CAPA under ISO 13485: what clauses 8.5.2 and 8.5.3 really ask for
A clause-by-clause reading of corrective and preventive action under ISO 13485:2016, the inputs that should feed it, and what a notified body auditor checks in a CAPA file.
Most medical device manufacturers already have a CAPA procedure. The trouble usually starts when the notified body auditor picks three CAPA records at random and reads them end to end. A root cause that says "operator error", an action plan that says "retrain", and a closure signed off two weeks later with no evidence that anything changed. This article walks through what ISO 13485:2016 actually requires in clauses 8.5.2 and 8.5.3, how corrective and preventive action differ in practice, which inputs should be feeding your CAPA process, how to scale the effort to the risk, and what an auditor looks for when they open a CAPA file.
What ISO 13485 clause 8.5.2 requires for corrective action
Clause 8.5.2 asks you to take action to eliminate the cause of nonconformities in order to prevent recurrence, and to do so without undue delay. The actions have to be proportionate to the effects of the nonconformities encountered. You need a documented procedure, and that procedure must cover a specific sequence:
- Reviewing nonconformities, including customer complaints.
- Determining the causes of nonconformities.
- Evaluating the need for action to ensure nonconformities do not recur.
- Planning and documenting the action needed and implementing it, including updating documentation where required.
- Verifying that the corrective action does not adversely affect the ability to meet applicable regulatory requirements or the safety and performance of the device.
- Reviewing the effectiveness of the corrective action taken.
Records of the results of any investigation and of the action taken have to be maintained, under the record control requirements of clause 4.2.5.
Two words in that list carry more weight than they first appear to. "Evaluating" in step three means the standard expects some nonconformities to be closed without a CAPA. A single scratched housing caught at final inspection, dispositioned through clause 8.3 control of nonconforming product, may need no more than a correction and a note on the trend log. What the standard does not allow is skipping the evaluation. The decision not to open a CAPA is itself a record, with a reason.
Step five is the one most procedures handle badly. If your corrective action changes a process parameter, a supplier, a label or the device design, you have to show that the change does not create a new problem. For a design-related action that usually pulls in design change control under clause 7.3.9 and an update to the risk management file. A CAPA that quietly changes a torque setting on an assembly line without assessing whether the new setting affects seal integrity has satisfied steps one to four and failed step five.
Clause 8.5.3: preventive action is about potential nonconformities
Clause 8.5.3 mirrors the corrective action clause with one difference in scope. Preventive action addresses potential nonconformities and their causes, before anything has gone wrong. The procedure has to cover determining potential nonconformities and their causes, evaluating the need for action, planning, documenting and implementing it, verifying that it does not adversely affect regulatory compliance or device safety and performance, and reviewing its effectiveness.
In practice, preventive action usually comes out of data analysis. A rising trend in out-of-tolerance readings on one moulding tool that is still inside specification is a preventive action candidate. So is a finding on one production line that has not yet occurred on the other two lines running the same process, or a supplier audit that shows their calibration programme is lapsing even though nothing they shipped has failed incoming inspection.
The distinction matters because auditors read the classification. If every CAPA in your log is corrective, it suggests the organisation only reacts to failures and that clause 8.4 analysis of data is not producing anything. If you label something preventive when it plainly followed a failure, it reads as an attempt to soften the record. The honest test is simple: has the nonconformity already happened in this product, process or system? If yes, it is corrective. If you are extending a fix to places where it has not happened yet, that extension is preventive, and it is reasonable to record both within one CAPA.
Corrective action, correction and containment are different things
ISO 13485 uses the definitions from ISO 9000, and the EU MDR defines corrective action in Article 2(67) as "action taken to eliminate the cause of a potential or actual non-conformity or other undesirable situation". The key word is cause.
Take a mislabelled batch of sterile drapes, where the outer carton shows the wrong expiry date. Quarantining the batch and relabelling it is a correction: it deals with the nonconforming product. Checking the two batches labelled on the same printer that week is containment. Finding that the label template pulls the expiry date from a field that the planning team can overwrite, and locking that field, is corrective action. Many CAPA records stop at correction and call it done, and those are the records an auditor will stop on.
The inputs that should feed your CAPA process
A CAPA system that only receives audit findings is starved. ISO 13485 links CAPA to several other clauses, and each one is a feed:
| Source | ISO 13485:2016 clause | Typical trigger |
|---|---|---|
| Complaints | 8.2.2 | Repeat complaint category, any complaint with a safety element |
| Feedback and post-market data | 8.2.1 | Signals from post-market surveillance |
| Nonconforming product | 8.3 | Repeat nonconformity, or a single one with significant risk |
| Internal audits | 8.2.4 | Major findings and repeat minor findings |
| Process and product monitoring | 8.2.5, 8.2.6 | Out-of-trend results, capability drops |
| Data analysis | 8.4 | Trends across suppliers, complaints, nonconformities |
| Supplier performance | 7.4 | Repeat rejections at goods-in |
| Management review | 5.6 | Outputs that require improvement action |
For manufacturers under the EU MDR, the regulation adds its own requirements on top. Regulation (EU) 2017/745 lists "management of corrective and preventive actions and verification of their effectiveness" in Article 10(9)(l) as one of the aspects the quality management system must address. Article 83(3)(e) says post-market surveillance data shall be used for the identification of needs for preventive, corrective or field safety corrective action, and Article 83(4) requires the manufacturer to implement the appropriate measures and inform the competent authorities and, where applicable, the notified body when that need is identified. Your post-market surveillance plan and your CAPA procedure should point at each other by name.
Medicinal product manufacturers will recognise the same structure in ICH Q10, section 3.2.2, which lists complaints, product rejections, non-conformances, recalls, deviations, audits, regulatory inspections and trends from process performance and product quality monitoring as CAPA inputs.
Proportionality: scaling CAPA to risk
Clauses 8.5.2 and 8.5.3 both require action proportionate to the effects of the nonconformity. Clause 4.1.2 asks you to apply a risk-based approach to the control of QMS processes, and CAPA is one of them. Proportionality is where small manufacturers tend to get it wrong in both directions: a full eight-discipline investigation for a typo in a work instruction, and a three-line record for a complaint about a device failing in use.
A workable approach is to decide the depth of investigation at the point of opening, using the same severity scale as your risk management file. A CAPA that touches a hazard with a serious harm rating gets a formal root cause method, a cross-functional team, a documented risk assessment of the proposed action and an effectiveness check with defined criteria. A CAPA about a documentation nonconformity with no product impact can have a short cause analysis and a simpler check. Write the tiers into the procedure so the decision is consistent and the auditor can see why two CAPA records look so different.
Timeliness belongs here too. The standard says "without undue delay", and it does not give a number of days. Set target timescales by tier in your procedure, track them, and record the reason when a CAPA runs over. An overdue CAPA with a documented reason and an interim containment measure is defensible. An overdue CAPA nobody has looked at for four months is not.
What a notified body auditor looks for in a CAPA file
When a notified body auditor audits your QMS, CAPA is one of the processes they will almost always sample, and they tend to trace from inputs. They pick a complaint, a nonconformity report or an internal audit finding and follow it through. The questions are predictable, and a good CAPA file answers them without anyone in the room needing to explain.
They will want to see the problem statement written specifically enough that someone outside the team understands what happened, where and to how many units. They will look for an investigation that reached a cause supported by evidence, and they will push on "human error" as a root cause unless you can show why the process allowed the error. They will look at whether the scope was considered: if the cause was a supplier's process, did you check other parts from that supplier? They will check that actions changed something durable, such as a document, a fixture, a specification or a system setting, and that the changed documents went through document control. They will look for the step-five verification that the action did not harm device safety or performance, and for a link to the risk management file where risk was affected. Finally, they will read the effectiveness review and compare the closure date with the implementation date.
They also read the CAPA log as a whole. Many CAPA records with the same root cause category, a long tail of overdue items, or no preventive actions at all are findings in their own right. Corrective and preventive action is a required input to management review under clause 5.6.2, so the auditor will also expect your management review records to show CAPA status being discussed and acted on.
CAPA documentation that holds up
A CAPA record that survives an audit usually contains the source and reference of the triggering event, the problem statement, the risk-based tier decision, the investigation method and evidence, the root cause, the scope assessment, the action plan with owners and due dates, the evidence of implementation including document revision numbers, the verification that the action does not adversely affect safety and performance, the effectiveness criteria set before closure, the effectiveness result, and the closure approval. If any of these lives only in an email thread, the auditor will treat it as missing.
The single most useful habit is writing the effectiveness criteria at the moment you approve the action plan, before anyone knows how it will turn out. It forces the team to say what success looks like, and it stops the closure from becoming a formality.
Pick your three oldest open CAPA records this week and read them as an auditor would, from trigger to closure, without anyone explaining them to you. Wherever you have to fill a gap from memory, the record needs fixing. If you want those steps, owners and effectiveness reviews held in one place with an append-only audit trail, see how InnoQualis handles CAPA.
