What is CAPA?

Correction, corrective action and prevention

A correction fixes the immediate problem, such as removing an account a leaver still had. A corrective action removes the cause, such as fixing the offboarding step that missed it. A preventive action deals with a problem that has not happened yet, such as checking whether other systems have the same gap.

Current ISO management system standards handle prevention through risk planning in clause 6.1, so clause 10.2 is titled “nonconformity and corrective action”. The term CAPA is still widely used, especially by teams with a quality management or medical device background.

What ISO 27001 and ISO 42001 ask for

When a nonconformity occurs, clause 10.2 expects the following, plus changes to the management system where the cause calls for them.

At a certification audit, a minor nonconformity needs a corrective action plan the auditor accepts. A major nonconformity has to be resolved and verified before a certificate is issued.

• React. Control and correct the problem, and deal with its consequences.
• Find the cause. Review the nonconformity, work out why it happened, and check whether similar ones exist or could occur.
• Act. Carry out the action needed to remove the cause.
• Check effectiveness. Review whether the action worked.
• Record. Keep documented information on what went wrong, what was done and the result.

What a good CAPA record looks like

Each record links to the finding or incident, describes the problem, states the root cause, and sets out the action, owner and due date. It then holds evidence that the action was done and, after a suitable interval, a check that the problem has not come back.

Auditors see the same weak patterns often: records closed on the correction alone, “retrain staff” given as the cause of everything, and no effectiveness check. SOC 2 has no CAPA clause, but auditors read management’s responses to exceptions, and the same exception appearing again in the next period is noticed.

Related terms

Nonconformity

An ISO audit finding that a requirement is not met. A minor nonconformity needs a corrective action plan; a major one must be resolved before a certificate is issued.

Internal audit

A review of the management system by someone independent of the area being audited. ISO 27001 and ISO 42001 require one before certification and at planned intervals after it.

Exception (audit)

An instance where a control did not operate as described during the audit period. A SOC 2 report lists exceptions, and readers judge how much they matter.

Management review

A recorded review in which leadership looks at how the management system is performing: audit results, risks, incidents, objectives and resources. Required by ISO management system standards.

Plan of Action and Milestones (POA&M)

The CMMC and NIST document listing unmet requirements with the planned fix, owner and date. Only a limited set of requirements may sit on a POA&M at a CMMC assessment.