Corrective and Preventive Action:

The Closed-Loop System

Summary
The Corrective and Preventive Action To better manage the issues that launch With nearly every ISO standard,
(CAPA) process is a fundamental process the CAPA process, companies need to e.g. ISO 9001, ISO 13485, ISO 14001,
that affects all of the control points in a optimize their practices by implementing ISO/IEC 27001, or OHSAS 18001,
company’s management system. Auditors efficient, closed-loop CAPA processes. organizations must determine the actions
tend to look deeply into companies’ CAPA Every good CAPA process should have a they can take to eliminate the causes of
process during investigations. Key built-in audit process to verify and validate potential nonconformities.
questions typically asked include: that the CAPA system is at optimal A company’s ability to rapidly correct
performance. Data and evidence tracking existing problems and implement controls
• Are CAPAs followed-up in a timely
is a critical component of action to prevent potential problems is essential
fashion?
management as well, so the organization to ensure customer satisfaction and
• Do records prove that all actions have can ensure that all non-conformance achieve operational success. Even more,
been completed successfully? information can be confirmed, monitored, regulatory bodies, such as the Food and
measured, and, if necessary, corrected. Drug Administration (FDA), CFR - Code of
• Are all recommended changes
Federal Regulations Title 21 and
completed and verified?
Environmental Protection Agency (EPA),
• Was the actual root cause identified? and Resource Conservation and Recovery
How was it validated? Act (RCRA) require a corrective action
• Was action taken to correct or prevent program, to ensure the protection of all
the problem and ensure it will not interested parties.
happen again? While a CAPA process must meet the
• Has it been demonstrated that actions necessary industry compliance
taken have no adverse effects on requirements, it also must be effective.
products or services? Otherwise, managers will find themselves
in a constant state of response and the
• Was training performed and CAPA process becomes a bottleneck.
communications issued to assure that
all relevant parties understand the
situation that occurred and the changes
that have been made?
How CAPA Works: It’s All About Improvement
A preventive action is created to offset a Corrective and preventive actions are Companies that implement a closed-loop
potential problem. While the preventive processes that may be used to achieve CAPA process can expect to experience
action process can contribute to the continual improvement. Continual satisfying and cost-effective results. See
overall continual improvement effort, its improvement reflects an ongoing effort to Figure 1 for an illustration of a closed loop
main objective is to eliminate potential improve products, services, or processes. CAPA process and how it ties in to the
problems before they occur. Corrective It can be incremental improvement over Plan, Do, Check, Act process. Through
actions, on the other hand, provide time or breakthrough improvement all at continuous monitoring, issues are
managers with not only the data they once. For instance, an organization’s highlighted, thereby allowing them to be
need to construct an effective and delivery processes are constantly addressed real-time. Consequently, the
efficient closed loop corrective action monitored and evaluated in light of the closed-loop process reduces the number
process but can be used as input into fact that they are already considered to be and severity of issues that occur. Over
preventive actions from lessons learned effective; improvement may come in the time, organizations build an intelligent
reports and data provided. Using both form of making the processes more knowledge base and can implement
types of actions enables a company to efficient. Improved efficiency could lead to additional preventive actions, thereby
transform itself from an operation that is a decrease in administrative and being more proactive, further improving
continually reacting to failures, to one operations costs, thereby lowering the processes and operations throughout
with the processes in place to prevent costs of goods and services and providing their facilities. As a result, customer
problems in the first place. Ultimately the an opportunity to lower prices to be more satisfaction improves and the bottom line
company saves time and money and, competitive and win more business. moves in the right direction.
most importantly, retains customers.
In addition to these advantages, a closed-
loop CAPA process ensures that best
practices are consistently applied to the
Interested Interested processes that support compliance
Parties Parties requirements. Properly documented
actions provide managers with important
INPUTS OUTPUTS historical data, which may be used to
implement continual improvement plans;
a well thought, integrated process can
help in the capture and dissemination of
Establish operational intelligence related to
System these actions.
rn

Le
Lea

ar
n

PLAN
Maintain and Improve Implement
the System and Operate
RESPOND DO ACT the System
RECOVER PREVENT
CHECK
L ea
rn a
Le

rn

Monitor and Revies

the System
DETECT
Requirements Managed
and System
Expectations
Figure 1 - Close Loop Process
Defeating Non-conformities
When implementing a CAPA process, it is Some of the many issues related to the As illustrated in Figure 2, BSI ISO 9001
important to define all of the non- CAPA process are: field audit results over a twelve month
conformities that could impact a period reveal that the majority of
• Poor documentation of requirements
company’s operations. Having a good nonconformities are raised in the areas of
grasp of the non-conformities helps • Failure to document and communicate document and record control closely
managers write procedures and design updates or process improvements followed by monitoring & measuring, and
actions that will be taken when a following a CAPA improvement. All three are closely linked,
corrective action plan is launched. • Inability to trace training documents as a good CAPA system requires good
documentation and continuous
But what is a non-conformity? A non- • CAPAs that are outdated or closed monitoring in order to deliver continual
conformity is defined as a deviation from without validation improvement.
a specific procedure, standard, stated
process, or system requirement. When • Missing or misplaced data A closed-loop CAPA process enables
defining nonconformities, it is important • E-mail sandwiches 1 companies to avoid or minimize the
to identify the potential severity of the occurrence of issues, as managers are
impact they could have on a management • Failure to monitor critical controls better able to characterize problems and
system. For example, a major assemble the best possible cross-
nonconformity could be an actual or functional team of people to successfully
potential deficiency that will seriously tackle them.
affect the management system. A minor
1
one would be a less serious more isolated A CAPA record that is sandwiched in by multiple
untraceable e-mails that should be formally
incident, such as a documentation/work documented evidence.
instruction error or inaccuracy.

20

18 8.5
4.2 Improvement
16
Documentation 8.2
14 Requirements Monitoring &
12 Measurement
10

0
4 4.1 4.2 5 5.1 5.2 5.3 5.4 5.5 5.6 6 6.1 6.2 6.3 6.4 7 7.1 7.2 7.3 7.4 7.5 7.6 8 8.1 8.2 8.3 8.4 8.5 Not
Defined

Figure 2 - Non-conformance by clause

Opening a CAPA
Some organizations open a CAPA for Any actions taken should be appropriate nonconformities. In fact, the in vitro
every event, regardless of its severity or to each process related to the problem diagnostics (IVD) and the Medical Device
potential impact. However, this creates and should be considered in relation to (MD) Directives would require risk based
bottlenecks because employees become their impact on conformity to product investigations for CAPAs especially if they
so focused on their CAPAs that they find it requirements and the effectiveness of the are related to complaints and reportable
difficult to focus on their other day-to-day management system. If the system is events. Thorough investigations are
responsibilities. It also creates a feeling of monitoring wrong or contaminated data, mandatory for the FDA, Health Canada,
chaos and concern that “the sky is falling”; companies basing actions and assigning and other competent authorities, such as
continuous improvement suffers by trying resources to implement those actions the Federal Financial Institutions
to keep up with CAPAs. could find themselves wasting resources Examination Council and Federal Deposit
and money. and Insurance Corporation in the financial
ISO 9001:2008 simply states that when
industry and the Environmental Protection
planned results are not achieved, Risk assessment is a good way to avoid
Agency in the environmental sector. These
appropriate corrective action shall be this effect. Risk matrices2 help managers
are only just a few examples where an
taken. It goes on to say that when and teams to clearly define risk, severity,
industry sector regulation mandates a
managers are determining suitable and potential impact. They also help
specific CAPA process.
actions, they would be wise to consider determine which procedures, designs, and
the type and extent of monitoring or controls best define expected In addition to predicting problematic
measurement they plan to undertake. This performance. The higher the risk, the more events, risk assessment may suggest
is similar for many other ISO standards. likely it will be necessary to launch a monitoring a particular aspect of a
corrective or preventive action. An process or product. The results of the
example of high risk situations are those monitoring may yield measurements and
associated with medical device analysis that help managers’ spot trends
that in turn will justify the opening of a
CAPA. In many companies, the compilation
of results is aided by software tools that
Severity provide a framework for the analysis that
is critical to an effective CAPA process.

2
Risk Matrices - are mainly used to determine the size of a
Extensive risk and whether or not the risk is sufficiently controlled.

It looks at how severe and likely an unwanted event is.

Major

Medium

Catagories
Minor
Not Acceptable

ALARP
No Impact
Acceptable

Highly Unlikely Possible Likely Very likely Probability

unlikely

Figure 3 Example Risk Matrix

Responding to a CAPA
Once a CAPA has been opened, a cross- It is important to document the specific Next, the team must conduct a detailed
functional team should be assembled to source of the information that is gathered investigation of the circumstances that
respond to the event and clearly define by the team. The information collected created the problem by performing root
the (potential) problem. Team members helps with the investigation and cause analysis. Eliminating the root cause
should consider the source of the developing an action plan. It also helps the is the only way to prevent the problem
information and data. They also must team evaluate the effectiveness of the from recurring. Many problem-solving
obtain or draft a detailed description of action and communicate how a problem techniques help in this phase of the
the problem and consult any has been resolved. Some sources of good process. The most popular techniques
documentation and/or data that provides information include service requests, include use of process mapping, Fish
evidence that a problem exists. The team customer complaints, internal audits, and Bone, and the Five Whys.
then must evaluate the situation to staff observations. Trend data also can be
The 5 whys have been criticized in the
determine both the need for action and gathered from Quality Assurance (QA)
past because it is very basic:
the level of action required. inspections, process monitoring, and risk
analysis. The data gathered must be • Tendency for the team to stop and
When evaluating the problem the team
properly organized and shared through address symptoms rather than going on
should consider the potential impact of
some sort of relational database. This to lower-level root causes.
the problem in terms of its risk to the
data, when properly organized and • Inability to go beyond the team’s current
company and its customers, as well as any
disseminated, becomes operational knowledge - cannot find causes that
immediate action that may be required.
intelligence that may be leveraged by the they do not already know.
They also must determine and document
entire organization to help improve
why the problem is a concern and what • Lack of support to help the team ask the
performance.
impact it may have on the company and right “why” questions.
its customers. Typical concerns can
include costs, functions, product quality, Defining the Root Cause • Results are not repeatable - different
safety, reliability, and customer people using 5 Whys come up with
satisfaction. A problem statement is a clear concise different causes for the same problem.
description of the issues that need to be
The potential impact and risk assessment • Tendency to isolate a single root cause,
addressed by the assembled team, and
may indicate the need for some kind of whereas each question could produce or
not just a byproduct of a quick
immediate action to remedy the situation uncover different associated root
brainstorming session. The description
for the short term until a permanent causes.
must contain enough information so that
solution is developed and implemented. If the specific problem statement can be These can be significant problems when
the remedial action solves the problem easily understood. Data supporting the the method is applied through deduction
adequately, the CAPA can be closed. statement also must be easy to translate. only. On-the-spot verification of the
However, the team must document the The problem statement may have to be answer to the current “why” question
rationale for its decision and complete reviewed several times until the entire before proceeding to the next is
appropriate follow-up to validate team is clear and in agreement about the recommended to avoid these issues.
effectiveness of the action. task at hand.

Define the Probem:

Enter Problem
Statement Here

Why? The Root Cause

Enter 1st “Why” here is the Last Cause
Therefore
Because in the Cause Chain
Why?
Enter 2nd “Why” here
Therefore
Because
Why?
Enter 3rd “Why” here
Therefore
Because
Why?
Enter 4th “Why” here
Therefore
Because
Why?
Enter 5th “Why” here
Figure 4 - Five Why’s Because
The Fishbone diagram on the other hand production, process or design experiment action plan may be difficult. In this
is considered a more holistic approach to programs to quantitatively confirm that instance, a programmed tool with a
problem solving and root cause analysis. the prescribed solution actually will comprehensive search function can ease
Causes in the diagram are often resolve the problem. It is important to the discovery process and help ensure
categorized, such as to the 5 M’s, note if employee training should be part that affected areas are uncovered,
(Machine, Manpower, Machines, Methods, of the action plan. To be effective, all considered, and addressed.
and Measurements). Cause-and-effect modifications and changes must be
Once the long term permanent action is in
diagrams can reveal key relationships communicated to all persons,
place, the team needs to ensure that it has
among various variables, and the possible departments, suppliers, etc. that were or
records of all actions taken. It also must
causes provide additional insight into will be affected. Automated tools can
have a plan in place to follow-up, verify,
process behavior. facilitate these communications to
and assess the effectiveness of the
stakeholders and also ensure that
Causes can be derived from brainstorming solution it has implemented after a pre-
communications are received and
sessions. These groups can then be labeled determined period of time. The team also
acknowledged.
as categories of the fishbone. They will should implement preventive measures
typically be one of the traditional such as modifying management systems,
categories mentioned above but may be Solution operation systems, practices, and
something unique to the application in a procedures to prevent reoccurrence of
specific case. Causes can be traced back to The next step is implementing the this nonconformity and all similar types of
the actual problem. solution. It is important to confirm and problems.
verify that all of the required tasks
Root Cause Analysis requires asking a described in the action plan are initiated, As this is not a “one size fits all” process, it
series of questions to identify all of the completed, and documented. At the same is up to the team to determine the
possible causes that could explain why time, necessary changes to documents, verification method and timeline required.
the problem occurred. It also helps to processes, procedures, or other system In some cases (depending on your
identify why the problem was not noticed modifications must be described in a clear industry) your customer contract may
earlier. Then, all causes should be verified. and concise manner and should specify dictate a specified amount of time that
the desired outcome of any changes. As processes must be monitored during and
Once the root cause is established, the
one may imagine, in complex processes, after corrective action.
team should work together to create a list
of required tasks and implement pre- discovering the potential impact of an

Category 1 Category 2

Factor Factor

Factor Factor

Factor Factor

Topic Name Factors and/or Categories of Factors

Factor Factor

Factor Factor

Factor Factor

Category 3 Category 4

Figure 5 - Fishbone Diagram

Unleashing the Power of CAPA with a Closed-Loop System
The objective of a Closed-Loop system is Non-conformances and Corrective and Preventive Actions
to utilize CAPA opportunities by
systematically converting them into inputs
that connect to specific tasks that are Identify Create
assigned to process owners to be carried non-confromance scorecard of
out until closure, verified and then during ad-hoc and Non-conformance
redirected back into the CAPA system for checklist audits and CAPA statistics
final disposition and/or continuous
monitoring. The CAPA process will provide
feedback to managers for necessary
Record
process improvements. This in turn Record Non-confromance
Non-confromance
enables them to continuously improve Non-confromance Resolved
Owner
how they proactively address and prevent
nonconformities.
Checking the effectiveness of a closed- Record Action
loop CAPA process has to be structured Root Cause Approved
and diligent. CAPA data must be easy to
access and analyze, while having a
continuous feedback loop. Automating Notify Person
forms-based processes like CAPA, Create Action Notify Action
Responsible
facilitates compliance and saves CAPA Completed Approver
for Action
companies’ time and resources; with
automation, the concerns of regulators,
auditors, and other stakeholders may be
easily addressed.

Manage CAPA

Create
CAPA

Approval
Assign Specify Complete
of Action
Responsibility Due Date Actions
Complete

Set Reminder
Notifications
Notifications
Establish are sent by the
Notifications system based
on user
applied rules

Set Escalation
Notifications

Figure 6: Example automated Closed-Loop CAPA

 Conclusion
Without a closed-loop system, the ability While implementing a closed-loop CAPA Manually meeting the requirements of a
for the CAPA process to effectively process can be an expense for companies, closed-loop system is a very daunting
communicate is compromised. As a result, the cost of inaction is higher (i.e. ad hoc task, which may tax resources in a manner
risk increases because there is no logical investigation of incidents, unclear that can lead to the deterioration and
flow that can be followed. While any assignment of accountability, assets over disuse of the CAPA process. An enterprise
regulated company can ill-afford to work or under protected, and fines or level, role-based, automated software tool
in such an environment, virtually every suspensions levied by regulatory will encourage stakeholder participation in
organization has to uphold customer, authorities). the CAPA process; the facts and figures
internal and industry standards associated with CAPA will become
One way to contain costs is to subject
operational intelligence; and the
In an optimal approach for a closed-loop both preventive and corrective actions to
organization’s operational intelligence
system, resources are managed as a the same closed-loop process.
quotient can greatly improve, thereby
series of interconnecting processes. The Furthermore, preventive actions, in
improving the likelihood of implementing
system identifies, understands, and particular, need to be thoroughly
and sustaining a top-notch, close-loop
manages processes that have investigated and justified, both at the time
CAPA process.
interrelationships. Inputs and outputs of of implementation and on a regular basis
the system are also monitored to ensure going forward, in order to avoid By leveraging intelligence to drive
the process is meeting its expected unintended consequences that could lead operational excellence, companies are
performance. This optimal approach takes to non-conformities. relying on automated closed-loop systems
a certain amount of automation to be to implement a systematic and consistent
effective. An example of a workflow CAPA process across the organization for
element of an automated closed-loop increased transparency, effectiveness, and
system is shown in Figure 4. We can see efficiency.
that key processes are integrated and
tracked to ensure that responsibility and
tasks are assigned, root cause analysis is
captured, and the final action plan is
documented, implemented, and verified.
Key owners are established, notified and
documented as are the start dates and
due dates. Automatic reminders and
escalation notifications ensure the
process and tasks are on track.

For more information, call 888-429-6178

or visit www.bsiamerica.com
BSI Group America Inc. BSI Group Canada Inc. The BSI certification mark may be used on your
12950 Worldgate Drive, Suite 800 6205B Airport Road, Suite 414 stationery, literature and vehicles when you have
Herndon, VA 20170 Mississauga, Ontario successfully achieved certification and conform
USA L4V 1E3 with applicable guidelines.
Tel: 1 888 429 6178 Canada
Fax: 1 703 437 9001 Tel: 1 800 862 6752 The mark shall never be applied directly on the
Email: [email protected] Fax: 1 416 620 9911 product or service.
www.bsiamerica.com [email protected]
www.bsigroup.ca
www.bsigroup.ca/fr Copyright © 2013 The British Standards Institution. All Rights Reserved.