The goal of a CAPA (Corrective and Preventive Action) is to solve a problem or issue. When this goal is achieved, the CAPA process extends beyond a regulatory burden, and generates real value for a company.

But many organisations struggle with their CAPA efforts – having too many open CAPAs, several unsolved CAPAs, and/or ineffective CAPAs causing issue reoccurrence. This places a high burden on the company, often causing frustration amongst the employees involved.

In this article, our Head of Quality Dr. Dirk Hüber reflects on the causes of such a situation and how it can be avoided, or – if already present – how the situation can be ameliorated so that the CAPAs become effective and efficient, and associated employees become re-motivated. The approach outlined below – which is fully compatible with ISO 13485:2016, FDA 21 CFR 820.100, and EU MDR quality system expectations – explains how to maximise the potential value of CAPA while significantly improving effectiveness and resource utilisation.

The Nonconformance and CAPA process

For context, let’s begin by visualising the Nonconformance (NC) process (Figure 1) and the CAPA process (Figure 2). The way these two processes are displayed follows a simple paradigm:

A CAPA can only be started from an NC:

• The NC describes and handles the nonconformity
• If it is decided that the root causes of the nonconformity shall be removed or reduced, a CAPA is started from the NC

In our experience, this is a clear and straightforward way to handle events that represent a nonconformity, regardless of the nonconformity’s source and whether the nonconformity requires a CAPA.

Root Cause Analysis (RCA) is part of a CAPA and the first step in the process for any CAPA, (see Figure 2). In an NC, only the known or immediate causes of the nonconformity are documented (see Figure 1, step 2). The immediate causes are the events that immediately led to the nonconformity, i.e., the last event in the chain of events that led to the nonconformity. These immediate causes are usually obvious without an elaborate investigation. In an NC, these known or immediate causes are necessary to perform the risk assessment for the nonconformity, because they should present e.g., as failure modes in the risk management file of the affected product. However, knowledge of the root causes is not a prerequisite for any task within an NC.

Handling the 4 decision points

Importantly, the processes in Figures 1 and 2 each contain two decision points, marked by light green frames around the respective process steps. It is crucial to manage and control these decision points to enable efficient and effective NCs and CAPAs.

In the following sections, we will explain for each of these four decision points:

• How the decision point is usually handled
• How the usual handling leads to lack of control
• How the decision point can be handled more efficiently and effectively to control the decision
• How such control contributes to efficiency and effectiveness

Decision point 1 | Is the event a nonconformity?

The first decision point is at the beginning of the NC process: is the event of interest a nonconformity, thus requiring the opening of an NC? In many practical cases, the events for which NCs are opened are either not nonconformities or could be handled in a more efficient way. Below are some typical examples.

Deviation from processes

Deviations from QMS processes may become necessary for a variety of reasons; frequently, because the existing processes are not sufficiently fit for a specific situation.

Often, a process deviation is intended and planned and as such, no NC is needed. Instead, the planned process deviation is described and justified in the document that plans the respective activities, e.g., in a development, risk management, verification, or change plan.

If it becomes apparent that a deviation from a process or an already approved plan becomes necessary while an activity is already executed (e.g., due to new information or changed circumstances), a pragmatic approach is to:

• Update the respective plan with the deviation and its justification if the deviation is significant, or
• Report the deviation and its justification in the respective report if the deviation is not significant

Production on risk

Production on risk often happens if activities for process validation have been successfully performed, but the formal approval of the validation report and the release of the manufacturing line for routine production still require some time, whilst it is necessary for business reasons to already start manufacturing.

If this happens frequently, it should first be considered whether the formalism can be reduced through more pragmatic handling.

Secondly, the production on risk should be described within the QMS, ensuring quarantine of the manufactured goods and the steps necessary to later release the goods from quarantine once all formal pre-requisites are fulfilled.

Equipment failure

Not every equipment failure e.g., in manufacturing, requires an NC. This is the case if the failure and how it must be handled is described in a procedure or in the equipment handbook.

Equipment failure, which is not significant (e.g., not affecting any product), could also be handled via a process for unplanned maintenance with much less effort than required by an NC.

If such alternative approaches are implemented it is important to still document, monitor, and trend equipment failures handled via the alternative approach. In case a negative trend is identified, an NC should be opened to understand it and act appropriately.

Inherent process failures

For some manufacturing technologies it is unavoidable that some parts or components are not manufactured according to their specifications. For example, abrasive technologies create particles, and plastic moulding may lead to burrs. Such process failures are inherent to the applied manufacturing technology and therefore might also be called ordinary process failures.

Such ordinary process failures are evaluated in a process FMEA and mitigated via preventive and/or detecting measures. However, often such measures cannot fully remove the failure, but only reduce its occurrence to an acceptable level.

Since they are known and expected failures, they should not lead to an NC if detected. Instead, their handling should be described either in the master batch record (if product specific) or within the QMS (if generic). Here, documentation, monitoring, and trending is necessary to be able to take appropriate action in case of a negative trend. Equally, extraordinary process failures (i.e., unexpected process failures) always require an NC to be opened.

Incoming inspection failure

If, during an incoming inspection of supplied material, it is found that the supplied material is not according to specification, an NC may not always be required. Often, a process to inform the supplier and reject the received material would be sufficient if the received material is deemed low risk. Again, documentation, monitoring, and trending is necessary to be able to take appropriate action in case of a negative trend.

Tailoring the approach case by case

Above we have exemplified cases where alternative approaches to an NC might be more appropriate and efficient, without losing effectiveness. Deciding which approach in which cases is appropriate depends on the risks involved and the nature of the products and processes, so it must be evaluated by each company for their individual situation. Efficiency is gained in all the examples shared through standardisation of events that happen frequently enough to justify the one-time effort connected to developing the respective standards.

Experience shows that an NC not only requires more effort than a standardised process for a specific event, but also that more NCs lead to more CAPAs, since the decision on whether an NC requires a CAPA is not always well managed and controlled – as explained next.

Decision point 2 | Is a CAPA needed?

Once the risk of the NC has been assessed, the decision can be made on whether a CAPA and/or a SCAR (Supplier Corrective Action Request – a request to a supplier to take Corrective Actions) is needed. A CAPA/SCAR is needed if the root causes of the NC need to be removed or reduced to an acceptable level by Corrective Actions, and/or if by Preventive Actions the probability that the nonconformity happens somewhere else (e.g., in another manufacturing line or another site, or for a similar topic) needs to be reduced.

In many companies, this decision is based upon hard criteria, e.g., if a certain risk level is exceeded, a CAPA and/or a SCAR is required. Usually, it is left to the NC Owner to open a CAPA if the criterium is fulfilled. If the criterium is not fulfilled, a CAPA and/or SCAR may still be opened, again, usually at the discretion of the NC Owner.

This kind of “automated” creation of new CAPAs out of NCs means that the company has no control over how many, and which CAPA are opened:

• Having no control on how many CAPAs are opened means that the company has no control over how many resources are required to process the open CAPAs. In reality, in such a setting no resources are actively appointed to a newly opened CAPA, since NC owners usually lack authority over resources, and CAPA is often not prioritised by line managers. As a result, CAPA teams become understaffed, sometimes even lacking the necessary skill set, experience, and/or knowledge to process the CAPA adequately. Thus, CAPA progress is slow or zero, and CAPA quality is low, resulting in ineffective and inefficient CAPA.
• Having no control on which CAPAs are opened means a lack of control on the topics which are addressed in CAPAs, and which resources are assigned. Accordingly, management cannot prioritise which topics should be addressed and solved.

To assume control over these topics and demonstrate the value of CAPA to the organisation, a proven solution is to install a CAPA Board:

CAPA Board

A CAPA Board is a panel with the authorisation to decide whether for a given topic a CAPA shall be opened or not. It functions as follows:

1. NC owners file a CAPA Request to the CAPA Board if the defined criteria require this, or at their own discretion
2. The NC Owners present their CAPA Requests to the CAPA Board who meet regularly
3. For each CAPA Request, the CAPA Board decides if:
   • A CAPA shall be opened
   • A CAPA shall be opened at a later date, e.g., due to lower priority of the topic and resource availability
   • No CAPA shall be opened, instead the topic shall be addressed outside of the CAPA process, e.g., via a change
   • No CAPA shall be opened, only the NC activities are performed
4. If it is decided to open a CAPA, the CAPA Board also assigns the CAPA Owner and the CAPA team, i.e., the resources to process the CAPA

Thus, the CAPA Board is accountable for prioritising the issues that need to be solved with consideration of the available resources, and deciding on the appropriate effort based on the risk connected with the issue.

The CAPA Board is led by the Quality function and consists of all operational functions involved in CAPA. It sits on a management level that has the competence to make the decisions as laid out above.

Decision point 3 | Is the CAPA ready for implementation?

The first decision point in the CAPA process asks whether the CAPA is ready for implementation. In most companies, this is not a decision point – the CAPA just moves on. Often, implementation activities start even if some planning is unfinished.

However, at this point in the CAPA workflow a review and approval of the planning phase should take place. This is crucial to improving the quality of CAPA, making CAPA effective, and ensuring that the issues addressed in CAPA are really solved.

To assume control over the quality of CAPA, a proven solution is to install a CAPA Review Board:

CAPA Review Board

Once the CAPA team has prepared the RCA, the plan for Corrective and Preventive Actions, as well as the plan for the Effectiveness Check, the CAPA Owner presents this to the CAPA Review Board. The board will discuss these outcomes with the CAPA Owner, and especially check on the following topics:

• Are the identified root causes really root causes, or only causes in the chain of events that led to the nonconformity?
• Have all root causes been determined?
• Do the Corrective and Preventive Actions adequately address all the root causes?
• Will the Effectiveness Checks genuinely check the effectiveness of the CAPA?
• Are sample sizes, acceptance criteria, and scheduling in the Effectiveness Check Plan adequate?

Performing an RCA is the most important task within a CAPA, and also the most difficult – requiring significant experience and skill. Furthermore, developing a Corrective and Preventive Actions Plan once the root causes have been determined that will lead to an effective CAPA is often not easy. Similarly, planning an Effectiveness Check that is meaningful may be challenging.

Therefore, the function of the CAPA Review Board is not to control the CAPA Owner and CAPA team, but to support them such that their CAPA will likely be effective.

If all the above questions are answered satisfactorily, the CAPA Review Board will approve the CAPA for implementation. Otherwise, the CAPA Owner will receive advice or instructions as appropriate on how to revise the RCA and/or the plans and will be asked to present to the CAPA Review Board again at an agreed date.

The CAPA Review Board, which also reviews and approves/denies all CAPA extension requests, is led by the Quality function and consists of experienced, senior members, who have the expertise and skills necessary to ask the right questions to guide the CAPA Owner.

Decision point 4 | Is the CAPA effective and may it be closed?

The last step in the CAPA process is also the last decision point: the decision whether the CAPA is effective and thus may be closed. It may seem that this decision is trivial: if execution of the Effectiveness Check Plan was successful, the CAPA is effective and may be closed. Accordingly, in many companies at this point there is at best only a formal check of the CAPA.

However, reality is often not that simple. There may be deviations from the plan, or the results – especially for the Effectiveness Check – may not be as definite as they first appear. New insights may have also arisen during implementation of the CAPA. As such, closing a CAPA is not as straightforward as it is often handled.

Again, the CAPA Review Board is the solution:

CAPA Review Board

Before a CAPA may be closed, it is presented a second time to the CAPA Review Board. The board will check the actions implemented for the CAPA, and especially check on the following topics:

• Have all actions been implemented according to plan?
• Are possible deviations from the plan justified?
• Is the evidence for implementation adequate, especially for the Effectiveness Check?
• Can the CAPA be closed?

As with other plans as explained above, CAPA plans may also require adjustment during implementation, e.g., due to new information or changed circumstances. If the intended change to a CAPA plan is significant, the CAPA Owner shall present the change and its justification to the CAPA Review Board, to receive approval for the changed CAPA plan.

If the intended change to a CAPA plan is not significant, the CAPA Owner documents it and presents the change and its justification to the CAPA Review Board when the CAPA is ready for closure. Additionally, the CAPA Review Board will check if there have been any unintended deviations from the CAPA plan during implementation.

Also, the evidence provided for the execution of the Effectiveness Check is reviewed and checked for conclusiveness – which is sometimes found to not be the case upon second view.

CAPA Board vs CAPA Review Board

Above we introduced two distinctly different boards to support the CAPA process: the CAPA Board and the CAPA Review Board. These two boards fill distinct roles within the CAPA process:

• The CAPA Board owns a managerial role, deciding which topics are escalated to CAPA, and which are dealt with in other ways – prioritising and assigning the resources to CAPA
• The CAPA Review Board owns an operational role, supporting the CAPA Owner and CAPA teams in achieving effective CAPA efficiently

Accordingly, the two boards do not usually share the same membership, or only partially so.

In conclusion…

The advice in this article is a proven approach, and with the required set of expertise and skill it will lead to effective and efficient handling of CAPA. Furthermore, if implemented correctly the two boards proposed here can be operated very efficiently with only reasonable effort required from their members.

Practice shows that additional measures should often be taken to support CAPA teams. For example, knowledge and experience in root cause analysis methods is frequently insufficient; sometimes CAPA Owners require more guidance than can be provided by the CAPA Review Board. If this is the case, training and mentoring a small expert team that supports CAPA Owners and CAPA teams works well to meet such needs.

Controlling the number of CAPAs will mitigate over-burdening. And with the necessary support and resources provided to CAPA teams, CAPA will comprehensively solve the issues that arise, and avoid reoccurring issues. Ultimately, morale and motivation amongst relevant employees will improve accordingly, adding further, lasting value to the organisation.

Should you have a CAPA challenge, feel free to get in touch with our Quality experts.