ISO 13485 from zero, episode eight: building a CAPA system that closes.
ISO Cloud Consulting editorial teamA CAPA system turns problems from production, complaints, audits and suppliers into lasting fixes. Control nonconforming product and concessions, triage by risk, find a root cause in the system rather than blaming human error, check actions do not create new risk, and close only after verifying effectiveness.
What is CAPA for in an ISO 13485 system?
This is episode eight of ISO 13485 from zero. Every part of the system we have built so far produces information about problems: nonconformances in production, complaints from the market, audit findings, supplier failures. This episode builds the process that turns that information into lasting fixes: corrective and preventive action, or CAPA.
Template for this step: the CAPA SOP, CAPA register and root cause toolkit are in the ISO 13485 CAPA & Nonconformance Kit ($79).
How must nonconforming product be handled?
Nonconforming product feeds CAPA most often. It must be identified, documented, segregated, evaluated and dispositioned. Disposition options include rework, use under concession, scrap, or return to the supplier.
ISO 13485 adds conditions that ISO 9001 does not. A concession is only allowed where regulatory requirements are still met, and the identity of the person who authorized it must be recorded. If nonconforming product is found after delivery, take action appropriate to its effects, which may include an advisory notice.
What are the inputs to CAPA?
Nonconformances, complaints, audit findings, supplier problems, trends in process data, service reports, post-market surveillance and management review. Each input should lead to a recorded decision: CAPA needed or not, and why.
How do you decide which problems need a full CAPA?
Not every problem needs one. Write criteria based on risk. A one-off nonconformance with no effect on safety may only need correction. A safety-related issue, a repeat problem or a systemic audit finding needs a CAPA.
How should the investigation find the root cause?
Define the problem precisely, with data. Then find the root cause using a structured method, such as asking why repeatedly or a cause and effect diagram. The root cause must be something in the system you can change. Human error is a symptom, not a root cause.
Also check whether the same cause could affect other products or processes, because that is where corrective action becomes preventive.
How do you avoid creating new risk with an action?
ISO 13485 expects you to verify that corrective actions do not adversely affect the ability to meet regulatory requirements or the safety and performance of the device. A change to a process, a supplier or a design made under CAPA should go through the same change control as any other change, including a check of the risk file.
When can a CAPA be closed?
Define in advance how you will know the action worked, what data you will look at, and when. Record the result. Only then close the CAPA. Track CAPA age and overdue actions, and report them at management review, because they tell top management how healthy the system really is.
By the end of this episode's work you should have a nonconforming product procedure with concession rules, a CAPA procedure with triage criteria, a register, and at least one CAPA worked through properly as an example. Next episode: internal audit.
Where can you get CAPA templates?
The ISO 13485 CAPA and Nonconformance Kit covers nonconforming product, concessions, the CAPA procedure and the register. The Free CAPA Initiation Checklist is a good place to start. See also the CAPA hub and the CAPA collection.
