ISO 13485 CAPA: The Essential 2026 Guide to 8.5.2 and 8.5.3

An ISO 13485 CAPA process is the documented way your company investigates problems, fixes their causes and proves the fixes worked. Clauses 8.5.2 for corrective action and 8.5.3 for preventive action require it, and weak CAPA records are among the most common audit findings.

This guide gives a seven-step method, shows which triggers matter, explains effectiveness checks and warns about the habits that make auditors dig deeper. It builds on internal audit and management review outputs.

What the standard says about corrective action

Clause 8.5.2 requires a documented procedure for corrective action. It must cover reviewing nonconformities including complaints, determining causes, evaluating whether action is needed, planning and documenting the action, and verifying it.

The standard also requires you to verify that the action does not adversely affect your ability to meet regulatory requirements or the safety and performance of the medical device. Effectiveness of the action must be reviewed.

Records of investigations and actions taken must be kept. Check the wording in the ISO 13485:2016 page on iso.org.

What the standard says about preventive action

Clause 8.5.3 requires a documented procedure to determine action that eliminates the causes of potential nonconformities, preventing their occurrence. It follows the same logic as corrective action, applied before a failure happens.

This is a difference from ISO 9001:2015, which dropped preventive action as a separate clause. Medical device makers still need it, so keep it visible in the system.

Typical preventive triggers are trend data, risk analysis results and lessons from other products or suppliers.

Why one ISO 13485 CAPA process is easier

Most companies run corrective and preventive action through one procedure and one log. Each record is tagged corrective or preventive, so both clauses are covered without duplicating forms.

A single ISO 13485 CAPA process also gives top management one list to review. Fragmented trackers hide overdue items.

Keep the log simple: number, source, description, risk, owner, due date, root cause, action, verification and closure date. Keep this in mind for every ISO 13485 CAPA.

CAPA triggers worth defining

Define in writing what starts a CAPA. Common sources are complaints, nonconforming product trends, audit findings, supplier failures, field actions and negative trends in process data.

Not every problem needs one. A single isolated defect may need only correction and a note. Set a threshold based on risk and recurrence, and document the rule so decisions are consistent.

Link complaint handling and nonconforming product control to the CAPA procedure explicitly.

Step 1 and 2: containment and risk assessment

Step 1 is containment. Stop shipment, quarantine suspect stock and decide whether product in the field is affected. Do this before the investigation starts.

Step 2 is a quick risk assessment. Ask whether the issue could affect patient or user safety and whether it triggers reporting to a regulator. Serious cases move into vigilance processes such as MDR serious incident reporting.

Record the decisions and who made them, with the time. These records matter if the issue becomes a field safety action. This is where a ISO 13485 CAPA is won or lost.

Step 3: investigate the root cause

Use a proportionate method. Five whys works for simple process errors, fishbone diagrams for multiple factors and fault tree analysis for complex product failures.

The root cause must be something you can act on. Operator error is rarely a root cause; the question is why the process allowed the error, such as unclear instructions or missing checks.

Keep the evidence: photos, data, test results and interview notes. An auditor will ask how you know the cause is real.

Step 4: plan the action

Write the correction, which fixes the immediate problem, separately from the corrective action, which removes the cause. Auditors look for both.

Each action needs an owner, a due date and a way to verify it. If the action changes a design, process or document, route it through change control and revalidation where applicable.

Check that the action does not create new problems. This is the verification the standard demands for regulatory requirements and device safety. Auditors judge your ISO 13485 CAPA on exactly this point.

Step	Question to answer	Record to keep
1 Contain	Is affected product stopped?	Quarantine and hold record
2 Assess	Is there a safety or reporting risk?	Risk and reportability note
3 Investigate	What is the actionable root cause?	Evidence and analysis
4 Plan	What correction and corrective action?	Action plan, owner, due date
5 Implement	Was it done without harm?	Revised documents, training
6 Verify	Did the action meet regulatory and safety needs?	Verification record
7 Effectiveness	Did the problem stop?	Criteria and result

Step 5 and 6: implement and verify

Step 5 is implementing the action with evidence, such as the revised procedure, training records or updated specifications. Step 6 is verifying that the action was done as planned and did not harm anything else.

Verification is different from effectiveness. Verification asks whether you did what you said. Effectiveness asks whether the problem stopped.

Both checks should be recorded with the person and date. Keep them separate in the CAPA form.

Step 7: check effectiveness

Set an effectiveness criterion when you plan the action, not afterwards. For example, no recurrence in the next six production lots or complaint rate below a defined value for three months.

Review the data after the agreed period and record the result. If the problem returns, reopen or raise a new CAPA with a deeper root cause.

Closing on completion of tasks instead of results is the habit most likely to attract a finding. Treat it as a standing rule for your ISO 13485 CAPA.

Common mistakes in an ISO 13485 CAPA

Auditors find the same patterns repeatedly: vague problem statements, root causes that blame people, no effectiveness criteria and overdue items without management attention.

Another pattern is over-using CAPA for trivial issues, which buries serious ones. A third is treating the log as the process, with no investigation evidence behind it.

A sound ISO 13485 CAPA record tells a short, evidence-backed story from trigger to proof.

Using CAPA data in analysis and management review

Clause 8.4 requires you to analyze data, including feedback, product conformity, process trends, suppliers and audits. CAPA volumes and recurrence belong in that analysis.

Show CAPA age, source and closure rate in the management review. Repeated causes across CAPAs point to weaknesses in training, design or purchasing.

That analysis is itself a source of preventive action, which closes the loop the standard describes.

What changes for US manufacturers

The FDA Quality Management System Regulation, effective 2 February 2026, incorporates ISO 13485:2016, so clauses 8.5.2 and 8.5.3 now sit at the center of US expectations. The detail is covered in QMSR CAPA.

Companies that already ran a CAPA system under the old Quality System Regulation usually need to adjust terminology and records rather than rebuild.

Compare the two frameworks in QMSR vs ISO 13485 before you edit procedures.

Supplier and outsourced causes

Many causes sit outside your walls. When a supplier defect triggers a CAPA, send a formal request, set a response deadline and keep the supplier’s reply in the record.

If the supplier fails to respond or repeats the issue, escalate through your purchasing controls and consider re-evaluation. The ISO 13485 purchasing guide explains how.

Your own verification of the supplier’s action remains your responsibility.

Templates and training

A CAPA procedure, form and log are quick to adapt. The ISO 13485 Toolkit includes a CAPA procedure and record template aligned to clauses 8.5.2 and 8.5.3.

Train anyone who can raise or own a CAPA on the form and on writing a clear problem statement. Keep the training record, since competence is audited under clause 6.2.

Run a mock CAPA on a historical issue to test the form before real use.

Where CAPA fits in your certification plan

Certification bodies check CAPA at every audit, so have at least a few closed records with effectiveness checks before stage 2. The certification timeline shows when to start.

Use your internal audit checklist to test the process.

Show a working loop from trigger to verified result and you will answer most CAPA questions before they are asked.

Metrics that show the system is healthy

Track four numbers: average days to close, percentage closed on time, percentage with recurrence within a year and share of CAPAs with a documented effectiveness result.

These numbers feed objectives and reviews. If time to close is rising, look at resourcing or at whether too many low-risk items enter the system.

Keep targets realistic. A target of zero overdue items invites backdated records, which is far worse than an honest late item.

ISO 13485 CAPA FAQ

Is CAPA mandatory in ISO 13485?

Yes. Clauses 8.5.2 and 8.5.3 require documented procedures for corrective and preventive action, and records of investigations and actions.

Do I need separate corrective and preventive procedures?

No. One procedure can cover both, as long as it addresses each clause requirement.

How long should a CAPA take?

The standard says without undue delay. Set targets by risk, such as shorter for safety-related issues, and record the reasoning.

What if the problem returns after closure?

Reopen or raise a new CAPA with deeper root cause analysis, and show the earlier action was reviewed for effectiveness.