26 of 44 FDA warning letters issued in FY2025 cited CAPA deficiencies. That is 59 percent of warning letters containing at least one finding related to how a pharmaceutical manufacturer identifies, investigates and resolves quality problems. CAPA has been in the top ten FDA inspection observations every year since 2015. In 2026 it is not getting better.
The May 2026 warning letter to Medline Industries illustrates exactly what happens when a CAPA system fails repeatedly. FDA cited the facility for failing to adequately investigate and implement corrective actions to determine root causes and prevent recurrence of repeated contamination incidents. The same issue had been cited in a previous 483 issued in January 2025 and discussed in a regulatory meeting in May 2025. Seventeen months of repeated CAPA failure on the same contamination problem - with multiple investigations since 2023 all identifying the same root cause - resulted in a warning letter, production suspension and the requirement to verify corrective actions as effective before notifying FDA of intent to resume production.
This article explains what a compliant CAPA system requires, why CAPA systems fail even when documentation exists and the four citation patterns FDA inspectors document most frequently when they review a pharmaceutical CAPA programme.
What a CAPA system is and what it is required to do
A corrective and preventive action system is the mechanism by which a pharmaceutical manufacturer identifies quality problems, investigates their root causes, implements actions to resolve them and prevents recurrence. Under 21 CFR 211.192 any unexplained discrepancy or failure of a batch to meet specifications must be thoroughly investigated. The investigation must have a written record including conclusions and follow-up. ICH Q10 Section 3.2.1 positions CAPA as a core element of the pharmaceutical quality system - not a documentation exercise but an active quality improvement mechanism.
The regulatory requirements for CAPA span multiple sections of 21 CFR Part 211. The investigation obligation under 211.192 applies to any failure to meet specifications. The quality unit's oversight role under 211.22 extends to reviewing and approving CAPA decisions. The annual product quality review under 211.180(e) must evaluate the effectiveness of previously implemented CAPAs. Together these create an expectation that CAPA is a closed loop - problem identified, root cause confirmed, action implemented, effectiveness verified.
"There shall be a written record of any investigation, and shall include the conclusions and follow-up."
21 CFR 211.192What FDA inspectors assess when they review a CAPA programme is not whether the documentation exists - it is whether the system actually works. A CAPA that is documented but does not address the root cause will generate a repeat finding. A CAPA that is documented and addresses the root cause but is never checked for effectiveness will eventually generate a repeat finding. FDA's shift since 2024 has been explicit: from CAPA closure to CAPA effectiveness. The question inspectors are asking in 2026 is not "did you close the CAPA" but "did the CAPA work."
The four most common CAPA citation patterns in 2025 and 2026
Citation 1 - Retraining as the only corrective action
The most consistently cited CAPA deficiency in FDA enforcement data is the use of retraining as the sole corrective action for a deviation or quality event. FDA's position on this is unambiguous and has been stated repeatedly in warning letters and guidance documents: human error is rarely the true root cause of a quality failure - it is most often a symptom of a deeper system failure.
When an operator makes an error that causes a deviation the investigation must determine why the error was possible. What system failure allowed it to occur? Was the SOP unclear? Was the process designed in a way that made errors more likely? Was there inadequate supervision? Was the workspace configured in a way that created confusion? Retraining addresses the person. A compliant root cause analysis addresses the system that allowed the person to err.
FDA inspectors consistently cite CAPA programmes where retraining appears as the corrective action for multiple unrelated events across the review period. A pattern of retraining-only CAPAs is treated as evidence that the CAPA programme is not conducting genuine root cause analysis - it is assigning blame to individuals rather than identifying systemic failures. The March 2026 warning letters published on a single day each cited weak CAPA responses as the reason for escalation, with one domestic OTC site cited for a water system that had been failing specifications for over two years while the quality unit failed to act beyond repeated retraining.
Citation 2 - Root cause identified but preventive action absent
A CAPA that correctly identifies the root cause of a deviation but implements only a corrective action - fixing the immediate problem - without a preventive action to prevent recurrence in related processes or products does not satisfy the full regulatory requirement.
The distinction between corrective action and preventive action is fundamental. The corrective action addresses the specific event that occurred. The preventive action asks whether the same root cause could produce the same failure elsewhere - in other products, other equipment, other production lines, other manufacturing sites. A CAPA that corrects a deviation on Line A without assessing whether Line B, Line C or other products manufactured on the same equipment are potentially affected leaves a systematic gap that inspectors identify.
This is precisely what FDA cited in the 2026 warning letter involving a sterile drug manufacturer that failed to evaluate historical environmental monitoring data after multiple contamination events. The CAPA addressed individual incidents without assessing the pattern across the full dataset. FDA concluded that the CAPA lacked root-cause confirmation and preventive robustness - a breach of FDA Compliance Program 7356.002.
Citation 3 - CAPA effectiveness not verified or verification inadequate
Closing a CAPA without a documented effectiveness check is one of the most mechanically simple violations to cite and one of the most common. An effectiveness check confirms that the corrective and preventive actions implemented actually resolved the root cause and prevented recurrence. Without it the CAPA loop is not closed - the system has no way of knowing whether the actions taken worked.
FDA inspectors are now comparing current incidents with historical CAPA records to evaluate effectiveness. If a CAPA was closed twelve months ago and the same or similar event has occurred since closure the effectiveness check either did not happen or was inadequate. The April 2026 enforcement data shows a warning letter issued because a manufacturer's own verification-of-effectiveness data showed the CAPA was failing for three consecutive quarters before the firm acknowledged ineffectiveness and opened a supplemental CAPA. The firm's VOE data clearly showed the problem - but the CAPA was not routed back to an earlier phase when the data exceeded the threshold.
What a compliant effectiveness check requires: a pre-defined metric that would demonstrate the corrective action worked, a defined timeframe for the check, a responsible person who will conduct and document it, and a process for reopening the CAPA if the check shows the action was not effective. The effectiveness check criteria must be defined before the CAPA is implemented - not after.
Citation 4 - Systemic CAPA not initiated for repeat or trending events
When the same type of deviation, the same type of OOS result or the same type of complaint occurs repeatedly without triggering a systemic CAPA the quality system is failing to perform one of its core functions. Individual CAPA records may be adequate for each isolated event. The failure is in the absence of trend analysis that identifies the pattern and triggers a systemic response.
FDA expects the CAPA programme to capture inputs from multiple quality data sources - deviations, complaints, OOS results, audit findings, stability failures, environmental monitoring excursions - and identify patterns that warrant systemic action even when each individual event appears contained. A CAPA trigger dashboard that automatically flags potential systemic CAPA events - three or more similar complaints, repeated deviations on the same equipment, OOS patterns across multiple batches - demonstrates the quality system maturity FDA is looking for in 2026.
The Medline Industries warning letter is the clearest recent example. Multiple investigations since 2023 had identified the same root cause for the same contamination problem. Individual CAPAs were documented for each event. No systemic CAPA addressed the persistent underlying failure. Seventeen months after the first 483 observation on the same issue, production was suspended.
When an inspector reviews a CAPA programme they look for three things simultaneously: whether individual CAPAs address root cause not symptom; whether CAPA effectiveness has been verified with documented evidence; and whether trend analysis is identifying systemic patterns before they generate repeat citations. A CAPA programme that passes the first test but fails the second or third will still generate findings.
What FDA inspectors actually review when they assess a CAPA programme
Understanding what inspectors physically examine during a CAPA review prepares the quality team to present the programme in its best light and to identify gaps before the inspector finds them.
Inspectors typically request the CAPA log for the last 12 to 24 months. They look for the total volume of CAPAs, the distribution of CAPA types and sources, the average time from CAPA initiation to closure and the effectiveness check status for closed CAPAs. A CAPA log showing a high proportion of closed CAPAs with no effectiveness check dates is an immediate signal.
Inspectors then select individual CAPAs for detailed review - typically any CAPA related to a topic already on their inspection agenda, any CAPA where the root cause is listed as human error, any CAPA that has been open for longer than the site's own SOP-defined closure timeline and any CAPA initiated in response to a previous 483 observation. For each selected CAPA they will read the investigation narrative, assess whether the root cause identified is genuinely a root cause or a symptom, review the corrective and preventive action plan for specificity and measurability, and look for the effectiveness check record.
They also cross-reference the CAPA log against other quality data. If a particular process, piece of equipment or product appears in multiple CAPA records during the review period the inspector will ask what systemic CAPA was initiated to address the pattern. If the answer is none, or if the individual CAPAs were each closed as isolated events without trend assessment, that becomes a finding.
What a compliant CAPA system looks like in practice
A compliant CAPA system has seven elements that FDA investigators assess during inspections. Every element must be present for the system to satisfy regulatory expectations.
Problem identification must be systematic and comprehensive - drawing from deviations, complaints, OOS results, audit findings, stability data and environmental monitoring. If quality events are entering the CAPA system inconsistently the system cannot function as intended.
Root cause analysis must use a structured documented methodology - 5 Whys, fishbone diagram, fault tree analysis or FMEA - chosen based on the complexity of the event and documented with justification. The methodology must be applied cross-functionally with input from operations, quality, engineering and where relevant regulatory affairs. Single-perspective investigations miss the systemic dimension of most quality failures.
Corrective action must directly address the identified root cause with specific measurable actions, responsible owners and realistic timelines. Vague commitments - "procedures will be reviewed" or "training will be enhanced" - without specific deliverables are consistently cited as inadequate.
Preventive action must assess whether the same root cause could produce the same failure in related processes, products, equipment or sites. This assessment must be documented even if the conclusion is that no other areas are affected.
Implementation verification must confirm that the actions were actually implemented as planned. Approval of the action plan is not the same as evidence of implementation.
Effectiveness check must be conducted after a pre-defined period using pre-defined success criteria. The check must be documented. If the effectiveness check shows the action was not effective the CAPA must be reopened and the process repeated.
Trend analysis and management review must occur at a frequency appropriate to the volume of CAPA activity. ICH Q10 requires CAPA to feed into management review. A CAPA programme that is never reviewed at management level and that never generates systemic CAPAs from trend analysis is not functioning as a quality system improvement mechanism.
In March 2026 FDA published a new draft guidance on responding to FDA Form 483 observations. It explicitly cited inadequate responses due to lack of relevant data, excessive data without focus and failure to address the root cause of observations. A generic CAPA commitment in a 483 response without substantive root cause analysis will not be accepted as adequate and will be weighed in FDA's escalation decision to a warning letter.
Three things to do before the next inspection
Review your last 12 months of CAPA closures for retraining patterns. Pull every CAPA closed in the last 12 months where the corrective action includes retraining. Count how many have retraining as the only corrective action. For each one ask whether the investigation identified the systemic reason the error was possible. If it did not, the CAPA is potentially citable as inadequate root cause analysis regardless of whether the specific event recurred.
Audit your effectiveness checks. For every CAPA closed in the last 18 months confirm there is a documented effectiveness check with pre-defined criteria and a conclusion. Any closed CAPA without a documented effectiveness check is a gap. Prioritise CAPAs initiated in response to previous 483 observations - these are the first ones FDA will examine in the next inspection.
Run a trend analysis across your quality data sources. Look for any process, product, equipment item or personnel category that appears across multiple CAPA records without having triggered a systemic CAPA. If you find such a pattern, initiate a systemic CAPA now. Demonstrating proactive identification of a trend is significantly better than being cited for missing it during an inspection.
The GMPify Deviation Investigation Framework Builder generates a complete six-section investigation framework for any manufacturing deviation - covering scope determination, root cause analysis methodology, CAPA structure with a 90-day implementation timeline, effectiveness check criteria, documentation requirements and regulatory notification assessment. Free to use at gmpify-tools.netlify.app/deviation-investigation.html.