Here is the CAPA process explained step by step: a nonconformity gets recorded, contained, analysed down to its root cause, corrected, checked against criteria you agreed before you started, and closed with evidence an auditor can read. The method works the same in a forty-person molding shop as it does in a regulated device plant, and a full cycle usually lands somewhere between 30 and 90 days depending on how deep the investigation has to go. The sequence below, current as of 2026, is the one that holds up when someone reads your closed file line by line.
That last point matters more than most guides admit. Quality practitioners on industry forums are blunt about it: auditors read closed CAPA records end to end, not your procedure manual, so a tidy SOP proves nothing on its own. Everything below assumes you are building a record someone else can follow without asking you a single question.
Table of Contents
What You Need
You cannot start a CAPA without five kinds of input, and most stalled investigations are stalled because one of them was never gathered. Collect them before the meeting, not during it.
- The nonconformance itself. What failed, which specification or drawing it failed against, where it was found, when it was detected, and which lots, orders or customers are affected.
- Process data. Machine settings, cycle counts, scrap records, downtime logs, inspection results, last calibration dates, and the process history for the same part or line over the previous six to twelve months.
- A risk assessment. Severity, occurrence, detectability, regulatory exposure and customer impact, so you can decide how fast this moves and how much investigation it deserves.
- Root cause evidence. Samples of the defect, test reports, operator interviews, supplier records, photographs, and the physical evidence itself. Retain the sample; it decides arguments later.
- A documented procedure and approval authority. The clause in your quality management system that governs CAPA, and the named person who can approve a record, commit money, or stop a shipment.
Roles matter as much as paperwork. In most plants the operator raises the nonconformance, the supervisor contains the material, a quality engineer runs the investigation, the quality manager approves closure, and a cross-functional team handles anything that crosses departments. Cross-functional matters: quality professionals report that a single investigator is limited by their own perspective, which is exactly how a line-side blind spot gets written into a root cause statement.
Two frameworks are worth knowing before you start, because the paperwork overlaps. The 8D problem solving process step by step guide covers the supplier-facing version of the same investigation, and it is the format customers usually ask for. The sequence here is the internal quality record most plants keep in their EQMS or QMS.
Step-by-Step CAPA Process
The CAPA process runs in eight stages: define the nonconformance, assess risk, contain the problem, investigate the root cause, select corrective and preventive actions, implement and document them, verify effectiveness, then close and review. You will also see five-step and seven-step versions published elsewhere, and the difference is only where the lines are drawn. Five-step lists fold risk assessment and containment together. Seven-step lists fold closure and review together. Nothing substantive is missing from any of them, so use whichever your customer or notified body expects and keep the sequence intact.
1. Define the Nonconformance
Write the problem statement in plain, testable language. “Sink marks on the cosmetic face of the housing, lot 4471, found at final inspection on 12 March, 6 parts in 400 above the 2 percent acceptance limit” is a definition. “Quality issues with cosmetic parts” is not.
Record what failed, the requirement it failed against, where and when it was detected, the affected lots or customers, and the immediate containment you took to stop further shipment or use. Deliberately leave the cause blank at this stage. Teams that guess the cause while writing the problem statement end up investigating a cause they chose rather than the one the evidence supports.
What good looks like: someone who had no part in the event can read the statement and know exactly what to go look at.
2. Assess Risk and Determine the CAPA Level
Not every nonconformance deserves a full investigation, and treating every one of them the same is how CAPA programmes die of paperwork. Score severity, occurrence and detectability, then layer on regulatory exposure and customer impact. A cosmetic blemish on an internal bracket and a dimension error on a part that ships into a regulated device are not the same event, and the timing and depth of the response should not be either.
Your risk assessment also sets the clock. High-severity or externally exposed problems get a cross-functional team, a defined containment deadline and interim controls. Low-risk internal issues can be dispositioned at the supervisor level with a documented decision not to open a formal CAPA, which is a legitimate outcome when you write down the reasoning and the data behind it.
3. Contain the Problem
Containment stops the bleeding while the investigation runs. Quarantine affected inventory, hold the shipment, sort what is already on the floor, suspend the process or the machine where appropriate, and notify customers or suppliers who may hold product from the same lot.
Document the scope and the effectiveness of the containment, not just the fact that you did it. How much material was checked, how much was found, and how you confirmed nothing else escaped. If parts already reached customers, a reverse logistics process explained for manufacturers covers how returned material gets quarantined, identified and dispositioned so it never mixes back into production stock.
Keep containment in place until the corrective action is verified. Pulling the hold early because the line looks fine is one of the most common reasons a problem comes back three months later.
4. Investigate the Root Cause
Collect facts first, then interpret them. Pull the process data, examine retained samples under magnification or measurement, interview the people who ran the line, review the equipment, the material supplier and the method itself, and only then pick a tool. Most teams reach for 5 Whys by reflex; it is fast and it works when the problem has a single linear chain.
The 5 Whys sequence for a cosmetic defect might run: why are there sink marks? Because the wall thickness is uneven. Why is the wall thickness uneven? Because the melt temperature drifted during the cycle. Why did the melt temperature drift? Because the thermocouple was reading a drifted value. Why was the thermocouple not replaced? Because replacement frequency is not in the preventive maintenance schedule.
Other tools suit other problems. A fishbone diagram (Ishikawa) is the right choice when several process families could contribute, such as machine, method, material, man, measurement and environment. Fault Tree Analysis works backwards from an unwanted outcome through logical gates when the failure is rare and the tree is already well defined. FMEA ranks what to attack first by severity, occurrence and detectability, and doubles as a preventive action list once the causes are known. A3 gives you a one-page story with a background, current condition, goal and analysis, which is fast and popular on shop floors. 8D is the structure customers and suppliers expect when the problem crosses a company boundary.
Separate the occurrence cause from the escape cause. Why the defect happened and why nobody caught it are two questions, and fixing only the first leaves your inspection burden where it was. Most 5 Whys chains that dead-end do so because the team stopped at a machine setting nobody had set correctly, when the real answer sits one level deeper in the setup standard or the training record.
Then confirm the cause with objective evidence. If you claim the thermocouple drifted, the trend data or calibration history should show it. “Operator error” is not a root cause, it is a label for a gap, and it is the single most common reason CAPA files fail an audit: it does not survive a follow-up question and it prevents nothing. Ask instead what allowed the error to be possible and undetectable, and write the answer into the process, the fixture or the control plan.
5. Select Corrective and Preventive Actions
Three words get mixed up constantly, and the test is simple: if the process is unchanged when the action is done, you did a correction, not a corrective action.
- Correction fixes this instance. Sort the lot, replace the part, re-run the inspection, re-train the one person involved.
- Corrective action eliminates the cause so the problem does not happen again. Replace the thermocouple and add it to the preventive maintenance schedule with a defined interval.
- Preventive action acts on a potential problem that has not occurred yet, usually drawn from trend data, audit findings and complaints that never reached a formal CAPA.
Write each action so a stranger could do it: a named owner, a target date, the specific document, machine or record that changes, and the evidence that will prove it happened. Retraining alone is the most common weak action in the industry, and it usually fails its effectiveness check because the procedure that permitted the error is still in place. Changing the procedure, the fixture or the control plan alongside the training is what makes it hold.
6. Implement and Document the Actions
Turn the approved plan into finished work. Update work instructions and SOPs, revise drawings or tolerances where that is the fix, change the control plan, retrain and record the training, adjust or replace equipment, and tighten supplier controls such as incoming inspection criteria or a scorecard threshold. Anything that touches a controlled document goes through your change control process with a revision number.
Each action needs an owner, a due date and the records that prove it: the revised instruction with its effective date, the training attendance sheet, the maintenance work order, the first-article or validation result where the process changed. Flag any action that affects other products or processes so the impact assessment is explicit rather than assumed.
Feed the result back into the PFMEA, the control plan, the work instructions and the training matrix. CAPAs that live only in a database are why the same defect keeps coming back with a new record number attached.
7. Verify Effectiveness
This is the step most programmes skip, and skipping it is the most common deficiency consultants report. Define the acceptance criteria and the observation period before you implement anything, not after the result looks good. Criteria like “no recurrence for 30 days” are meaningless; “no more than two cosmetic rejects in the next 5,000 parts inspected on this line, reviewed at 30 and 60 days” is a measurement.
Use data that already exists wherever possible: defect rate and scrap trend, customer complaint volume, internal and external audit findings, process capability on the affected characteristic, deviation counts, or downtime on the machine involved. Compare against the baseline from before the action, and make sure the volume behind the comparison is big enough to mean something. A 50-part check on a defect that shows up once in 4,000 proves nothing.
Where you changed a document, verify it differently: did the updated instruction show up on the floor, is the old revision gone, and have the people using it been through the training record. If the effectiveness check fails, do not close the CAPA. Reopen it, go back to the analysis, and treat the failed result as new evidence, which is exactly what it is.
8. Close, Review, and Prevent Recurrence
Closure needs a named approval, the evidence package and a short statement of what changed as a result. Record the lessons learned, then look horizontally: the same cause is frequently present on a sister line, a second shift, a similar part or a different site, and the CAPA should say whether the fix is being deployed there and how that is being tracked.
Update the control plan, PFMEA, work instructions and training matrix so the fix is part of the standard system rather than a one-off. Report CAPA trends at management review: closure time, percentage verified effective on first check, repeat deviation rate and the age of open records. A backlog of records sitting open past their target date is a signal about the system, not about the people who raised them.
Set a defined re-review date, and reopen the record if the problem reappears. Closing a CAPA because the calendar said so is how the same defect gets investigated three times under three different numbers.
Common Mistakes
Most failed CAPA programmes fail the same way, and the fixes are unglamorous.
- Stopping at the symptom. Reworking the parts makes the number look better without touching the cause. Ask what allowed the defect to be produced in the first place.
- Writing “operator error” as root cause. It ends the investigation and prevents nothing. Keep asking until the answer points at a document, a fixture, a setting or a control that can be changed.
- Vague actions. “Improve training” or “increase awareness” cannot be verified. Every action needs an owner, a date and a document or machine that changes.
- Skipping or under-documenting containment. If the scope of affected material is unknown, you cannot prove the problem is fixed, and you may be shipping more of it.
- Changing several variables at once. Fix the tooling, the material and the method in one CAPA and you will never know which change worked, so you cannot standardise the right one.
- Closing without effectiveness evidence. Implementation is not effectiveness. The action being done says nothing about the defect being gone.
- Retraining as the only action. Widely reported to fail verification, because the procedure that allowed the error never changed.
- Never checking similar processes. The same cause usually sits on the other shift or the sister line. Horizontal deployment takes one line in the record and saves two more.
- Inconsistent records between departments. When engineering, production and quality each keep their own version, internal audits fail on the paperwork long before they reach the technical questions.
Frequently Asked Questions
What are the 7 steps of CAPA?
Most published lists use seven: identify the problem, evaluate risk and priority, contain the immediate impact, analyse the root cause, plan actions, implement them, and verify effectiveness before closure. This guide splits the first step into defining the nonconformance and assessing risk, and adds a final review step, giving eight. The sequence is identical either way. Use the count your customer or notified body expects and keep the order.
What is the difference between a correction and a corrective action?
A correction fixes the specific instance you already have, such as sorting the affected lot or re-inspecting the parts on the floor. A corrective action eliminates the cause so the problem does not happen again, such as changing the setup standard, adding a check or replacing a component. The practical test: if the process is unchanged when the work is done, it was a correction, not a corrective action.
When should a CAPA be initiated?
Open one when a nonconformity is severe, repeated, escapes to the customer, involves a regulated or safety-related characteristic, or indicates a systemic process problem. Triggers include production defects, customer complaints, supplier nonconformities, internal and external audit findings, out-of-specification results, process deviations and trends showing rising scrap or downtime. Low-risk internal issues can be dispositioned without a formal CAPA, provided the decision and its data are documented.
How do you verify CAPA effectiveness?
Set the criteria and observation period before you implement the action, then measure against a baseline. Useful evidence includes defect rate and scrap trend, complaint volume, audit findings, process capability on the affected characteristic, and confirmation that revised documents reached the floor. Use a sample large enough to be meaningful, review at a defined interval, and reopen the CAPA rather than closing it if the check fails.
Who should own a CAPA investigation?
The quality engineer or quality manager typically owns the record and the analysis, while the process owner who controls the affected operation co-leads the root cause work. Operators and line technicians supply the facts from the floor, and a cross-functional team handles anything spanning departments or suppliers. Single-investigator CAPAs are the most common weakness, because one person’s perspective sets the limits of the search.
Is a CAPA required for every nonconformity?
No. Every nonconformity needs to be recorded and dispositioned, but not every one needs a full investigation. Use a risk-based triage: severity, occurrence, detectability, regulatory exposure and customer impact decide whether the case becomes a formal CAPA, a documented nonconformance, or a correction handled at the supervisor level. What auditors object to is the unrecorded case, not the small number of CAPAs you chose not to open.
Conclusion
The CAPA process explained step by step comes down to discipline in the middle of the sequence: define the nonconformance in testable language, contain the affected material, and collect objective evidence before anyone names a cause. Root cause analysis is only worth the effort if the actions that follow change the process, and no action is finished until effectiveness has been measured against criteria set beforehand. Start with the definition and the containment, because nothing downstream is worth anything until the scope of the problem is known.
Regulatory frameworks set the same expectations under different numbers. ISO 9001 addresses nonconformity and corrective action in clause 10.2, ISO 13485 splits them into clause 8.5.2 for corrective action and clause 8.5.3 for preventive action, FDA 21 CFR 820.100 carried the CAPA requirement for US device manufacturers until the quality system regulation that took effect in February 2026 folded ISO 13485 in by reference, and ICH Q10 applies the same model to pharmaceutical quality systems. The vocabulary changes by industry. The sequence does not.