What counts as a robust root-cause analysis?

A root-cause analysis is robust when it uses a traceable methodology (such as 5-Why, Ishikawa or Fault Tree) to move from symptom and trigger to the actual root cause, and the derived action demonstrably addresses that cause. ISO 13485:2016 Section 8.5.2, binding in the US via 21 CFR Part 820 (QMSR), explicitly requires determining and eliminating the cause, not just the symptom.

How is the effectiveness of a CAPA measured?

Through an effectiveness check against predefined, measurable acceptance criteria, such as the absence of the deviation over a defined observation period or a process metric being met. Only once it has been demonstrated that the cause has been eliminated is the CAPA considered effectively closed. ICH Q10 establishes this effectiveness assessment as part of the CAPA system.

What happens to open CAPAs during an inspection?

Overdue and inadequately documented CAPAs are among the most common findings in GMP inspections and notified body audits. A growing backlog is taken as an indication that the pharmaceutical quality system under EU GMP Guide Part I Chapter 1 is not controlling its own actions. What matters is risk-based prioritization, due dates that are met and defensible closures.

Does CAPA apply equally to pharmaceuticals and medical devices?

The principle is identical, but the regulatory anchoring differs. In the pharma and biotech environment, CAPA derives from ICH Q10, the EU GMP Guide Part I and 21 CFR Part 211. For medical devices and IVDs, ISO 13485:2016 Sections 8.5.2 and 8.5.3 apply, binding in the US via 21 CFR Part 820 (QMSR, incorporating ISO 13485:2016), embedded in the requirements of EU 2017/745 (MDR) and EU 2017/746 (IVDR).

How do you run CAPA management to GMP and ISO 13485 so that open CAPAs are closed out for good and every inspection is passed without an overdue backlog?

We build CAPA systems to ICH Q10, EU GMP and ISO 13485:2016: every action follows root-cause analysis, is implemented on schedule and verified for effectiveness. Without root-cause work, recurring deviations and a growing backlog of overdue CAPAs build up, and every inspector reads that as a weak quality system.

Request a CAPA Backlog Check

Overview

Why do CAPA systems fail in practice?

CAPA systems across GxP, from Pharma to medical devices · ICH Q10, EU GMP Guide Part I, 21 CFR Part 820 (QMSR), ISO 13485:2016

Last updated: September 18, 2026

A CAPA is not a form, but the mechanism by which a quality system learns from deviations. It is precisely at this learning step that most systems break down.

Treating symptoms instead of analyzing causes: if the root cause is not determined robustly, the action only corrects the symptom. The deviation returns, and ISO 13485:2016 Section 8.5.2, made binding for the US market by 21 CFR Part 820 (QMSR), explicitly requires that the cause of the nonconformity be determined and eliminated.
Overdue backlog: CAPAs that remain open beyond their planned due date are one of the most common inspection findings. A growing backlog shows that the pharmaceutical quality system under EU GMP Guide Part I Chapter 1 is not controlling its own actions.
Missing effectiveness verification: a CAPA is only considered effective once it has been demonstrated that the cause has been eliminated. If it is closed without an effectiveness check, the evidence that ICH Q10 expects as part of the CAPA system is missing.
No link to risk and trending: without a connection to quality risk management under ICH Q9(R1) and without trending of recurring deviations, every CAPA remains an isolated case rather than revealing systematic weaknesses.

Industries

What this means in your industry

PharmaBiotechMedTechIVD

Pharma

What applies: ICH Q10 requires a CAPA system, EU GMP Part I Chapters 1 and 8 anchor it. For the US market 21 CFR Part 211 applies.
Who audits: The GMP inspection by the competent authority (§ 64 AMG).

Biotech

What applies: As in pharma: ICH Q10 and EU GMP Part I Chapters 1 and 8.

MedTech

What applies: ISO 13485:2016 covers corrective action in Section 8.5.2 and preventive action in 8.5.3. The FDA adopts both via 21 CFR Part 820 (QMSR).
Who audits: Class IIa to III: the notified body. Class I: it is not or barely involved, there the competent authority acts (MDR Art. 93).

IVD

What applies: As for medical devices, only under the IVDR: the same Sections 8.5.2 and 8.5.3 of ISO 13485:2016.

Services

How we support you

CAPA System Design & Process Build

Building a CAPA process with defined triggers, escalation levels, responsibilities and risk assessment in line with ICH Q9(R1). Deliverable: an SOP for CAPA management including the decision logic for when a deviation triggers a CAPA and when a correction is sufficient.

Root-Cause Analysis & Problem Solving

Facilitated root-cause analysis using structured methods (5-Why, Ishikawa, Fault Tree). Deliverable: a documented root-cause analysis for each CAPA with a traceable link between the determined cause and the derived action in line with ISO 13485:2016 Section 8.5.2, which 21 CFR Part 820 (QMSR, incorporating ISO 13485:2016) makes binding for the US market.

CAPA Backlog Clearance

Review, risk prioritization and resolution of overdue and open CAPAs. Deliverable: a prioritized backlog list with status assessment, a closure plan and cleanly documented closures that withstand an inspection.

Effectiveness Verification & Trending

Definition of measurable effectiveness criteria and building a trending capability for recurring deviations. Deliverable: an effectiveness-check concept with acceptance criteria per CAPA, plus a trending report as input for the management review in line with ICH Q10.

Inspection Readiness for CAPA

Preparing the CAPA system for regulatory and notified body audits, including a mock review of open cases. Deliverable: a gap list of critical CAPAs and a defensible set of example cases for the inspection.

Learn more →

How we work together

Strategy Consulting

Clarity before action.

When clarity on strategy and priorities is missing: market entry, portfolio strategy, digitalization roadmap or regulatory realignment.

Hybrid Consulting

Think and do.

When direction and delivery power are needed at once: transformations, approval projects, market entry.

Operational Consulting

Your project. Our responsibility.

When capacity and expertise are missing: resource bottleneck, audit preparation or production ramp-up.

What it comes down to

A CAPA is only as good as the root-cause analysis it is based on. First the deviation is assessed on a risk basis in line with ICH Q9(R1), then the root cause is separated from symptom and trigger, and only after that are actions planned. Actions defined first correct the symptom and leave the cause in place.

The result is a recurring deviation that is linked to the first CAPA in the audit and turns two isolated cases into a systematic finding.

The critical point is effectiveness verification, not implementation. An action can be implemented quickly, but the evidence that the cause has actually been eliminated requires predefined acceptance criteria and an observation period.

The backlog arises when CAPAs that have been implemented but never verified for effectiveness with defensible evidence remain open and grow into the overdue inventory that ICH Q10 and the EU GMP Guide Part I read as a weakness of the quality system.

We therefore front-load the effort into root-cause analysis and the definition of measurable effectiveness criteria, because that is where every later closure becomes inexpensive instead of costly in the backlog.

Our approach

Step

Result

Problem Identification & Assessment

Deviation recorded, severity and CAPA need assessed on a risk basis in line with ICH Q9(R1), immediate action documented.

Root-Cause Analysis

Robustly determined root cause with a traceable methodology, separated from symptom and trigger.

Action Planning

Defined corrective and preventive actions with owners, due dates and a clear link to the determined cause.

Implementation

Actions implemented and documented on schedule, affected SOPs and training updated.

Effectiveness Verification

Effectiveness check passed against predefined acceptance criteria, CAPA closed with defensible evidence.

Trending & Review

Recurring causes made visible through trending, the result fed as input into the management review in line with ICH Q10.

Common pitfalls

Where projects commonly fail

The root cause is not separated from the symptom and the trigger.

An action that only corrects the observed symptom leaves the actual cause in place, and the deviation returns as a recurring case that every inspector links to the first CAPA.

CAPAs are closed without effectiveness verification.

A closure without a documented effectiveness check against predefined criteria satisfies neither the expectation of ICH Q10 nor the evidence obligation under ISO 13485:2016 Section 8.5.2, which 21 CFR Part 820 (QMSR) also makes binding for the US market, and is immediately apparent in an audit.

The backlog of overdue CAPAs is managed rather than reduced.

Constantly postponed due dates signal to the inspection that the quality system under EU GMP Guide Part I Chapter 1 is not controlling its own actions. Due dates are to be set on a risk basis and met, not extended.

Every deviation generates a CAPA.

Without decision logic for when a correction is sufficient and when a CAPA with root-cause analysis is required, the system grows under its own weight. ICH Q9(R1) provides the risk-based basis for this distinction.

CAPAs from different sources run separately.

Deviations, product quality complaints under EU GMP Guide Part I Chapter 8, audit findings and customer complaints all feed into the same CAPA system. If the strands remain disconnected, the trending that reveals systematic causes across individual cases is missing.

Quality Management & Compliance

Do any of these pitfalls apply to you?

In a first call we assess your situation and say what needs clarifying first in your case. Without obligation, reply usually within one working day.

Request a CAPA Backlog Check →

FAQ

Frequently asked questions

A correction eliminates the immediately identified nonconformity. A corrective action eliminates the cause of a nonconformity that has already occurred so that it does not recur. A preventive action eliminates the cause of a possible nonconformity that has not yet occurred. ISO 13485:2016 separates these in Sections 8.5.2 and 8.5.3. The umbrella term CAPA comes from the former 21 CFR 820.100; since 2 February 2026, 21 CFR Part 820 (QMSR) points to precisely these two sections of the standard.

Sources

ICH Q10, Pharmaceutical Quality System (Corrective Action and Preventive Action System)
ICH Q9(R1), Quality Risk Management
EU GMP Guide Part I, Chapter 1 and Chapter 8, primary text
21 CFR Part 820 (Quality Management System Regulation, QMSR, effective since 2 February 2026) & 21 CFR Part 211, primary text
ISO 13485:2016, Section 8.5.2 and 8.5.3, corrective and preventive actions

Image notice: The images on this page were generated using artificial intelligence. They do not depict real people, places, or events.

Life Science Journal

Regulatory updates, straight to your inbox.

New requirements, authority decisions and practice notes. Once a month, unsubscribe any time.

Case Studies

What this looks like in practice

All case studies →

Case StudyPharma

Audit Software Integration for Improved Production Quality under GMP

Compliance with GMP standards

An international software provider in the regulated life sciences environment needed a robust internal audit system to monitor production processes in line with GMP and reduce regulatory risk.

International software provider in the regulated life sciences environment

Case StudyPharma

Audit Support: Securing Reliable Audit Results

Dependable assessment

Provision of independent, experienced auditors to conduct audits to GMP and ISO standards, including report writing and CAPA follow-up.

Life sciences company with its own internal and external value chain

Quality Agreements With Critical Suppliers

A quality agreement is not an extended purchase order. It is the operating interface between two quality management systems. Which audit, change and cost rules it has to carry so that it gives a clear answer when it matters.