Corrective and Preventive Action: What Does FDA Look For During Inspection?

This is a first of a series of articles addressing the topic of what FDA seeks during an inspection. This article also serves to introduce my lecture and workshop scheduled for OMTEC 2011, relative to FDA inspections. (Further details are available following this article.)

The orthopaedic industry faces strong pressure from regulatory bodies as well as from the industry to maintain the quality of medical devices and, concurrently, to lower expenditures as much as possible. An effective corrective and preventive action (CAPA) process is one means to achieve these objectives.

The CAPA subsystem serves to collect and analyze information, identify and investigate product and quality problems and take appropriate and effective corrective and preventive action to prevent recurrence. Risk management tools play a large role in this process, and it involves every facet of the Quality Management System (QMS). A key part of CAPA is root cause analysis, which is utilized to ascertain the source of a problem, non-conformity or defect so that corrective or preventive action can be taken to address the issue.

Verifying or validating corrective and preventive actions, communicating corrective and preventive action activities to responsible people, providing relevant information for management’s review and documenting these activities are essential in dealing effectively with product and quality problems, preventing their recurrence and preventing or minimizing device failures. Today’s FDA investigator is more sensitive to these deliverables because of accelerated and more intense internal training, as well as on-the-job training for new investigators at the district level.

Defined Significance and Scope

Corrective and preventive action(also called corrective action/preventive action) is a concept embodied in 21 CFR, Part 820 (Good Manufacturing Practices, Quality System Regulation – cGMP-QSR) and ISO 13485:2003 (ISO 13485). CAPA focuses on the systematic investigation of discrepancies (failures and/or deviations) in an attempt to prevent their recurrence (for corrective action) or prevent from occurrence (for preventive action). To ensure that corrective and preventive actions are effective, the systematic investigation of failure incidence is pivotal in identifying the corrective and preventive actions undertaken. CAPA, next to Management Responsibility, is the most important process of the overall QMS.

The significance of the device (and any hazard the defective device presents) and/or the process failure should be taken into consideration when determining compliance with corrective and preventive action requirements. Analysis should be taken to the level necessary to determine the actual failure mechanism, e.g., defective component, incorrect raw material, systemic issue, process aberration, etc. The cause of failure is obvious in some cases, and a formal investigation may not be needed. In that case, just a correction might be in order. A record of the investigation, follow up and conclusions shall be made in accordance with 21 CFR, Part 820, section 820.100 and ISO 13485:2003, sections 8.5.2 and .3.

When a systemic failure has been identified, manufacturers need not analyze every device or process with the same symptoms. However, enough process issues should be analyzed to clearly establish symptoms before any assumptions are made about the cause of failure or about corrective actions. When an investigation results in identification of a deficiency, such as a failed component or a design flaw, and this deficiency may exist in other product lines, the investigation will not be effective unless it extends to determining the effect on other product lines and possibly a process in the QMS itself. Process issues are handled in a similar manner.

If the failure is design related, the design shall be corrected per the design control requirements in 820.30 in order for the devices to meet company quality claims and not be adulterated under the FD&C Act section 501(c). When a failure is determined to be related to documentation, assembly, processing, labeling, testing, packaging or other manufacturing operations, the manufacturing deficiency shall be identified, corrected and documented.

Implementing an effective corrective or preventive action that is capable of satisfying quality assurance and regulatory documentation requirements is accomplished in seven basic steps.

  1. The identification of the problem, nonconformity or incident or the potential problem, nonconformity or incident.
  2. An evaluation of the magnitude of the problem and potential impact on the company.
  3. The development of an investigation procedure with assignments of responsibility.
  4. Performing a thorough analysis of the problem with appropriate documentation.
  5. Creating an action plan listing all the tasks that must be completed to correct and/or prevent the problem.
  6. The implementation the plan.
  7. A thorough follow up with verification of the completion of all tasks, and an assessment of the appropriateness and effectiveness of the actions taken.

Note: These steps are the roadmap for the investigator. They should be followed explicitly.

Links to Other Process Points

To achieve effective CAPA process acuity, it is important to track, manage and assess all different quality data points within the organization and to manage key performance indicators throughout the process, as well. CAPA, like all quality processes in the QMS, does not “stand alone” but in fact directly links with Management Review, Purchasing Controls, Non-Conforming Product, Complaint Handling, Quality Audits, Servicing and Installation and Production Controls. Risk is the binding process that not only holds these relationships together, but also has a large effect on outcome. (See ISO 14971:2007.) Before risk management became popular, per se, decisions didn’t necessarily include quantitative inputs and outputs. Many low risk decisions (which should have been treated as just a correction – a “quick fix,” if you will) ended up in the sphere of a very involved and prescriptive CAPA process and were doomed for failure. Some quality data points that could be important to making risk-based decisions for compliance and improvement are commonly derived from the following.

  • Service Reports
  • Regulatory Authority and Customer “Observations”
  • Process/Product Complaints
  • Purchased Parts Non-conformities
  • Production Non-conformities
  • Internal/External Audits
  • Supplier Audits
  • Manufacturing Non-conformities
  • Engineering Non-conformities
  • Quality System Non-conformities
  • Analysis/Trending Data
  • Analysis/Trending Known Problem (issues)

The CAPA process is a tool to facilitate action within the matrix of the QMS, and not a department, nor is it an island unto itself. It “behaves” with these process triggers to show the establishment of an integrated system (or not).

The Assessment of Risk

CAPA findings in FDA inspections continue to be among the highest observations cited by investigators. FDA has provided information explaining that risk is an important consideration in the CAPA process. FDA does not, however, provide any guidance on how risk is included in this important process. Additionally, more information flowing out of FDA is indicating that risk is becoming an additional focus of the agency.

Using the result of the impact evaluation, the seriousness of the issue is assessed. The level of risk that is associated with the problem may affect the actions that are taken. For example, a problem that presents a serious risk to the function or safety of a product may be assigned a high priority and require immediate remedial action. On the other hand, an observation exposing only deviant data and slight occurrence may have a lower priority.

Based on the outcome of the aforementioned impact and risk evaluations, it may be determined that immediate remedial action is required to remedy the situation until a thorough investigation and a permanent solution is implemented. If remedial actions are necessary, the actions and the resources required are listed. Steps that must be taken immediately to avoid any further adverse effects are explained. In some instances, it may be determined that the remedial action is all that is needed. In that case, a rationale is written for that decision, appropriate follow up is done and the CAPA is presented to the Quality Review Board (QRB) for formal and documented close out.

What Does FDA Look At in the CAPA Process During a Routine Inspection?

The investigator will want to verify definition and documentation of the CAPA system procedures that address the requirements of the quality system regulation. Usually this means that, depending upon the size of your company, your Quality Manual will “set the stage” for your CAPA policies, that you probably will have at least one second-level procedure (Standard Operating Procedure) and that linked Work Instructions will address everything from the important CAPA forms to how your company will address quality data generated from an integrated software system/data base.

The next step could be determining whether appropriate sources of product and quality problems have been identified. Confirm that data from these sources are analyzed to identify existing product and quality problems that may require corrective action. Lately I have seen an increase in FDA 483s written for not addressing the quality data that is being made available by a company’s own QMS. Many companies are being inundated with compiled data, trend reports, customer feedback and management-required data, and don’t do anything impactful with this information. I handle a lot of FDA inspections, and some companies simply ignore the data or handle it in such a manner with hopes that the trends will simply “go away.” The FDA investigator doesn’t want to see this, and may write a finding such as, “Appropriate sources of quality data are not adequately analyzed to identify existing and potential causes of non-conforming product and other quality problems.”

Determine if sources of product and quality information that may show unfavorable trends have been identified, and discern whether the company is identifying product and quality problems that may require a preventive action. During inspection, the investigator reviews historical records such as trending data, corrective actions, acceptance activities (component history records, process control records, finished device testing, etc.) and other quality system records for unfavorable trends.

Your company’s use of statistical techniques for analyzing this data where applicable has become more impactful with the insertion of risk management into the fabric of the QMS, e.g., have enough samples been taken to ascertain whether this issue is only an aberration or is it, in fact, truly a corrective action opportunity. The analysis of product and quality problems should include appropriate statistical and non-statistical techniques. Statistical techniques include Pareto analysis, spreadsheets and pie charts. Non-statistical techniques include quality review boards, quality review committees and other multifunctional methods for drawing conclusions. The analysis of product and quality problems should also include the comparison of problems and trends across different data sources to establish a global vs. an isolated view of an issue. The full extent of a problem must be captured before the probability of occurrence, risk analysis and the proper course of corrective or preventive action can be determined.

FDA will challenge whether your quality data information system captures the “right data” and to risk-based decision-making. In other words, the investigator will try to verify that the data received by the CAPA system are complete, accurate and timely. During your due-diligence, prior to the inspection, you should review all levels of CAPA documents for conducting failure investigations. Identifying 1) failure modes and determining the significance of these modes, 2) the rationale for determining if a failure analysis should be conducted as part of the investigation, and 3) the depth of the failure analysis are integral in making convincing decisions with compliant outcomes. Determining whether the depth of your company’s investigation is sufficient (establishing root cause(s)) and if the corrective action necessary to correct the problem has been adequately taken will be challenged at every step of the way. Companies commonly don’t have time to complete corrective and preventive actions in a proper manner. This resource-intense process is sometimes overwhelming, and in most cases reflective of an intrinsic lack of management support to complete the actions necessary.

By way of example, if the investigator starts inquiring about the cross-functional group of individuals that address quality data, e.g. the QRB, there will be a built-in step to then verify that appropriate statistical methods are employed where necessary to detect recurring quality problems. Determining if the results of analyses by your company are compared across different data sources to identify and develop the extent of product and quality problems commonly becomes the second part of this inquiry. You need to be prepared to show how the QRB interacts, what subjects are periodically covered, whether this group generates minutes that could become Management Review inputs, and whether the follow-ups to CAPA issues are completed in a timely and accurate manner. This is not easy! A process owner should be assigned to facilitate and bring closure to the many variables that will present themselves throughout the course of an investigation.

Your company’s involvement with failure investigations will be challenged. This involvement should start with executive-level management and be evidenced through the interaction of process owners. The challenges could be in line with determining 1) whether failure investigation procedures are followed, 2) whether the degree to which a quality problem or nonconforming product is investigated is commensurate with the significance and risk of the nonconformity, 3) if failure investigations are conducted to determine root cause (where possible) and 4) that there is control to prevent distribution of nonconforming product.

Determining that your company has taken appropriate actions for significant product and quality problems identified from data sources is paramount to establishing a successful CAPA process. FDA will commonly use selected samplings of significant CAPAs and determine the effectiveness of these corrective or preventive actions (usually by reviewing product and quality problem trend results and establishing whether are any similar product or quality problems will arise after the implementation of the corrective or preventive actions). Investigators will search with a microscope to see that corrective actions taken are verified or validated, to ensure that such actions are effective and do not adversely affect the finished device or jeopardize the implementation of the supporting processes. Corrective actions must be verified and, if applicable, validated. Corrective actions must include the application of design controls, if appropriate.

Usually, the last line of questions will serve to verify that CAPAs for product and quality problems were implemented and documented. Also, attention will be given to any ensuing information regarding nonconforming product, quality problems and CAPAs to establish that this information is properly disseminated, including dissemination for management review. 


It is important to use the CAPA system. It is one of the key elements to a QMS that will lead to improved/compliant processes, with an ISO focus on continual improvements. A robust CAPA program is of the utmost importance to an orthopaedic device manufacturer. A system that identifies and eliminates non-conformances and potential non-conformances enables both regulatory compliance and cost savings.

Not every problem or nonconformance requires corrective action. Whether corrective action is needed varies by type of device being manufactured, the risks involved with each occurrence and the severity of the output. The decision may be left to process owners, or some companies might have Quality Review Board. In any case, it is not a decision for only one individual to make. FDA will emphasize that point throughout the inspection, and always place the ultimate responsibility for correcting problems upon top level management. The need for corrective action should be evaluated along several dimensions. How often does it happen? How important or critical is the issue? How are customers impacted? The answers determine if there is need for corrective action.

FDA requires that procedures are in place to ensure that information is disseminated to those directly responsible for assuring quality or the prevention of such problems, and to provide for submission of relevant information on identified quality problems, as well as corrective and preventive actions, for management review. Your company’s procedures should clearly define the criteria to be followed to determine what information will be considered relevant to the action taken and why. FDA emphasizes that it is always management's responsibility to ensure that all nonconformity issues are handled appropriately and in a compliant manner.

FDA agrees that the degree of CAPA taken to eliminate or minimize actual or potential nonconformities must be appropriate to the magnitude of the problem and commensurate with the risks encountered. FDA will not dictate in a regulation the degree of action that should be taken, because each circumstance will be different, but FDA does expect your company to develop procedures for assessing the risk, the actions that need to be taken for different levels of risk, and the means to correct or prevent the problem from recurring, depending on that risk assessment.

John Gagliardi has had success over the past 40 years in the Medical Device and Pharmaceutical industries because of his practical approach to process-orientation and business. He has been actively involved in research and development, quality assurance, training, operations, process architecture, FDA inspections and regulatory affairs. John specializes in building systems in a compliant and business-ready manner. Email John at This email address is being protected from spambots. You need JavaScript enabled to view it..

MidWest Process Innovation, LLC
513-573-0085 (phone)

Continue learning from Mr. Gagliardi during OMTEC 2011 by attending his lecture and workshop on Wednesday, June 15.

Lecture: Planning For and Managing FDA Inspections: Logistics/Process Architecture/QSIT

This session will address:

  • Preparing for an FDA inspection/definition of inspectional policy
  • Designating an inspection team/roles and responsibilities/management’s role
  • Limiting missteps associated with inspections
  • Review of a procedure for managing inspections
  • Handling the closeout meeting
  • Responding to an FDA-483

Workshop: Planning For and Managing FDA Inspections: Working With Actual Scenarios from FDA Inspections

This workshop will cover:

  • Choosing the appropriate objective evidence
  • Planning for and answering the questions
  • Scenarios - FDA “Hot Buttons”
  • Benchmarking with fellow attendees to gain knowledge

Attendees will receive these tools to put to immediate use:

  • An effective understanding of how to prepare for an FDA inspection
  • The ability to properly manage and behave during this type of inspection
  • An understanding of how to approach issues when certain scenarios present themselves
  • The ability to enable a predictive strategy in lieu of a reactionary approach that sometimes depends on luck
  • The knowledge to respond to an FDA-483 without “digging a deeper hole”

Detailed abstracts for this lecture and workshop are available online and in the Advance Program. Please visit for the most up to date information.