Corrective and preventive action (CAPA) is often a thorn in the side of medical device manufacturers. Problems with CAPA top the list of reasons for 483s and warning letters from the U.S. Food and Drug Administration (FDA) year after year, and many companies struggle to identify when they should even initiate a CAPA.

When companies are uncertain about what should trigger this action, they tend to make one of two mistakes:

• They get “CAPA happy.” In this case, every incident is treated as CAPA-worthy, which leads to mountains of paperwork and enormous stress. As they pile up, the backlog slows progress to a crawl, and the company may suffer “death by CAPA.”
• They ignore issues. On the other hand, some companies don’t escalate issues to CAPA when action is warranted. This underuse of the process leaves them vulnerable to 483s and warning letters from FDA, and has an adverse effect on the safety and efficacy of their devices.

The problem in both situations is uncertainty or misconceptions about the process. Here are my thoughts on what events should really trigger a CAPA.

The purpose of CAPA

First, let’s take a step back and look at the bigger picture. Your CAPA process is meant to investigate and address systemic quality issues, such as a component that repeatedly fails inspections during manufacturing. Keep this in mind as we get deeper into the different events that may trigger these actions.

Some companies escalate every one-off event into a CAPA, but this dilutes the effectiveness of the process and creates as many problems as it solves. The most effective approach to CAPA focuses heavily on preventive actions.

Many companies rely solely on a reactive approach, attempting to catch and correct problems as they arise. The best CAPA processes are proactive, with a focus on preventing systemic issues from ever occurring in the first place.

The quality subsystems that feed CAPA

Although a CAPA may come from any area of your QMS that presents a systemic quality issue, there are a few main areas that often trigger a CAPA.

Nonconformance

A nonconformance is a product or process that doesn’t fulfill a specific requirement established by the company, such as a disconnected process or defective product. A nonconforming product is one that does not conform to the device manufacturer’s specific requirements. There are many ways a product could be nonconforming; perhaps a certain component does not meet specifications or has been assembled incorrectly.

Similar to a CAPA, a nonconformance triggers a process, which involves controlling the nonconforming product and investigating the cause of the issue and the likelihood it will occur again.

However, it’s important to note that not all nonconformances will trigger a CAPA. This is a trap that many medical device companies fall into. They initiate an action for every nonconformance and end up on the “CAPA happy” end of the spectrum.

In reality, a single nonconformance will rarely require a CAPA. In some cases, nonconformances are minor enough that a manufacturer may decide that the device can still be used as is.

Now, there are situations in which nonconformances should trigger a CAPA. For instance, you may notice that a specific type of nonconformance—like a problem with a certain component—has appeared repeatedly. Even worse, the component is used in several of your products. At this point, you are probably looking at a systemic issue, and a CAPA may be warranted.

Complaints

The FDA defines a complaint as any communication that alleges deficiencies in your product after it has been placed on the market.

As with nonconformances, a complaint should trigger an investigative process that identifies the issue, how it affects the customer, and the root cause of the problem. Similar to a nonconformance, a single complaint will probably not trigger a CAPA. Again, you are looking for indications of a systemic issue, like multiple complaints about the same issue with your product.

However, there is one big caveat here: In the absence of a systemic problem, you may still initiate a CAPA when an adverse event occurs, such as an injury to a patient or end user.

Incidents like these always warrant a more thorough investigation and should trigger an action. The risks to patients, providers, and your company are too large to treat these events as one-off incidents.

In short, when a complaint raises a serious issue, you don’t need to wait until you can spot a trend to take action. There is no set number of complaints that determines whether a CAPA should be initiated. You must look at the big picture and evaluate each situation in light of many factors, such as the time between complaints and the circumstances surrounding them.

Audits

Audits, both internal and external, may uncover issues that need to be addressed. However, if these issues exist, your goal should be to discover them during internal audits so you can address them before an FDA inspection or ISO audit.

As before, you must evaluate whether the issues you discover during your internal audits are systemic in nature before initiating a CAPA. Medical device companies will often escalate every problem to CAPA as they perform their internal audit in an attempt to be thorough. Again, however, this is usually unnecessary.

If your audit uncovers a nonconformance, for example, you don’t need to immediately launch an investigation. You can instead issue a request for more records to help you understand the extent of the nonconformance. From there, you can decide whether the issue is systemic and requires a CAPA.

Change management

Change management may be known by different terminologies (e.g., change control, change requests, change orders), but the bottom line is that it’s a system that should be used regularly and may be triggered by any of the previous systems we’ve talked about.

For example, if you have single incidents of complaints or nonconformances, these may trigger a change in your documentation, labeling, product, design, or specifications. It’s possible that the whole incident can be handled this way without initiating a CAPA.

Risk-based CAPA

There should be a deep connection between CAPA and risk management within your organization. Whenever you believe an issue may warrant a CAPA, your first turn should be to your risk management documents. Has this issue already been assessed and documented? If not, then it’s time to update. If so, did you calculate the risk appropriately?

Also, remember that choosing to initiate a CAPA is an exercise in risk management. Risk is the combination of the likelihood of harm and the severity of that harm. As we’ve seen, CAPAs are generally initiated when the problem is systemic, meaning there is a higher likelihood of occurrence. Still, an adverse event involving injury to a patient may also trigger a CAPA because of its severity.

About the author

Sara Adams is a medical device guru at Greenlight Guru and a biomedical engineer who began her career in the medical device industry in the post-manufacturing world. As an experienced quality engineer, she has been responsible for leading corrective and preventive action investigations and implementations, process improvements, and supplier and regulatory audits.

This article originally appeared on the Quality Digest website and is published with permission.