White Paper

Simplify CAPA In 7 Steps

Compliance Regulation Business Technology risk management-GettyImages-1433535736

For companies whose products are subject to regulatory requirements, especially those under the jurisdiction of agencies like the U.S. Food and Drug Administration (FDA), a corrective action/preventive action (CAPA) process is needed to address and mitigate the impact of quality events such as deviations and nonconformances.

Many companies, however, are not equipped to implement an effective CAPA process. It may be that their employees lack the proper training and background to perform corrective actions. Or perhaps they don’t have access to tools and strategies that adequately support a formal CAPA process. A review of the FDA warning letters issued each year indicates that some companies only think about CAPA after the fact – when quality issues have already emerged, and they have no choice but to address them. Most organizations have some sort of CAPA system in place, but too many are woefully inadequate.

This brief provides an in-depth look at each critical phase of CAPA and provides a blueprint to help life sciences companies successfully manage them.

7 Steps to a Comprehensive CAPA

A comprehensive CAPA process comprises the following seven essential phases that must be meticulously planned for, conducted, and tracked.

  1. Identification.
  2. Evaluation.
  3. Investigation.
  4. Analysis.
  5. Creation of an Action Plan.
  6. Implementation of the Action Plan.
  7. Follow-up.

Careful execution of each step enables organizations to establish a comprehensive CAPA program that satisfies both quality assurance (QA) and regulatory documentation requirements. Each action’s function in satisfying regulatory requirements and contributing to overall continuous improvement efforts is detailed below.

1. Identification

To implement an effective CAPA, the first step is to clearly define the actual problem, nonconformity, or incident. It is important to accurately and completely describe the situation as it currently exists. This should include the source of the information for the quality event, a detailed explanation of the problem, and any available evidence of the problem’s existence.

Sources of Quality Events

It’s vital to note the specific origin of the information that initiates an action. Documenting the source of the information can be very useful when conducting an investigation into the problem and creating and implementing an action plan. It also gives you a baseline for evaluating the effectiveness of the QMS and provides a focal point when communicating the completion of an action to the appropriate individuals or departments.

Quality event information may come from many possible sources, both external and internal. Examples of sources that lead to preventive actions may include:

  • Service requests.
  • Internal quality audits.
  • Customer complaints/concerns.
  • QA inspections.
  • Staff observations.
  • Trending data.
  • Risk assessments.
  • Process performance monitoring.
  • Management reviews.
  • Failure mode analyses.

Other sources are certainly possible and are dependent on specific circumstances.

2. Evaluation

Evaluating the extent of the problem and its potential impact on the company requires a complete written description of the issue. The description should be concise but must contain sufficient information to ensure the problem can be easily understood when read. There are five key activities involved in the evaluation phase, each of which is detailed below.

1. Document Evidence:

List the specific information available that demonstrates the problem exists. For example, the evidence for a product defect may be a high percentage of service requests or product returns, while the evidence for a potential equipment problem may be steadily increasing downtime. A CAPA request form is commonly used to initiate a CAPA action and collect preliminary information. At a minimum, these forms should include fields to record the following information:

  • Date of the CAPA request.
  • Source of the request.
  • Description of the problem.
  • Evidence observed.
  • Initiator of the preliminary assessment of potential impact and/or risk action.

2. Determine Action:

The situation that has been described and documented in the “Identification” step must be evaluated to determine the need for action and the level of action that is warranted. The potential impact of the problem and the actual risks to the company and/or customers must be assessed. Essentially, the reasons that the problem is a concern must be documented.

3. Forecast Potential Impact:

An important part of any evaluation is a specific explanation of precisely why the documented problem is a concern. This may include possible repercussions the problem may have in terms of costs, function, product quality, safety, reliability, and customer satisfaction.

4. Assess Risk:

Using the result of the impact evaluation, the seriousness of the problem can be assessed. The level of risk associated with the problem may affect subsequent actions that are taken. For example, a problem that presents a serious risk to the function or safety of a product may be assigned a high priority and require immediate remedial action. On the other hand, an observation that a particular machine is experiencing a rising level of downtime each month may have a lower priority.

5. Take Remedial Action:

Based on the outcome of the impact and risk evaluations above, stakeholders may determine that immediate remedial action is needed to remedy the situation until a thorough investigation is conducted and a permanent solution is implemented. If remedial actions are necessary, the actions and the resources required should be documented. Any expedient actions taken to avoid further adverse effects must be explained, and the actions taken then recorded. This documentation will become part of the “Action Implementation” and “Follow-Up” steps of the CAPA. In some instances, you may decide that the remedial action is all that is needed. In such cases, you should always document:

  • The rationale for that decision.
  • Evidence that appropriate follow-up was done (see the “Follow-Up” section below).
  • A record that the CAPA was closed out.

Specialized forms are commonly used to explain the remedial steps that must be taken to avoid any further adverse effects. These “Remedial Action Required” forms typically include fields to record the following information:

  • Identifying number for the CAPA action.
  • Date the form was issued.
  • Indication of corrective or preventive action.
  • Description of the problem.
  • Evidence observed.
  • Potential impact of the problem.
  • Remedial action(s) required.
  • Date remedial action was completed.
  • Name of person(s) who completed the remedial action.

3. Investigation

Kick off the investigation process by writing a procedure for conducting an investigation into the problem. A written plan provides assurance of an investigation’s completeness.

Coming to a consensus on the best approach to investigations is often a sticking point, especially within organizations whose approach to CAPA is less formal. For investigations to be effective, four investigation fundamentals must first be established:

1. Gain Organizational Commitment:

For a CAPA process to be embedded long-term, it must align with business initiatives and empower employees to solve a variety of problems.

2. Integrate Root Cause Analysis Into Quality Systems:

The investigation process should establish a well-grounded method for accomplishing work within the organization. A formal reporting system must be in place for accountability and documentation purposes. All departments and business functions involved must be aligned if the desired result is to be achieved. When alignment is lacking, personnel tend to revert to familiar, ineffective methods.

3. Train Key Personnel in Root Cause Analysis:

Training on any new process steps should be provided at the appropriate level. It’s unlikely that new skills can be implemented into old systems, nor can the new systems and processes be properly supported using the old approaches. Teach the right skills to those who need and will use them. Ensure that they understand the new skills and can apply them, and confirm that proficiencies are task-appropriate (e.g., internal investigators need greater proficiency in cause analysis than the operators who answer investigators’ questions).

4. Provide Reinforcement and Appropriate Tools:

The likelihood that personnel will use any new skills that they’ve been trained upon is low without ongoing coaching, support, accountability for effective investigations, and reliable corrective actions. One powerful reinforcement approach is to appoint an appropriately trained individual to be a cause analysis process advisor. Most importantly, equip key employees who have been trained in root cause analysis with tools that enable them to conduct investigations and implement corrective actions. To institute a truly closed-loop problem-solving approach, the system must be flexible and tie all quality processes together, from the initial nonconformance to the corrective action.

Next Step: The Investigation Plan

Once the investigation model is formalized, the investigation plan should be written. It must include:

  • An objective for the actions that will be taken.
  • The procedure to be followed.
  • The personnel that will be responsible.
  • Any other anticipated resources that may be needed.
  • Objective

Every action must have a goal. The first step in conducting the investigation is to state an objective for the action. Whereas in the “Identification” phase, the problem was defined and the current situation was documented, the objective is a statement of the desired outcome of the CAPA. State what the situation is expected to be when the action is complete. The statement should generally explain that the problem will be corrected, all effects of the problem identified and rectified, and controls will be put in place to prevent the situation from occurring again.

  • Procedure

Specific instructions should be devised to outline what must be done to determine the contributing and root causes of the problem. The investigation procedure will vary depending on the circumstances, but it must incorporate a comprehensive review and analysis of all the circumstances related to the problem. Consider equipment, materials, personnel, procedures, design, training, software, and any external factors.

  • Responsible Personnel and Resources

A critical element of the investigation procedure is assigning responsibility for conducting each aspect of the investigation. Any additional resources that may be required should also be identified and documented. For example, specific testing equipment or external analysis may be necessary.

The forms used to collect investigation procedure information are the basis of the written action plan for the investigation into the problem. These forms should include the overall objective and instructions for conducting the investigation, as well as the person(s) responsible for the investigation and an expected completion date. They should include specific fields to capture the following:

  • Identifying number for the CAPA action.
  • Date the investigation was initiated.
  • Objective of the action.
  • Basic instructions.
  • Name of the assigned investigator(s).
  • Expected completion date.
  • Approver.
  • Date of the investigation procedure approval.

4. Analysis

This step in the CAPA process involves collecting relevant data, investigating all possible causes, and using all available information to determine the cause of the problem. The primary goal in the analysis phase is to determine the root cause of the problem described. It is critical to distinguish between the observed symptoms of a problem and the fundamental root cause of the problem. Contributing causes are typically identified but are secondary to the root cause determination. While there are many formal methods that can be used to perform root cause analyses, the general process consists of three basic steps:

1. List Possible Causes:

By considering all possible causes, appropriate information and data can be collected and ultimately used to determine the root cause of the problem.

2. Organize Results and Data:

This step may involve combining the results of various tests and a review of records, processes, service information, design controls, operations, or any other data that may lead to a determination of the fundamental cause of the problem. The resulting documentation should be complete and address all the possible causes that were previously determined. This information is used to zero in on the root cause of the problem.

3. Conduct Root Cause Analysis:

Determining the root cause often requires answering a series of “Why?” questions and digging deep until the fundamental reason for the problem is found. For example, if an investigation reveals that the operator had not been properly trained and had forgotten an essential step in a machining process, the improperly trained operator is the immediate cause of the problem. However, the operator may not be the root cause. Continue asking questions like, “Why was the operator not trained properly?” “Are the existing training programs adequate?” “Are trainings being implemented properly?” Further investigation may reveal that the operator was on vacation when the training was given and, therefore, did not receive the proper training when other operators did. The root cause of the problem is a lack of follow-up in the training program since no mechanism existed to cross-check training records to ensure that a missed training session was rescheduled.

When the root cause of a problem is revealed, it must be documented. This is essential for determining the appropriate corrective and/or preventive actions that should be taken. Problem analysis forms are commonly used to record information during this phase. Such forms are used as a collection point for the information discovered during the analysis to which supporting documentation and data may be attached. These forms typically include the following information fields:

  • Identifying number for the CAPA action.
  • Date the analysis commenced.
  • List of possible causes and supporting data.
  • Root cause determination.
  • Supporting documentation for the root cause determination.
  • Analysis completion date.
  • Name of the individual who conducted the analysis.

5. Creation of an Action Plan

Using the results from the analysis, the optimal method for correcting the situation (or preventing a future occurrence) should be determined and an action plan then developed. The plan should include the following tasks and identify the individuals responsible for completing each:

1. Actions To Be Completed:

List all the activities and tasks that must be accomplished to either correct the existing problem or eliminate a potential problem. For a CAPA program to be effective, it is important to take a global approach, so make sure to identify all actions that will be required to address everything related to the situation. For example, in the training situation described above, the root cause was a flaw in the training program. One of the actions that should be taken is to review all previous training records to determine if this problem resulted in other employees not receiving the necessary training.

2. Document or Specification Changes:

List any documents to which modifications will be required and describe the modifications in general terms.

3. Process, Procedure, or System Changes:

Describe any changes to processes, procedures, or systems that will need to be made. Enough detail should be included so that it is clearly understood what must be done. The expected outcome of these changes should also be explained.

4. Employee Training:

Employee training is an essential part of any change that is made and, as such, should be a vital part of the action plan. To ensure that the actions taken will be effective, any modifications made to documents, processes, etc., must be effectively communicated to all persons or departments that will be affected.

5. Monitors/Controls:

If necessary, the action plan should include any controls or monitors that are put in place to prevent the problem’s occurrence or recurrence.

6. Implementation of the Action Plan

Once the action plan is devised, you’re ready for CAPA implementation. It’s time to initiate, complete, and document all the required tasks that have been listed and described in the action plan. To ensure the CAPA implementation is comprehensive, maintain the following:

  • Implementation Summary:

This document should include a list and summary of all the activities that were completed as outlined in the action plan step.

  • Supplementary Documentation:

List all documents or other specifications that have been modified. This documentation is typically attached to a final report on the CAPA action, which facilitates the verification of the changes in the next “Follow-up” step.

7. Follow-Up

One of the most fundamental steps in the CAPA process is an evaluation of the actions that were taken. Several key questions must be answered, including:

  • Have all the objectives of this CAPA been met (i.e., did the actions correct or prevent the problem, and are there assurances that the same situation will not happen again?)
  • Have all the recommended changes been completed and verified?
  • Have appropriate communications and training been implemented to ensure that all relevant employees understand the situation and the changes that have been made?
  • Is there any chance that the actions taken may have had any additional adverse effects on the product or service?

These and any other germane follow-up questions should be aimed at verifying two critical CAPA elements:

1. Results of the Actions:

The implementation and completion of all changes, controls, training, etc., must be verified, and the evidence that this has been done must be recorded. Appropriate information should be compiled as documentation that all actions have been completed successfully.

2. Effectiveness of the Actions:

Another key aspect of any CAPA is verifying that the actions taken were effective. A thorough evaluation should be conducted to ensure that:

  • The root cause of the problem has been solved.
  • Any resulting secondary situations have been corrected.
  • Proper controls have been established.
  • Adequate monitoring of the situation is in place.

The evaluation should also include an investigation to determine if the actions taken could result in any other adverse effects. This investigation and the results should be documented.

When the follow-up step is complete, there should be a formal indication (e.g., a checkbox and date on a form) that it has been completed. A review and approval signature by authorized personnel should be recorded.

Documenting the complete CAPA process – from identifying the problem to successfully completing the CAPA – is important for all companies, but absolutely critical for those subject to regulatory requirements. Meeting modern risk-based CAPA requirements demands a well-documented system that helps you determine the root cause of nonconformances, system failures, or process problems, and then corrects the problems and prevents them from recurring. The documentation maintained in the system must identify why something went (or may go) wrong and what has been done to make sure it does not happen again. Following the seven steps outlined above should result in a complete, well-documented investigation and, ultimately, a solution that facilitates compliance with FDA and ISO regulatory requirements.

The MasterControl Approach to Intelligent CAPA Management

MasterControl offers the world’s most trusted, connected, dynamic, and intelligent CAPA management software tool. Based on three decades of field-tested best practices, the easy-to-use MasterControl CAPA software solution automates all CAPA-related processes and integrates them with your critical quality processes. MasterControl provides:

  • Built-in advanced analytics and reporting.
  • Automated task distribution.
  • Process-to-process launching.
  • Innovative quality event and trend analysis tools.
  • A truly closed-loop CAPA process with real-time visibility.
  • Best practice configurable forms.
  • Automatic revision control.
  • Electronic signature manifestations and audit trails.
  • Seamless training integration.
  • A secure, cloud-based system accessible via mobile device.
  • Dynamic orchestration of quality events using no-code form- and workflow-builder tools.