risk
- Failing to escalate when the same issue recurs
- Assigning CAPA ownership only to the quality department
- Closing actions without effectiveness evidence
- Letting due dates slide without documented extensions
Common misconceptions worth correcting:
- Correction is not corrective action: fixing the part isn't fixing the cause
- Not every complaint automatically requires a formal CAPA
- Preventive action doesn't have to follow every corrective action. GHTF's own worked example records preventive action as "not applicable" for a corrective action already taken
- A completed action is not proof of effectiveness
A low-risk, isolated event with no systemic implications may not need a full CAPA. What it does need is a documented assessment explaining why, a correction, trend monitoring, and clear criteria for when it gets escalated later.
Audit self-check: Can your team explain:
- Why the CAPA was opened
- How the root cause was supported with evidence
- Why the chosen actions were appropriate
- How device impact was assessed
- What objective evidence justified closure
If any of those answers are fuzzy, that's where an auditor will dig.
Building this kind of judgment across a team, not just the senior quality engineer, is exactly the gap QMS Learning's Medical Device & Life Sciences QMS pathway is built to close. It covers ISO 13485, FDA 21 CFR Part 820, and ISO 14971. The pathway is currently set up as a Q3 2026 pilot cohort, so check current availability before assuming it's open.
Conclusion
ISO 13485 CAPA is a documented, risk-based system for addressing actual and potential causes of medical device quality problems. Treat it as an operational system, not a form or a quality-department checkbox.
The strongest programs connect quality signals to root-cause investigation, controlled action, device-risk assessment, effectiveness verification, and management review in that order, with evidence at every step.
A smaller number of well-justified, properly verified CAPAs beats a large backlog of rushed ones every time. Depth over volume, on every record you open.
Frequently Asked Questions
What does CAPA mean in ISO?
CAPA stands for Corrective and Preventive Action. It addresses the root causes of actual or potential nonconformities, covered under ISO 13485 Clauses 8.5.2 and 8.5.3 respectively.
What are the CAPA requirements in ISO 13485?
Requirements include documented procedures, root-cause determination, action planning and implementation, assessment of effects on regulatory compliance and device safety, effectiveness review, and retained records throughout.
What is the difference between ISO 13485 Clause 8.5.2 and Clause 8.5.3?
Clause 8.5.2 covers corrective action for nonconformities that have already occurred. Clause 8.5.3 covers preventive action for potential nonconformities that haven't happened yet.
How does CAPA under ISO 13485 differ from corrective action under ISO 9001?
ISO 13485 ties CAPA more explicitly to device safety, performance, complaints, and regulatory requirements, and keeps preventive action as a standalone clause. ISO 9001:2015 folds prevention into risk-based thinking instead.
Does every nonconformity require a CAPA under ISO 13485?
No. Isolated, low-risk events may not need a formal CAPA, but the decision must be documented, risk-based, monitored for recurrence, and escalated if evidence points to a systemic issue.
How do you verify CAPA effectiveness?
Define measurable criteria and an observation period before implementing the action. Review objective evidence afterward (not just completed tasks) and reopen or escalate the CAPA if effectiveness isn't demonstrated.