ISO 13485 from zero, episode eight: building a CAPA system that closes the loop.

What turns problems into lasting fixes?

This is episode eight of ISO 13485 from zero. Every part of the system we have built so far produces information about problems: nonconformances in production, complaints from the market, audit findings, supplier failures. This episode builds the process that turns that information into lasting fixes: corrective and preventive action, or CAPA.

How do you handle nonconforming product?

Product that does not meet requirements must be identified, documented, segregated, evaluated and dispositioned. Disposition options include rework, use under concession, scrap, or return to the supplier. ISO 13485 adds conditions that ISO 9001 does not. A concession is only allowed where regulatory requirements are still met, and the identity of the person who authorised it must be recorded. If nonconforming product is found after delivery, take action appropriate to its effects, which may include an advisory notice.

Template for this step: the CAPA SOP, CAPA register and root cause toolkit are in the ISO 13485 CAPA & Nonconformance Kit ($79).

What are the inputs to CAPA?

Nonconformances, complaints, audit findings, supplier problems, trends in process data, service reports, post-market surveillance and management review. Each input should lead to a recorded decision: CAPA needed or not, and why.

How do you triage?

Not every problem needs a full CAPA. Write criteria based on risk. A one-off nonconformance with no effect on safety may only need correction. A safety-related issue, a repeat problem or a systemic audit finding needs a CAPA.

How do you find the root cause?

Define the problem precisely, with data. Then use a structured method, such as asking why repeatedly or a cause and effect diagram. The root cause must be something in the system you can change. Human error is a symptom, not a root cause. Also check whether the same cause could affect other products or processes, because that is where corrective action becomes preventive.

How do you act without creating new risk?

ISO 13485 expects you to verify that corrective actions do not adversely affect the ability to meet regulatory requirements or the safety and performance of the device. A change to a process, a supplier or a design made under CAPA should go through the same change control as any other change, including a check of the risk file.

When can a CAPA be closed?

Define in advance how you will know the action worked, what data you will look at, and when. Record the result. Only then close the CAPA. Track CAPA age and overdue actions, and report them at management review, because they tell top management how healthy the system really is.

The ISO 13485 CAPA and Nonconformance Kit covers nonconforming product, concessions, the CAPA procedure and the register. Previously: complaints, vigilance and post-market surveillance. Next episode: internal audit.