21 CFR 820.100 - Corrective and Preventive Action (QMSR)

What it says

Procedures for corrective and preventive action must be established, requiring analysis of quality data sources, investigation of the cause of nonconformities, identification of actions needed to correct and prevent recurrence, verification that corrective and preventive action does not adversely affect the finished device, and documentation of activities.

Paraphrased for plain-language clarity. Always verify against the current published regulation text.

What it means in practice

• This is the device-side equivalent of the drug CAPA expectations built around 21 CFR 211.192 and ICH Q10, now aligned with ISO 13485:2016 under the Quality Management System Regulation.
• Data sources feeding CAPA are expected to be broad: complaints, service records, audit findings, nonconforming product reports and process monitoring data all count as inputs the system must analyse.
• Verification that a corrective action does not adversely affect the finished device is an explicit, distinct step - a fix for one problem must not be assumed safe without checking it did not introduce a new one.

What FDA inspectors look for

• Whether CAPA effectiveness checks use objective data against pre-defined criteria, rather than being closed based on the absence of a repeat complaint alone.
• Whether the same CAPA source, repeated similar complaints or nonconformities, is being addressed only individually rather than trended and assessed for systemic cause.
• Whether corrective action verification explicitly considers potential adverse effects on the finished device, documented as its own assessment step.

Related regulations