c o m p l i a n c e

Product Quality and FDA Inspectors Demand

Strong Corrective and Preventive Action
(CAPA) Program

Here’s the truth: If an FDA inspector comes to your facility, he or she will want to see how
you have configured your Corrective and Preventive Action (CAPA) program. Bet on it.

There are two reasons for this; one official and the other unofficial. Officially, the FDA always
includes an inspection of a CAPA system in its rounds. A level 1 abbreviated quality system
inspection technique (QSIT) inspection will include a look at CAPA and one of three other
areas: management controls, design controls or production and process controls. A level 2
QSIT inspection will look at all four areas.

But the unofficial reason may be more important: FDA inspectors have told many company
officials and consultants off the record that they view a firm’s CAPA capabilities as an
indicator of how well or how poorly a firm has a handle on its overall operations.

“FDA inspections often focus on deviations, including what was done to investigate
the causes, how the deviations were resolved, and what was done to prevent future
similar issues,” points out John Vadnais, Vice President at RCM Technologies. “The FDA
particularly looks at the company’s investigations process (see the hallmark Barr decision
on investigations), and at the CAPA record which often is made in response to a deviation,”
he adds. “CAPA’s offer the benefit of formal tracking which empowers the company to
ensure that all items are resolved.  It offers the FDA a view into the company’s compliance
process and, through its openness, may serve to reassure the FDA. The deviation, and the
accompanying CAPA record if used, is a frequent focus for FDA review.”

CAPA as ‘Bellwether’
Former FDAer Ken Miles agrees that CAPA represents something of a bellwether for
overall compliance work in the eyes of the agency. “Many of us, myself included, felt in
our inspection that if the firm was strong in CAPA, they were likely to be in good shape
elsewhere. Likewise, if they had CAPA problems with us at the outset, we suspected we were
in for a long, tough inspection.” Miles was inspector in the agency’s Oakland, Calif. Office.

Even a quick reading of the FDA’s hundreds of 483 warning letters issued in the past few
years shows that the agency is serious about enforcing firm-wide CAPA compliance. Here are
just a few examples of actual letters with firm names removed:

• “Procedures for implementing corrective and preventive actions were not

implemented…in your firm’s handling of two quality assurance problems that led to
recalls.” [April 15, 2003]

• “Significant deviations include, but are not limited to the following: Failure to
adequately establish and maintain procedures for implementing corrective and
preventative action, which include requirements for analyzing processes, work
operations, concessions, quality audit reports, service records, complaints, returned
product, and other sources of quality data to identify existing and potential causes
of nonconforming product or other quality problems.” [June 11, 2003]

• “CAPA activities have not been documented, including investigations of causes of

nonconformities.” [March 29, 2004]
 c o m p l i a n c e

“It is no surprise that these and other CAPA violations appear on the first page of these warning letters just a few lines
under the ‘Dear Firm’ salutation,” notes Michael Causey, former editor of the industry newsletter Part 11 Compliance
Report and now an independent consultant. “FDAers expect firms to have strong CAPA capabilities in every aspect of their
operation.”

In public presentations, FDAers including Jan Welch in the Office of Compliance at an April 2004 industry conference have
stressed that CAPA compliance remains critical even with the agency’s shift in 2002 to emphasize a risk-based approach
to current good manufacturing practice (GMPs) inspections. [See Quality System chart below]

Source: FDA

“Overview of the Quality System

Regulation for Medical Devices,
April 21, 2004

An analysis of the FDA’s 483 letters in recent years demonstrates clearly that CAPA is a big issue and that it will remain so.
In the pre-QSIT inspection world, CAPA was in fact the number one item cited in 483s, appearing a whopping 50% of the
time. However, in the QSIT world, CAPA is now the number two item, cited 30% of the time. But don’t let that give a false
impression: the new number one 483 item is management responsibility, which is often tied in with CAPA control, experts
point out.

“When the agency has a problem with a firm’s CAPA program, they’re going to look to the top for answers,” Causey notes.
He points out that the FDA inspector’s manual carries these instructions for the conclusion of an inspection:

• “Evaluate whether management with executive responsibility ensures that an adequate and effective quality
system has been established and maintained.”

CAPA Given Short-Shrift?

But former FDAer Timothy Wells – an FDA team leader for the QSIT program from 1998 to 2000 and now an independent
consultant – worries that many firms aren’t giving CAPA work the time it deserves. “When I visit pharmaceutical
companies I often find [a] lack of CAPA programs, no management review, and a poor audit program,” he said in 2003.

Wells and others in the field argue that firms that don’t have a strong CAPA program are ultimately hurting themselves
most. “I believe that having those [CAPA] systems in place will also result in less recalls, less investigations, less product
loss and more profits for the industry.”

Medical device firms generally lead the way in these compliance efforts, most experts agree. With standards in place and
arguably a better understanding of how compliance with CAPA and issues including 21 CFR Part 11’s electronic records
provisions works, firms including Thermage, Bausch & Lomb, Guidant Corporation and Fischer Imaging are pioneers in
leveraging these compliance efforts into better business practices and operations.

In August 2003, for example, Thermage tapped AssurX, Inc.’s CATSWeb for their corporate-wide quality tracking system
that includes customer complaints, supplier quality, CAPAs, investigation reports and nonconformances. Thermage is a
medical device company that manufactures ThermaCool TC, an advanced radio frequency (RF) based device used for the
treatment of skin in dermatology and plastic surgery applications. 2
 c o m p l i a n c e

According to Richard Meader, Thermage’s Vice President of Clinical, Regulatory and Quality Affairs, “We selected
CATSWeb because it was 21 CFR Part 11 compliant and we could easily configure the system to our existing processes
and workflows. And since CATSWeb is so flexible, we see potential applications outside of the quality systems area as
well.”

Fischer Imaging, the United States’ oldest existing manufacturer of x-ray medical equipment, is utilizing CATSWeb
largely in its operations, quality regulatory group and engineering departments, but other departments are brought
in as required by job. Fischer’s operations group includes purchasing, receiving, inspection, and production. “It is truly a
corporate wide usage,” says Gary Turner, VP of Quality and Regulatory Affairs. “The product’s ease of use and flexibility
makes it easy to add new users and find new ways to take advantage of its capabilities”, adds Frank Strupeck, Supplier
Quality Engineer.

It is also worth noting that innovative firms outside the FDA’s regulatory reach are embracing the value of strong firm-
wide CAPA capabilities. In February 2004, for example, AssurX,Inc. announced that Watlow has selected its CATSWeb
for the firm’s corporate-wide corrective action system to be rolled out at seven North American plants in 2004. Watlow,
headquartered in St. Louis, MO, is a provider of thermal components and solutions to a variety of industries including
semiconductor, plastics processing, foodservice equipment, life sciences, aerospace, and others.

Watlow’s Quality Process Leader Drew A. Dubray stated, “Before we selected CATSWeb, all of our facilities were using
different systems. We needed to consolidate all of this information into a single, centralized, Web-based system that
everyone could use, and provide better visibility on a corporate-wide basis. “

A ‘Healthy’ CAPA
According to the FDA’s Welch, “Healthy” CAPA subsystem procedures include provisions to:

1. Identify and correct existing nonconforming product or other quality problems

2. Identify and eliminate the causes of existing nonconforming product and other quality problems; and

3. Identify and eliminate the causes of potential nonconforming product and other quality problems.

A common mistake made by drug and device firms is to believe that CAPA is only a “factory floor” issue, notes Causey.
“The FDA doesn’t look at it that way, and neither should a firm that wants to be operating efficiently.”

Firm-wide risk management is key to a successful CAPA program, Causey noted. For example, FDA risk management
and assessment concept papers suggest a firm perform an error prevention analysis to minimize medication errors.
The four main components of that program should be to:

• Identify known and potential medication error modalities;

• Identify potential and actual causes of each error;

• Prioritize the errors according to the expected outcome, especially in terms of risk of harm to patient; and

• Minimize the potential for an error through corrective action including renaming, relabeling or repackaging.

Even the strongest CAPA program can lose its value if a firm cannot measure and demonstrate system performance for
an FDA inspector, Causey said. That also means senior management must be able to articulate the CAPA program and
its metrics in a way that is clear to the FDA.

Audit Trails Critical

“FDAers are fond of saying ‘if you can’t show it, it didn’t happen,’” Causey said. That means even an otherwise strong
CAPA program won’t do a firm much good during an inspection unless they can utilize clear audit trails to detail your
CAPA program and how it identifies potential problems and notifies relevant personnel.

Whether developing a program in-house or working with a vendor with a strong track record like AssurX, Causey
stresses that the audit trail capability is crucial. “If your system cannot quickly and accurately produce audit trails in
human readable form, you are simply not ready for prime time from an inspector’s point of view.”

3
 c o m p l i a n c e

Another key to developing a strong CAPA program is

starting with a definition of the sometimes-elusive
concept; two underlying definitions provide potentially
helpful foundations for your own interpretation: ISO
13485 and 21 CFR 820.100(a).
ISO 13485: Under this definition, corrective
actions “shall be appropriate to the effects of the
nonconformities encountered.” ISO 13485 calls for a
documented procedure to be established to define
requirements for:
• Reviewing nonconformities (including
customer complaints);
• Determining the cause of nonconformities;
• Evaluating the need for action to ensure
nonconformities do not recur;
• Determining and implementing action
needed, including, if appropriate, updating
documentation;
• Recording the results of any investigation and
of action taken; and
• Reviewing the corrective action taken and its
effectiveness.
ISO 13485 also calls for the organization to determine
action to eliminate the causes of potential
nonconformities in order to prevent their occurrence.
Those preventive actions should:
• Determine potential nonconformities and
their causes;
• Evaluate the need for action to prevent the
occurrence of nonconformities;
Correction vs. Corrective Action
& Preventive Action
Remember to approach your CAPA system
with a clear understanding of the difference
between correction and corrective action.
Corrective action is defined by the FDA as
an “action taken to eliminate the causes of
an existing non-conformity, defect or other
undesirable situation in order to prevent
recurrence.” An example of a correction action
is when defective components damaged
during assembly cause out-of-box failures.
Controls to fix it are instituted and operators
are trained in them.
“Correction” refers to repair, rework, or
adjustment and relates to the disposition
of an existing nonconformity. An example
of a correction is when devices are returned
because of out-of-box failures are repaired and
put back into inventory.
And “preventive action” is defined by the FDA
as an “action taken to eliminate the cause of
a potential non-conformity, defect, or other
undesirable situation in order to prevent
occurrence.” An example is when SPC charts
indicate a process is drifting toward upper
limit for diameter of injection molded part.
Investigation determines the cause of the drift
is wear to mold. You replace the mold, and
verify/validate that the process yields parts
meeting specifications.

• Determine and implement any action needed;

• Record the results of any investigations and actions taken; and

• Review preventative actions taken and their effectiveness.

21 CFR 820: Sub-part J of the rule says each manufacturer should establish and maintain the following procedures for
implementing CAPA:

• Analyzing processes, work operations, concessions, quality audit reports, quality records, service records,
complaints, returned products, and other sources of quality data to identify existing and potential causes of
nonconforming product, or other quality problems;

• Investigating the cause of nonconformities relating to product, processes and the quality system;

• Identifying the actions needed to correct and prevent recurrence of nonconforming product and other quality
problems;

• Verifying or validating the CAPA;

• Implementing and recording changes in methods and procedures needed to correct and prevent identified
quality problems; 4
 c o m p l i a n c e

• Ensuring that information related to quality problems or nonconforming product is disseminated to those
directly responsible for assuring the quality of such product or the prevention of such problems; and

• Submitting relevant information on identified quality problems, as well as CAPA for management review.
Ultimately, there are many reasons to put a priority on a strong CAPA system. FDA inspectors will look there first and
often use that first impression of your operation to influence the rest of your inspection. Perhaps even more importantly,
CAPA presents firms with an exciting opportunity to prevent recalls, improve operational efficiency, and boost the
bottom-line.

Additional Resources (FDA):

Good Manufacturing Practice/Quality Systems:  http://www.fda.gov/cdrh/comp/gmp.html

QSIT Guide:  www.fda.gov/ora/inspect_ref/igs/qsit/qsitguide.pdf

21 CFR Part 11:  http://www.fda.gov/ora/compliance_ref/part11/

Case Studies:
(Available in electronic format at www.assurx.com/custstud.html, or to request printed copies, please call 408-778-1376, ext,. 705)

Bausch & Lomb: Implementing a Global 21 CFR Part 11 CAPA System

Guidant Corporation: Going Paperless – A Case Study Illustrating the Benefits of Electronic Records

Galderma R & D: A New Streamlined Approach for QA Audits and CAPA Processes

Alcon Labs: A New Vision of Quality Assurance

AssurX, Inc.
18525 Sutter Boulevard
Suite 150
Morgan Hill, CA 95037
tel 408.778.1376

fax 408.776.1267

www.assurx.com
info@assurx.com © Copyright 1993 - 2007, AssurX, Inc. All rights reserved. 5