Effective CAPA: From the Root Cause to Verifying Effectiveness

Introduction

In the pharmaceutical and life sciences sectors, an effective CAPA links five elements: nonconformity, risk, cause, actions, and evidence of effectiveness. If any one of these elements is weak, the process risks becoming nothing more than a collection of administrative tasks: updating an SOP, retraining staff, sending a reminder to the supplier, and closing the case.

The goal, however, is to understand why the event occurred and to take action on the system that was supposed to prevent or detect it. This approach makes CAPA a concrete part of the quality system, not merely a matter of fulfilling documentation requirements.

CAPA within the Swiss Regulatory Framework

For organizations subject to Swiss pharmaceutical legislation, the obligations depend on the activities carried out and the scope of the authorization. TheOrdinance on the Authorization of Medicines stipulates that manufacturing must comply with the GMP rules set forth in the relevant annexes. For wholesale distribution, Swissmedic refers to the applicable GDP requirements through Article 15 and Annex 4 of the ordinance.

During GMP and GDP inspections, Swissmedic may examine, among other aspects, deviation management, documentation, training, monitoring of storage conditions, supplier qualification, complaints, outsourced activities, and self-inspections. Re-inspections may also verify the corrective actions required during a previous visit.

The PIC/S GMP Guide PE 009-17 requires an appropriate level of root cause analysis, corrective or preventive actions consistent with the findings of the investigation, and monitoring of their effectiveness. It also specifies that attributing the event to human error must be justified, after first verifying that no process, procedural, or system issues have been overlooked.

Tools such as the 5 Whys, the Ishikawa diagram, and the SMART framework are best practices, not specific legal requirements. Also, ISO 9001:2015 is a voluntary standard, unless it becomes applicable due to a company’s choice, certification, contract, or other provision. As of July 21, 2026, the 2015 edition is still current; ISO plans to release a new edition in the coming months.

Correction, corrective action, preventive action, and improvement

Concept	Purpose	Example
Correction	Resolve or address the nonconformity that has already been identified	Quarantine products affected by temperature fluctuations
Corrective Action	Eliminate the cause of the nonconformity to prevent it from recurring	Modify the alarm system that failed to promptly notify of the excursion
Preventive Action	Eliminate the cause of a potential nonconformity	Apply the same improvement to other refrigerators with a similar configuration
Improvement	Improve performance, reliability, or ease of use, even without a nonconformity	Digitizing the SOP Approval Workflow

Replacing an outdated copy of an SOP is a correction. Revising the process for distributing, collecting, and checking copies, on the other hand, is a corrective action.

Under ISO 9001:2015, prevention is integrated into risk-based thinking and is no longer a separate clause. In the pharmaceutical sector, however, the term CAPA typically continues to encompass both corrective and preventive actions.

How to Properly Describe a Nonconformity

An effective description must include verifiable facts, not hypotheses about the cause. According to the ISO/IAF guidance, a well-documented nonconformity includes the unmet requirement, objective evidence, and a clear statement of the deviation.

A practical structure is:

On [date and time], during the process or at the location [where], [measurable fact] was observed regarding [products, lots, documents, or records involved], in violation of [requirement, SOP, specification, or authorized condition], as demonstrated by [evidence].

Example – Temperature Deviation

On July 14, 2026, the L-03 data logger in refrigerator F-02 recorded a maximum temperature of 11.8 °C for 47 minutes, compared to the expected range of 2–8 °C. Batches A and B were present in the refrigerator. The products were placed in quarantine pending a documented impact assessment.

The description should not jump to the conclusion that “the operator left the door open” until the hypothesis has been verified.

Assess Criticality, Impact, and Urgency

The initial assessment is used to determine containment measures, the scope of the investigation, responsibilities, and the timeline for handling the situation. It may consider:

• potential consequences for patients, users, and product quality;
• impact on identity, effectiveness, security, traceability, or data integrity;
• the number of products, processes, locations, or records involved;
• the likelihood that the problem has already occurred elsewhere;
• the ability to detect the error before use or dispensing;
• frequency and presence of preceding signals.

Urgency does not always equate to criticality. An easily traceable data entry error may require immediate correction, even if its impact is limited. Conversely, an outdated SOP may not yet have caused any harm, but it could indicate a systemic weakness affecting multiple departments.

There is no one-size-fits-all framework that applies to all organizations. Criteria, categories, and thresholds must be defined internally, applied consistently, and commensurate with the risk.

How to Conduct a Root Cause Analysis

Root cause analysis does not begin by selecting a tool, but by reconstructing the event. It is necessary to gather a timeline, recordings, technical data, documented accounts, training information, interviews, previous deviations, and operating conditions.

It is helpful to distinguish between:

• immediate cause: what directly brought about the event;
• root cause: a weakness that allowed the immediate cause to manifest itself;
• Contributing factors: conditions that increased the likelihood or impact.

When to Use the 5 Whys

The 5 Whys method is suitable for relatively straightforward and well-defined problems.

Example – Obsolete SOP

1. Why was an outdated SOP used?
   Because a hard copy was still there in the department.
2. Why hadn’t it been withdrawn?
   Because the department was not included in the list of distribution points.
3. Why was the list incomplete?
   Because the copies were printed locally without being registered.
4. Why was it possible to print unchecked copies?
   Because the document management system did not apply watermarks or restrictions.
5. Why hadn’t the risk been identified?
   Because the document review process verified approval but not actual use at the operational sites.

The cause is not simply “failure to return the copy,” but the lack of effective oversight of the copies in use.

When to Use the Ishikawa Diagram

The Ishikawa diagram is useful when an event can stem from multiple categories of causes: people, methods, equipment, materials, measurements, and the environment.

For a temperature deviation, the following could be analyzed simultaneously:

• duration and frequency of door opening;
• probe positioning and calibration;
• refrigerator contents;
• alarm configuration;
• absence of the primary person in charge;
• organization of picking activities;
• ambient temperature.

When to analyze contributing factors

In complex events, there isn’t always a single cause. The ISO/IAF guidance on reviewing and closing nonconformities recommends not stopping at the first factor identified and distinguishing between possible hypotheses and those that have been confirmed.

This approach is particularly useful for:

• recurring complaints with different causes;
• dispensing or recording errors;
• training issues;
• defects originating from suppliers;
• Deviations influenced by workload, IT interfaces, and organizational factors.

“Operator inattention” or “insufficient training” are rarely sufficient conclusions. We must ask ourselves why the system allowed the error to occur, why it was not detected, and whether the task was designed in a clear and sustainable manner.

Define SMART actions, responsibilities, and deadlines

An action must be:

• specific: describes exactly what will change;
• measurable: defines expected results and evidence;
• feasible: has the necessary resources and expertise;
• relevant: it addresses the confirmed cause;
• Time-limited: It has a justified expiration date.

“Restructuring the workforce” is too vague. A better way to put it is:

By September 30, the operations manager will update the recording instructions, implement an automated check for required fields, and verify through practical observation that all relevant staff members know how to complete and correct the records in accordance with the new procedure.

Each activity must have a designated or functional manager with the necessary authority, a deadline, a documented output, and clearly defined dependencies. Any extensions must be evaluated in light of the residual risk and must not be used as automatic administrative renewals.

Practically verify effectiveness

Effectiveness does not necessarily mean that the action has been completed. A SOP may have been approved and training completed without any real change in operational behavior.

The verification plan should be defined prior to implementation and should specify:

• indicator to be checked;
• initial situation or baseline;
• expected result;
• time period and sample size;
• audit manager;
• evidence to be preserved;
• Decision to be taken in the event of a negative result.

The period should not be automatically set to 30, 60, or 90 days. It must be long enough to observe the process over a representative number of cycles.

Examples of assessments:

• Temperature deviations: analysis of subsequent shipments or opening cycles, alarm response times, and the absence of events attributable to the same cause.
• Out-of-date SOPs: Checking points of use, ensuring there are no obsolete copies, and verifying compliance during a subsequent self-inspection.
• Training: practical observation or competency test—not just signing the logbook.
• Suppliers: compliance of subsequent deliveries, adherence to change notices, and verification of agreed-upon actions.
• Recurring complaints: trends normalized relative to distribution volumes, broken down by product, lot, cause, and channel.
• Exemption or registration: targeted audit, process observation, and verification of the proper implementation of the barriers put in place.

The mere absence of new deviations may not be very meaningful when the event is rare. It is preferable to combine this with process indicators, such as proper use of the procedure, timeliness of alarms, or completeness of records.

Complete CAPA Example: Temperature Deviation

Non-compliance: The F-02 refrigerator exceeded 8 °C for 47 minutes. Two batches were present in the unit.

Correction and containment: products placed in quarantine; verification of the data logger; collection of stability data; temporary suspension of refrigerator use.

Impact Assessment: Quality Assurance evaluates duration, maximum temperature, product characteristics, available data, and the potential involvement of other units.

Root Cause Analysis: The alarm had been triggered but was sent only to the phone of the manager, who was absent. The prolonged opening of the door during the picking process caused the temperature to rise. The SOP called for a substitute, but the notification system did not include an automatic escalation.

Root cause: The alarm system configuration is not aligned with the shift schedule.

Contributing factor: picking activities concentrated in a single extended shift.

Actions:

1. configure automatic escalation to the substitute;
2. review the picking process to reduce setup time;
3. check the configuration of the other refrigerators;
4. update education and training;
5. document the change and any necessary technical checks.

Effectiveness verification: For eight weeks, response times to alarms, activations, and thermal events of the analog units are analyzed. The example uses an internal time period defined based on the process frequency, not a regulatory deadline.

Closure: The CAPA can be closed when the actions have been implemented, the evidence is complete, the effectiveness criteria have been met, and no unintended impacts have emerged.

When a CAPA Can Be Closed

A CAPA is ready for closure when:

1. The nonconformity and its scope have been defined;
2. The impact has been assessed and mitigation measures have been completed;
3. the causes have been confirmed or the uncertainties have been adequately justified;
4. The actions address the identified causes;
5. Implementation and documentation are complete;
6. Its effectiveness has been verified by objective evidence;
7. the residual risk and any indirect consequences are acceptable;
8. Deviations, change control, training, and related documents are aligned.

The closing date should not automatically coincide with the last date listed in the plan.

Errors That Make CAPA Ineffective

The most common errors include:

• skip directly to the solution without completing the investigation;
• attributing the issue to “human error” without analyzing the process and operating conditions;
• to use training as the sole solution to any problem;
• to confuse correction with corrective action;
• include unrelated events in a single CAPA;
• ignore previous deviations, complaints, or trend signals;
• to delegate CAPA entirely to the supplier without supervision;
• define actions that cannot be measured;
• simply verify that the documents have been approved;
• close it before the process has been observed for a representative period;
• accept extensions without reassessing risk and mitigation measures;
• modify original records without ensuring data traceability and integrity.

Operational Checklist for Effective CAPA

• Is the nonconformity described in terms of facts, requirements, and evidence?
• Have the products, data, and processes that may be involved been identified?
• Are the containment measures proportionate to the risk?
• Have the frequency and spread to other areas been examined?
• Is the claim supported by evidence?
• Do actions address the cause and not just the effect?
• Are the people in charge, deadlines, and deliverables clear?
• Was the method for evaluating effectiveness established in advance?
• Is the sample or observation period representative?
• Is the closure approved based on objective evidence?

Conclusion

Effective CAPA requires proportionality: more in-depth investigations for high-risk issues and streamlined processes for minor incidents, without compromising traceability. The value lies not in the complexity of the form, but in the ability to demonstrate that the cause has been understood, the system has been strengthened, and the result has been verified.

To learn more about the approach and experience behind the support we offer, please visit our About Us page.