Correction, corrective action and preventive action
These terms are often mixed up, and the difference between them is the point of CAPA. The definitions follow ISO 9000 usage. The example is a run of enclosures with cracked snap clips.
| Term | What it does | Example |
|---|---|---|
| Correction | Fixes the detected nonconformity | Sort the stock and replace cracked parts |
| Corrective action | Removes the cause of a problem that has happened, so it does not recur | Tighten resin drying control after confirming that under-dried material made the clips brittle |
| Preventive action | Removes the cause of a potential problem before it happens | Apply the same drying control to other parts molded from moisture-sensitive resins |
A factory that only makes corrections will keep finding the same defects. The cost shows up as sorting, rework, delays and escapes rather than as improvement.
How a CAPA process works
- Trigger. A nonconformity from incoming inspection, line testing, outgoing inspection, a customer complaint, a field return or an audit.
- Record. Logged with an ID, owner, date and severity, so nothing depends on memory or email threads.
- Contain and correct. Protect the customer first: quarantine, sort, rework.
- Investigate. Find and verify the root cause, including why the problem was not detected.
- Plan and implement. Actions with owners and due dates, and updates to work instructions, control plans and FMEA.
- Verify effectiveness. Show with data that the problem has not come back.
- Close. Only after effectiveness is verified.
For a significant problem, the investigation is often written up as an 8D report. CAPA is the system that tracks all of them, including small internal issues no customer sees.
What a CAPA record should contain
Whether the factory uses a database, a spreadsheet or paper, each record should show:
- ID, source of the problem, date opened and owner
- Product, part numbers and lots affected
- Severity, which sets how fast the CAPA must move
- Containment taken and its result
- Verified root cause, for both occurrence and escape
- Actions, each with an owner and due date
- The effectiveness criterion agreed in advance, and the result
- Closure date and who approved it
A record missing the last two items is a task list, not a CAPA.
Where CAPA systems usually fail
A frequent weakness is closing a CAPA when the action is done rather than when it is shown to work. “New fixture installed” is an action. “No recurrence in the next ten lots, against two failures per lot before” is evidence. Agree in advance what effectiveness check is required.
Other weaknesses to look for:
- Root causes that stop at “operator error” or “material defect” without asking why
- CAPAs open for months without escalation
- Fixes applied to one product but never checked on similar products
- No link to change control, so corrective changes reach production without review under the engineering change process
Standards and the “preventive” part
In ISO 9001, corrective action sits in clause 10.2, “Nonconformity and corrective action”. Prevention is expected to come from how the factory identifies and acts on risks, so ask what it does with them: whether process FMEAs are updated after a failure, and whether lessons from one product reach the design and process reviews of the next. ISO 9001 was revised in 2026, and certified sites move from the 2015 edition over a transition period, so check which edition a certificate refers to.
Medical devices are stricter. ISO 13485:2016 requires documented corrective action (clause 8.5.2) and preventive action (clause 8.5.3), and in the US, the FDA’s Quality Management System Regulation (QMSR), which replaced the old Quality System Regulation on February 2, 2026, incorporates ISO 13485 by reference. For a regulated digital health product, a supplier’s CAPA system is part of your own regulatory exposure and needs specialist review.
What to ask a supplier
- The CAPA log for the last 12 months: how many opened, closed and overdue
- A walk-through of two or three closed CAPAs, including the effectiveness evidence
- How customer complaints, line failures and audit findings enter the system
- How corrective actions trigger a change review
These are standard questions in a factory audit, and the answers say more about a supplier’s quality than its certificates do.
Where Zefinity helps
QA and corrective action follow-up, making sure corrective actions on your product are closed on evidence rather than paperwork, is part of Zefinity’s Launch service.
Frequently asked questions
What is a SCAR, and how does it relate to CAPA?
A SCAR, or supplier corrective action request, is a formal request from a buyer asking a supplier to investigate a problem and correct it. It normally opens a record in the supplier's CAPA system, and the answer often comes back as an 8D report. Keep your own log of SCARs as well: date issued, response due, and the evidence you need before you accept closure.
Does ISO 9001 still require preventive action?
Not as a separate procedure. Since the 2015 edition, ISO 9001 has required corrective action and handled prevention through risk-based thinking across the quality system instead of a dedicated preventive action clause. A certified factory may therefore have no formal preventive action procedure, which is not a gap in itself. ISO 13485 for medical devices still requires both.
When should a CAPA be closed?
When there is evidence that the action worked, not when the action was completed. Agree the effectiveness check in advance, such as a number of lots without recurrence, a period of production or a yield level, and close the CAPA only when the data meets it. For a problem on your product, closure should need your approval as well as the factory's.