CAPA workflow template (corrective and preventive action)

What the capa workflow template (corrective and preventive action) process is

Most CAPA systems fail in the same place: the root cause turns into a description of the symptom. 'The employee forgot to check' is not a root cause, it's a restatement of the nonconformity. The result is a corrective action called 'retraining' and a nonconformity that comes back eight months later.

A useful CAPA diagram forces three things apart: the immediate containment that stops the damage, the investigation that finds the cause, and the two actions that follow: the corrective action, which removes the cause of this specific nonconformity, and the preventive action, which removes the possibility of it happening elsewhere. In practice these get blended together, which is exactly why auditors ask about them separately.

The step that's most often missing is the last one: effectiveness verification. A CAPA shouldn't close because the action was carried out; it should close because it's documented that the action worked. The diagram needs a branch where insufficient effectiveness sends the case back to investigation instead of forward to closure.

What this flowchart covers

In this template

• Registering the case: source (nonconformity, complaint, internal audit or supplier failure), description, and an initial assessment of whether it warrants a CAPA at all
• Initial containment and immediate actions: stopping the issue, quarantining affected items, and assessing whether notification is required
• Risk assessment that sets the case's level, which in turn decides how deep the investigation needs to go and who approves closure
• Investigation and root-cause analysis with a documented method (5-why, fishbone or fault-tree analysis) and a branch that sends the case back if the cause isn't found
• An action plan split into corrective action for the specific nonconformity and preventive action for similar processes, each with an owner and a deadline
• Effectiveness verification and closure: documented confirmation that the action worked, approval of the closure, and updates to affected SOPs and training

When to use this template

• Nonconformities keep recurring, and you can see the root-cause analysis stopping at the symptom in practice
• You're being certified or inspected under ISO 9001, ISO 13485, GxP or GMP and need to show the CAPA process as controlled
• CAPA cases get closed once the action is carried out, with no documented assessment of whether it worked
• The CAPA system is clogged with minor issues because there's no criterion for what triggers a case
• Corrective and preventive actions get logged in the same field, and you can't show an auditor the difference

Controls documented

• ISO 9001 clause 10.2
• ISO 13485 clause 8.5.2/8.5.3

How it works

1. Define what triggers a CAPA

   Write the criterion in before the first decision node: recurrence, risk level, customer impact or a regulatory requirement.

2. Separate containment from corrective action

   The immediate action that stops the damage is not the corrective action.

3. Make the root-cause method a requirement on the node

   State the method you use and who needs to be involved.

4. Put an owner and a deadline on every action

   Both the corrective and the preventive action need a named owner and a date.

5. Let effectiveness verification be able to fail

   Draw the branch where insufficient effectiveness sends the case back to investigation.

Frequently asked questions

What are the typical steps in a CAPA workflow?

Issue identification → containment → investigation and root cause analysis → corrective action plan → preventive action plan → implementation → verification of effectiveness → closure.

Why does CAPA need to be approval-tracked?

Both ISO 9001 (10.2) and ISO 13485 (8.5.2 / 8.5.3) require documented evidence that corrective and preventive actions were reviewed and effective.

What's the difference between corrective and preventive action?

Corrective action removes the cause of the nonconformity that occurred. Preventive action removes the possibility of a similar one arising elsewhere.

When can a CAPA case be closed?

When the actions have been carried out and the effectiveness has been documented — not simply when the actions have been carried out.