Building an Effective CAPA Plan: Your 8-Step Guide

Without a formalized CAPA plan, you won’t know where to begin when a systemic issue or defect is found. Get ahead of the issue by building an effective CAPA plan now.

Posted by Katie Yahnke in Manufacturing, Pharmaceutical on September 19th, 2018

A CAPA plan is a corrective and preventive action plan. It’s a quality management strategy used often in the manufacturing and production industries to identify and rectify systematic defects and ensure they aren’t repeated.

If your organization is involved in manufacturing, product design, testing, distribution or related activities, you probably need a CAPA plan.

You’ll also need a form to document and record your CAPA plan. Get started with this customizable CAPA Form Template.

This guide will teach you how to build an effective CAPA process that’s easy to implement and easy to follow, so you can spend less time dealing with defects and less money on penalties.


Who Needs CAPA?

Imagine you suddenly get a flurry of customer complaints regarding a defective product. You do everything right at the beginning, making sure to follow Best Practices for Handling Complaints.

And when it’s time to address the real issue, where do you begin? If you don’t have a formalized CAPA plan, how will you identify the root cause or fix the issue? If you do have a formalized CAPA plan, all of your next steps will be laid out so you can make your way back to compliance as quickly and smoothly as possible.

Legally, companies that specialize in medical device manufacturing and pharmaceuticals must have “adequate” CAPA procedures. The FDA reviews CAPA systems during inspections, premarket approval applications and recalls. In 2016 alone, the FDA issued more than 300 citations to medical device manufacturers for inadequate CAPA procedures.

Logically, experts and guidelines in most countries recommend implementing a CAPA system simply for the maintenance and upkeep of your own company. For example, Current Good Manufacturing Practices, the Hazard Analysis and Critical Control Points approach and many ISO standards recommend implementing a CAPA process.


Criteria for a Good CAPA Plan

For a company’s CAPA procedure to be considered adequate, the FDA is looking for a robust, effective and useful process that will systematically address defects.

The entire plan should be precise with assigned owners and timelines. It should be clear and written for the reader. Who is the audience? How much do they know?

Specifically, the procedure should include clear guidelines for:

  1. Identifying an issue
  2. Evaluating the criticality of an issue
  3. Investigating the root cause of an issue
  4. Developing resolution plans
  1. Implementing resolution plans
  2. Measuring efficacy of resolution plans
  3. Updating and recording procedural changes
  4. Communicating CAPA-related information

Simply stating that personnel should “evaluate the severity and impact of the issue” is not robust or effective, and it will not be useful to a person handling an issue.

So, let’s get into the specifics of each step.


1. Identify the Issue

Identify the issue, hit the target

In this first phase, you’ve just received a complaint and you’re trying to collect more information about the issue.

An issue is identified when someone notices a nonconformance or defect in a product or in the process of making the product. Complaints are made through internal or external systems such as a customer complaint line, the management review process, a staff suggestion box or an audit.

So this first phase is trying to provide some context around the issue. If your review and complaint processes are comprehensive and consistent, a significant amount of this information should already be documented and available.

 

Questions to Ask
  • Explain what is involved. Is it a product, equipment or a process that is having the issue?
  • Explain what happened and what should have happened.
  • Explain where the event was observed. In what room or business unit did the issue occur?
  • Explain when the event occurred. At what time or on what day was the issue discovered?

2. Evaluate the Severity of the Issue

In phase two, your main objective is to decide if the issue requires a CAPA plan to resolve, or if a milder strategy is appropriate.

This step is key because over- and under-escalating issues to CAPA are equally ineffective. Treating every issue as CAPA-worthy will make you overwhelmed and under-resourced, whereas escalating zero issues runs the risk of warning letters, fines and extensive harm to staff or customers.

This decision is best made by evaluating the severity, harm and complexity of the issue. This evaluation will determine if a simple change could keep the issue under control or if the following CAPA steps are necessary.

(The best way to evaluate harm and likelihood is by conducting a risk assessment. If you haven’t done that yet, get started by downloading your risk assessment template here.)

 

Are CAPA Steps Necessary?

CAPA is typically reserved for systemic issues in which the same complaint is reported continuously. And while there’s no right threshold for when an issue becomes CAPA-worthy, the amount of time between complaints or the circumstances around them must be considered.

A single complaint rarely requires a CAPA response, unless real danger is present. For example, if a customer is seriously injured, it’s important to take the complaint seriously for the safety of the public.

Quantity and severity are the two key factors to determine CAPA’s necessity. A severe issue that’s only reported one time, and a minor issue that’s reported often may be held to similar standards.

 

Questions to Ask

So, what questions should you ask to ensure a best possible complaint evaluation?

  • Has customer or employee safety been affected?
  • Has this event occurred before? If yes, how many times?
  • Does this impact product design or performance?
  • Does this impact regulatory documents?

Your answers to these questions will make it easier to categorize the event as low, medium or high risk. If you determine that an event is low risk and a CAPA system is not needed, continue to monitor the issue using another system. If you determine the event is medium or high risk, follow the next step of CAPA.


3. Investigate the Root Cause

In this third phase, the objective is to investigate the issue and determine its root cause.

The root cause is the source of the identified problems or risks, and it’s a crucial bit of information in the battle to prevent their occurrence or reoccurrence.

Don’t point fingers without a proper investigation, even if the cause and effect appears to be obvious. Regulators are wary of unverified and unproven root causes, and it’s frustrating to waste your time resolving a false cause.

(Also – check out our step-by-step guide for more information on conducting investigations.)

Identifying root causes can be intimidating because a) there could be many potential causes and b) it’s tough to be certain that any one cause is more responsible than another. Thankfully, experts have developed a few systematic methods for root cause analysis.

 

The 5 Whys

The first technique is the 5 Whys. The logic behind this method is simple: identify root causes by exhausting the question “why?”. Brainstorm answers to questions like why did the event occur? Why were the conditions as such? Drill down further to sub-causes, ask why they occurred too.

The logic is that you’ll make your way through all of the potential causes and end up identifying the one that doesn’t have a proper answer to why?

5 Whys

 

The Fishbone Diagram

Another technique is the Fishbone Diagram.

Start by drawing a fish. Where the head would be, write out the problem or defect. Then, the bones will be labeled using the major categories of potential causes.

Fishbone Diagram (1)

For manufacturing industries, bones may be labeled as one of the 6 M’s: machines, methods, materials, measurements, Mother Nature (environment) and Manpower (people). For service industries, bones may be labeled as one of the 4 P’s: policies, procedures, people and plant/technology.

Under each bone, brainstorm all the possible causes of the problem relating to that category. Continue on and drill down, getting more and more specific until you uncover the root cause.

 

The Fault Tree Analysis

A third technique, the Fault Tree Analysis, is one of the most widely used methods. It looks like this:

 

Fault Tree Analysis

 

It’s a deductive diagram used to determine sequences of failures and errors that may cause an incident. The top of the “tree” has the issue, defect or nonconformance. Underneath that, use your own judgement to list some of the potential causes. Below each potential cause, break it down further to create a logic diagram.


4. Determine Resolution Options

Determine resolution options

In the fourth phase, the goal is to use the information gathered from steps one, two and three to develop a plan to resolve the issue and root cause.

There are three categories of actions to fix an incident: a correction, a corrective action or a preventive action.

  • A correction is a “Band-Aid fix”. Its main purpose is to quickly resolve a problem that arises.
  • Corrective actions are fixes to the root cause to prevent the reoccurrence of a problem.
  • Preventive action is a form of risk management—it seeks to prevent the occurrence of a problem.

5. Implement Corrective Actions

Corrective actions; written or verbal warnings

Phases five and six are all about implementing your resolution plan, whether that consists of corrective actions, preventive actions or both.

If you’re looking to implement corrective actions, you will have first already identified systemic issues plaguing your company, service or product. Corrective actions can be knee jerk at times but a quick and reactionary measure is an important step in correcting and containing an issue.

In HR, corrective actions are measures related to disciplinary behavior. Written warnings, verbal warnings, leave with or without pay, demotion or similar. In the manufacturing realm, corrective actions include alarms, redesigns, instrument calibration or modifying handling processes.

Corrective actions need to be immediate. Keep this Employee Disciplinary Action Form on hand in case warnings or other disciplinary actions are required.

Whichever corrective actions you take, it’s important that they are carried out promptly and entirely. Remember they may not be a permanent solution to the issue.


6. Implement Preventive Actions

Preventive actions - processes, checklists

Preventive actions, as we know, are prediction-based, proactive measures that seek to prevent or monitor potential risks before they escalate into major, potentially harmful issues.

Common preventive actions include:

  • Reviewing or auditing suppliers
  • Identifying issues prevalent in competitors
  • Monitoring and analyzing negative trends
  • Implementing alarms
  • Conducting risk analysis
  • Conducting regular performance reviews
  • Establishing training programs
  • Developing disaster recovery plans
  • Implementing calibration control programs

7. Monitor Efficacy of Actions

Goal achieved - monitor efficacy of actions

The next step of your procedure is monitoring and documenting the effectiveness of the corrective or preventive actions you’ve implemented.

This effectiveness check is the most important step as it ensures the action is not only appropriate, but that it will actually resolve the issue and stop it from occurring (or recurring). There are many ways to report on effectiveness, depending on the measures you chose to implement.

For example: analyzing trends of human error, testing errors and deviations both before and after you implemented the corrective action can help to determine if it’s working.

Surprise audits are another great option for efficiency checks. The audit will ensure that all machinery, people and processes are acting according to the prescribed corrective action.


8. Modifying the Procedures

Changing direction - modifying the procedures

Also track the effectiveness of the plan itself. After its first use, ask: was it easy to understand and follow? Effective technical writing is critical to your CAPA process, it will ensure your plan and reports are clear, impartial, easy-to-understand and complete.

Or, even better, hold training sessions on the draft version of your CAPA procedure. Based on the feedback, revise the procedure and clarify specific steps that were found to be difficult, confusing or vague.

This involvement will not only make sure those involved feel a sense of ownership, they will now have the tools to carryout the procedure right the first time.


Katie Yahnke
Katie Yahnke

Marketing Writer

Katie is the marketing writer at i-Sight. She writes on topics that range from fraud, corporate security and workplace investigations to corporate culture, ethics and compliance.

Want to conduct better investigations?

Sign up for i-Sight’s newsletter and get new articles, templates, CE eligible webinars and more delivered to your inbox every week.