CAPA System: Lifecycle, Risk Linkage, and FDA Enforcement

A corrective and preventive action system is what the FDA expects every medical device manufacturer to run in order to find quality problems, fix them at the root, and keep them from coming back. As of February 2, 2026, CAPA system FDA requirements are governed by the Quality Management System Regulation (QMSR), which incorporates ISO 13485 by reference into 21 CFR Part 820.¹ CAPA deficiencies remain among the most frequent inspection findings, and failures can escalate from warning letters to product seizures, injunctions, and criminal prosecution with fines up to $1,000,000.²

What Changed on February 2, 2026

The old framework spelled out CAPA obligations directly in 21 CFR 820.100. That section no longer exists. Under the QMSR, § 820.10 requires every manufacturer subject to Part 820 to document a quality management system that complies with ISO 13485 as incorporated by reference.¹ CAPA is still mandatory. The specific requirements now flow from ISO 13485 rather than from freestanding FDA regulatory text.

On the same date, the FDA retired its Quality System Inspection Technique (QSIT) and began inspecting under a new compliance program aligned with the QMSR.³ If your procedures still cite “820.100” as the controlling regulation, update them. Companies already certified to ISO 13485 face a mostly procedural transition. Companies that relied only on the old 820.100 text face a bigger adjustment, because ISO 13485 demands a broader, risk-based approach rather than a checklist of discrete CAPA steps.

The FDA also recognizes ISO 14971 (risk management for medical devices) as a consensus standard relevant to inspections.⁴ Conformity to consensus standards is voluntary, but demonstrating it during an inspection strengthens a manufacturer’s position.

Corrective Action vs. Preventive Action

Corrective action addresses a problem that has already happened: a failed batch, a customer complaint, an audit gap. The first move is containment. Quarantine affected product, place holds on distribution, or pull specific lots. Once the immediate risk is controlled, the investigation must find and eliminate the root cause. Fixing a defective component solves today’s complaint. Redesigning incoming inspection so defective components never reach production solves the underlying weakness. A fix that only treats the symptom will show up as a repeat inspection finding, and repeat findings dramatically increase the odds of escalated enforcement.

Preventive action is the forward-looking counterpart. It targets problems that haven’t happened yet but show early warning signs in service reports, trending complaint categories, process capability studies, or environmental monitoring. When a parameter drifts toward its control limit even though no product has failed, that is a preventive action trigger. A common audit finding is a system that handles corrective actions well but has no real preventive pipeline. Regulators treat preventive action as evidence that a manufacturer is managing risk proactively rather than reacting to failures.

The CAPA Lifecycle FDA Inspectors Look For

A CAPA begins when someone formally enters a concern into the tracking system. The source might be a complaint, an audit observation, a process deviation, a trend, or an adverse event report. During the initial evaluation, the quality team assesses severity and risk. Not every issue warrants a full CAPA; minor deviations may need only a correction with monitoring. The significance and risk of the nonconformity determine whether a full root cause investigation is needed.

Root Cause Analysis

The FDA does not mandate a specific methodology. Its inspection guidance requires that failure investigations be conducted to determine root cause where possible and that the depth of investigation be “commensurate with the significance and risk of the nonconformity.”⁵ Common approaches include the 5 Whys, fishbone diagrams that map contributing factors across categories like equipment, personnel, and materials, and fault tree analysis for complex system failures.

Investigations typically pull in multiple departments and review equipment calibration records, training documentation, supplier data, and software logs. The FDA expects firms to use “appropriate statistical and non-statistical techniques” for analyzing quality problems, including tools like Pareto analysis to prioritize the most impactful failure modes.⁵ Investigations most often fail when they stop at the first plausible explanation without confirming it with data. An inspector who sees “operator error” listed as root cause, with no evidence of what the operator did wrong or why the system permitted it, will flag the investigation as inadequate.

Implementation and Verification of Effectiveness

Once the root cause is confirmed, an implementation plan specifies exactly what changes are required, who owns them, and by when. Changes might include recalibrating equipment, revising standard operating procedures, retraining personnel, modifying a design input, or qualifying a new supplier. Implementation ends only when the changes are fully integrated into daily operations and documented.

Verification of effectiveness is the most heavily scrutinized stage. The team monitors the process over a defined period to confirm the action worked and no new problems have emerged. FDA guidance expects sampling plans to be written and based on a valid statistical rationale, not arbitrary sample sizes. When the population distribution is unknown, a minimum of 30 samples is a commonly accepted baseline rooted in the central limit theorem. Common deficiencies include firms documenting verification as “no complaints received” without any proactive data collection, or firms using vague sampling like “randomly check some units” with no statistical justification.⁶

If verification shows the action failed, the cycle restarts. A new investigation opens, and the process repeats until the organization can demonstrate the risk has been eliminated or reduced to an acceptable level. Every iteration must be documented.

Linking CAPA to Risk Management

A CAPA system does not operate in isolation. When an issue arises, one of the first questions is whether it appears in the existing risk analysis for the product. If it does, the team evaluates whether the original severity and probability estimates still hold or whether the real event shows the risk was underestimated. If the issue is not in the risk analysis at all, it must be added, assessed against the organization’s risk acceptability criteria, and managed through the risk control process.

This integration sets priority. An issue tied to what the design team identified as an “essential output” (a characteristic critical to the device functioning properly) gets immediate resources and elevated priority. An issue that falls within previously accepted risk levels may justify a lower response priority, though the rationale must be documented with objective evidence. Organizations that treat CAPA and risk management as separate systems tend to produce investigations that lack context, because the investigator does not know whether the failure mode was already known or is something new.

Reporting Deadlines Triggered by CAPA Outcomes

Some CAPA outcomes trigger mandatory reporting on tight deadlines. When a corrective action results in a product correction or removal intended to reduce a health risk, the manufacturer must submit a written report to the FDA within 10 working days of initiating the action. If the correction or removal later extends to additional lots, an amended report is due within another 10 working days.⁷

Separately, the Medical Device Reporting (MDR) rules under 21 CFR Part 803 require manufacturers to report deaths and serious injuries linked to their devices. The standard deadline for manufacturers is 30 calendar days after becoming aware of a reportable event. That window shrinks to five working days when the event requires remedial action to prevent an unreasonable risk of substantial harm to the public, or when the FDA has made a written request for a report. A “serious injury” means one that is life-threatening, results in permanent impairment, or requires medical intervention to prevent permanent damage. User facilities such as hospitals have a 10 working day window.⁸ Missing these deadlines is itself a regulatory violation, independent of whatever quality problem triggered the CAPA.

Recordkeeping and Data Integrity

A CAPA is only as strong as the documentation behind it. Inspectors expect a complete file for every CAPA that tells the full story: the initial trigger, the investigation, the root cause determination, the action plan, the implementation evidence, and the verification results. Each file must contain a clear audit trail tracking every change, decision, and approval from opening to closure.

Electronic Records Under 21 CFR Part 11

When CAPA records are maintained electronically, 21 CFR Part 11 applies. The regulation requires secure, computer-generated, time-stamped audit trails that independently record the date and time of every entry or action that creates, modifies, or deletes a record. Changes must not obscure previously recorded information. Electronic signatures must include the signer’s printed name, the date and time of signing, and the meaning of the signature, such as review, approval, or authorship.⁹ Audit trail documentation must be retained at least as long as the underlying records and be available for agency review.

ALCOA+

The FDA evaluates data integrity using a framework called ALCOA+. The core ALCOA elements require that quality records be:

Attributable to the person who generated the data
Legible and permanent
Contemporaneous, recorded at the time the work was performed, not reconstructed later
Original, meaning the first recording of the data point rather than a transcription
Accurate and representative of the facts

The “+” adds four elements aimed at electronic systems: Complete (including repeat analyses or reprocessing data), Consistent (recorded in the expected sequence with proper timestamps), Enduring (maintained intact throughout the retention period), and Available (accessible at any time during that period).¹⁰ Records that fail these criteria undermine the entire CAPA file, because an inspector who cannot trust the data cannot trust the investigation built on it.

Retention

Under the previous framework, quality records had to be retained for the design and expected life of the device, with a floor of two years from commercial release. The current QMSR directs manufacturers to ISO 13485 for record control, which requires retention for at least the lifetime of the device or as specified by applicable regulatory requirements.¹ For long-lifecycle devices like implants, that can mean decades of accessible, organized documentation. Inadequate recordkeeping is treated as seriously as the underlying quality failure and can independently trigger enforcement.

Software Validation

Any computer system used as part of the quality management system must be validated for its intended use according to an established protocol, and all software changes must be validated before approval and issuance. These activities and their results must be documented.³ This applies to enterprise eQMS platforms and to spreadsheets used to track CAPA metrics alike.

Inspectors find problems here frequently. A firm may have a solid CAPA procedure on paper, but if the software managing the workflow has not been validated, any data it produces is suspect. Common issues include systems that allow records to be modified without audit trails, systems upgraded without revalidation, and spreadsheets with unprotected formulas that can be accidentally altered. If the software touches your quality data, prove it works correctly and prove you tested it.

Enforcement When CAPA Fails

The FDA’s enforcement toolkit escalates in severity, and where a company lands on that spectrum often depends on how well its CAPA system performed when a problem surfaced.

Warning letters are the most common initial enforcement action. A warning letter identifies specific violations and demands a corrective response, typically within 15 business days. They are public records and can damage supplier relationships and stock prices well beyond the direct regulatory consequence.¹¹
Seizure and injunction. The FDA can seize adulterated or misbranded products and obtain court injunctions that halt manufacturing entirely until violations are corrected. Consent decrees arising from injunctions frequently require millions of dollars in remediation costs and third-party auditing before a facility can resume production.
Criminal prosecution. Introducing adulterated products into commerce is a federal crime. A first offense carries up to one year in prison and a $1,000 fine. A repeat offense or one involving intent to defraud rises to up to three years and $10,000. Knowingly adulterating a drug in a way that creates a reasonable probability of serious health consequences or death carries up to 20 years in prison and a fine of up to $1,000,000.²

Civil monetary penalties also apply, and the 2026 adjustment cycle was cancelled, so 2025 penalty levels remain in effect.² A CAPA program that documents its investigations, verifies effectiveness with real data, and connects to a working risk management process is the single strongest defense against ending up on any rung of that ladder.

1
eCFR. 21 CFR Part 820 – Quality Management System Regulation
2
Office of the Law Revision Counsel. 21 U.S. Code 333 – Penalties
3
U.S. Food and Drug Administration. Quality Management System Regulation (QMSR)
4
U.S. Food and Drug Administration. Corrective and Preventive Action Subsystem
5
Food and Drug Administration. Guide to Inspections of Quality Systems
6
U.S. Food and Drug Administration. Statistical Techniques – FDA Industry Conference
7
eCFR. Medical Devices; Reports of Corrections and Removals (21 CFR Part 806)
8
eCFR. Medical Device Reporting (21 CFR Part 803)
9
eCFR. 21 CFR Part 11 – Electronic Records; Electronic Signatures
10
U.S. Food and Drug Administration (FDA). Quality Essentials: Inspectional Coverage of QMS and Data Integrity
11
U.S. Food and Drug Administration. Warning Letters