CAPA stands for Corrective and Preventive Action. It is the process by which an organisation investigates problems, eliminates their causes and prevents recurrence.
Where the term comes from
CAPA is regulatory language from the medical device and pharmaceutical world. It appears in FDA regulation and is central to ISO 13485. In device companies, the CAPA system is often the single most scrutinised process in an inspection — an inadequate CAPA system is among the most commonly cited FDA findings.
In ISO 9001 the same activity exists but the term is not used: the standard talks about corrective action in clause 10.2, with prevention handled through risk and opportunity planning in clause 6.1.
Why device CAPA is stricter
A device CAPA system is expected to draw on more sources than a quality system typically does — complaints, service records, returned product, nonconforming product, audit findings, and process monitoring data — and to analyse them for trends rather than only reacting to individual events.
It must also connect to risk management. If a CAPA changes a design or a process, the risk file is expected to be revisited.
The common failure
Opening too many CAPAs. A CAPA system that treats every minor issue as a formal investigation becomes a backlog, and a backlog of overdue CAPAs is itself a finding. Mature systems triage: most issues are handled as corrections, and CAPA is reserved for problems that are systemic, recurring, or carry real risk.