CAPA Lifecycle Map | GMPify Training

⚠

CAPA Trigger — Problem Identified from Any Quality Data Source

A CAPA is initiated when a quality problem is identified from any source: deviation, OOS result, complaint, audit finding, trend analysis, environmental monitoring exceedance, management review or self-inspection. CAPA deficiencies appear in over 60% of FDA enforcement actions. ICH Q10 Section 3.2.2 establishes CAPA as one of four pharmaceutical quality system enablers. 21 CFR 820.100 provides the seven-element framework FDA uses to assess CAPA systems across both pharmaceutical and device manufacturers.

21 CFR 211.192 · 21 CFR 820.100 · ICH Q10 Section 3.2.2 · FDA QSIT Guide · FY2024 FDA enforcement data

Deviations

OOS results

Complaints

Audit findings

Trend data

EM exceedances

Self-inspections

Phase 1

Problem Identification and Risk Assessment

1Document the problem formally

Open CAPA record immediately. Document what occurred, when, where and what product or process is affected. Contemporaneous documentation required. Reference all source data - deviation report, OOS record, complaint number or audit finding. CAPA record number assigned.

21 CFR 820.100(a)(1) · ALCOA+ data integrity

↓

2Conduct initial risk assessment

Assess severity, scope and patient safety risk using documented methodology under ICH Q9(R1) 2023. Determine whether immediate containment is required. Classify CAPA priority - critical, major or minor. Document risk assessment rationale. Higher risk CAPAs require faster timelines and more rigorous investigation methodology.

ICH Q9(R1) 2023 · 21 CFR 820.100(a)(2)

↓

Is immediate containment required?

YES → Contain first NO → Step 3

↓

3Implement containment actions

Quarantine affected product, halt process if required, notify QA unit and document all containment actions with timestamps. Containment is not corrective action. It addresses the immediate situation while investigation proceeds. Document containment separately from CAPA corrective actions.

21 CFR 211.192 · ICH Q10 Section 3.2.2

↓

4Assess scope extension

Assess whether the problem could affect other batches, products, processes or sites. Document the scope extension conclusion - even when the conclusion is no other products are affected. 21 CFR 211.192 requires scope extension to other batches and products associated with the specific failure. Undocumented scope extension is a direct 483 citation risk.

21 CFR 211.192 · FDA OOS Guidance 2022

Phase 2

Root Cause Investigation

5Select RCA methodology

Select root cause methodology appropriate to the problem complexity. Document the selection rationale. 5 Why for single-factor linear problems. Ishikawa fishbone for multi-factor complex problems. FMEA for prospective risk and preventive action assessment. Fault tree for safety-critical events with multiple causal pathways. ICH Q9(R1) 2023 requires subjectivity reduction through structured documented methodology.

ICH Q9(R1) 2023 · 21 CFR 820.100(a)(2)

↓

6Conduct root cause analysis

Apply selected methodology with full documentation of the analytical pathway from observed event to identified root cause. Distinguish immediate cause from contributing causes from root cause. Human error is NOT a root cause - investigate why the system allowed the error. Document each Why in 5 Why or each branch in Ishikawa. Evidence must be objective not assumed.

ICH Q9(R1) 2023 · FDA QSIT Guide · 21 CFR 211.192

↓

Is root cause identified with objective evidence?

YES → Step 7 NO → Reopen investigation

↓

7Assess preventive action scope

Assess whether the identified root cause exists in other processes, products or sites that have not yet experienced the failure. Preventive action addresses potential failures before they occur. 21 CFR 820.100 specifically requires preventive action consideration. Document preventive action conclusion - including when no preventive action is required and why.

21 CFR 820.100(a)(3) · ICH Q10 Section 3.2.2

↓

⚠ Do not accept these as root causes

Human error ⋅ Operator did not follow procedure ⋅ Equipment malfunction ⋅ Training gap ⋅ Unknown. These are immediate causes or symptom descriptions. The investigation must explain why the system allowed the failure to occur and why it could occur again.

Phase 3

CAPA Implementation

8Define effectiveness criterion BEFORE implementing

This step must occur before corrective action implementation. Define a measurable effectiveness criterion with a specific threshold. Example: zero recurrences of the same deviation type in the same process area within 90 days of SOP update implementation. A criterion defined after closure is designed to confirm the action was taken - not that the problem was solved.

ICH Q10 Section 3.2.2 · FDA March 2026 Warning Letter VOE case

↓

9Develop CAPA action plan

Define specific corrective actions that address the identified root cause - not the symptom. Each action must have a named owner and a realistic completion date. Actions must change the system that allowed the failure - not just retrain the operator who experienced it. Preventive actions for other potentially affected processes documented separately with owners and timelines.

21 CFR 820.100(a)(4) · ICH Q10 Section 3.2.2

↓

10QA review and approve CAPA plan

Quality unit reviews and approves the complete CAPA plan before implementation begins. Review covers: root cause adequacy, corrective action scope, preventive action assessment, effectiveness criterion, timeline and owner assignments. QA approval documented with date. No corrective action implementation may begin without QA approval of the complete plan.

21 CFR 820.100(a)(5) · 21 CFR 211.22

↓

11Implement corrective and preventive actions

Execute approved corrective actions per plan. Document implementation evidence for each action: updated SOP with approval record, training record with competency assessment, equipment modification with qualification data, process parameter change with validation data. Implementation evidence must be objective - a training record showing who was trained and when, not just a note that training occurred.

21 CFR 820.100(a)(5) · 21 CFR 211.68 · ICH Q10

↓

12Communicate changes to responsible personnel

Ensure all personnel affected by the CAPA actions are informed and trained. 21 CFR 820.100 specifically requires that information on quality problems and CAPA be disseminated to those directly responsible. Communication records documented. Management review informed of significant CAPAs per ICH Q10 management review requirements.

21 CFR 820.100(a)(6) · ICH Q10 Section 3.2.4

Phase 4

VOE and Closure

13Conduct scheduled effectiveness check

At the pre-defined scheduled date conduct the effectiveness check using the pre-defined criterion and threshold. Collect objective data - do not rely on absence of complaints as evidence of effectiveness. For process-related CAPAs collect process performance data. For procedure-related CAPAs audit compliance with the new procedure. Document results with supporting data.

ICH Q10 Section 3.2.2 · 21 CFR 820.100(a)(7) · FDA March 2026 WL

↓

Does effectiveness check meet the pre-defined criterion?

YES → Step 15 NO → Step 14

↓ NO

14VOE failure — mandatory escalation

When the effectiveness check criterion is not met the CAPA does not close. Three required responses: (1) route CAPA back to root cause phase if original RCA may have been incorrect or incomplete, (2) open an additional CAPA addressing the new failure mode identified by VOE, or (3) implement supplementary containment and extend the monitoring period with documented justification. The March 2026 FDA warning letter cited a firm whose own VOE data showed failure for three consecutive quarters with no response. Do not repeat this failure mode.

FDA Warning Letter March 2026 · 21 CFR 820.100(a)(7) · ICH Q10

↓ YES

15Complete closure documentation

Prepare closure documentation package: completed root cause analysis with methodology; all corrective and preventive actions with implementation evidence; effectiveness criterion and verification result with supporting data; scope extension conclusion; preventive action conclusion; and QA approval for closure. All elements must be present before closure is submitted for QA review.

21 CFR 820.100 · 21 CFR 211.192 · ICH Q10

↓

QA approves CAPA closure?

YES → Close and trend NO → Address gaps

↓ YES

✓ CAPA CLOSED

Add to APQR trending ⋅ Submit to management review ⋅ Monitor for recurrence

ICH Q10 Section 3.2.1 and 3.2.4

⚠ March 2026 Warning Letter — VOE Failure Case

Q1 2025 — VOE check fails Complaint rate exceeds the pre-defined threshold. The CAPA SOP required routing back to a previous phase when effectiveness checks failed. The firm did not act.

Q2 2025 — VOE check fails again Second consecutive quarter exceeding the threshold. No additional CAPA opened. No containment applied. No response to the failing VOE data.

Q3 2025 — VOE check fails for third time Third consecutive quarter of failure. 221 complaints and 177 Medical Device Reports filed. FDA inspection conducted December 2025.

March 25, 2026 — FDA warning letter issued CDRH warning letter cited the VOE data showing failure for three consecutive quarters with no response as the primary CAPA system deficiency. The VOE plan existed. The threshold existed. The data exceeded it. Nobody acted.

The Seven CAPA Elements FDA Assesses — 21 CFR 820.100

Element 1 — Data analysis Systematic analysis of all quality data sources to identify existing and potential causes of nonconforming product or quality problems.

Element 2 — Investigation Investigation of causes of nonconformities relating to product, processes and the quality system.

Element 3 — Action identification Identification of the action needed to correct and prevent recurrence of nonconforming product and other quality problems.

Element 4 — Action verification Verification or validation of corrective and preventive actions to ensure they are effective and do not adversely affect the finished device.

Element 5 — Implementation Implementation of and documentation of changes in methods and procedures needed to correct and prevent identified quality problems.

Element 6 — Communication Ensuring that information related to quality problems or nonconforming product is disseminated to those directly responsible for assuring quality.

Element 7 — Management review submission Submission of relevant information on identified quality problems as well as corrective and preventive actions for management review. ICH Q10 requires CAPA data to feed both management review and Annual Product Quality Review with systemic trend analysis not just closure rate summaries.

Never do this

Close a CAPA with a failed effectiveness check. Accept human error as a root cause. Define effectiveness criteria after closure. Ignore VOE data that exceeds the pre-defined threshold. Close CAPAs to meet administrative targets without solving the underlying problem.

VOE design requirements

Criterion defined before implementation. Measurable with a specific threshold. Scheduled check date. Result feeds back into CAPA system. Failed criterion triggers mandatory escalation. All results documented regardless of outcome. Effectiveness period typically 30 to 90 days post-implementation.

Trending obligations

CAPA data must be trended at APQR and management review per ICH Q10. Three high-value analyses: root cause category trending, repeat CAPA rate and time-to-effectiveness. A repeat CAPA rate above 10% signals systematic investigation failure not isolated events.

Key regulations

21 CFR 211.192 — pharmaceutical investigation requirement. 21 CFR 820.100 — seven-element CAPA framework. ICH Q10 Section 3.2.2 — CAPA as PQS enabler. ICH Q9(R1) 2023 — subjectivity reduction in RCA. FDA March 2026 Warning Letter — VOE failure case.