Corrective and Preventive Action (CAPA) is a key process within a pharmaceutical quality management system. It is the process of identifying and documenting corrections and improvements to systems and processes to reduce the risk of a deviation, non-conformance or quality issue occurring or recurring (hereafter referred to as an ‘issue’).

A CAPA record must include all the necessary details, otherwise it may be considered inadequate, inappropriate, or lacking, and may therefore not achieve the intended outcome of eliminating the cause of the issue.

In turn, the regulator may not be satisfied that the company can produce quality products that comply with all quality and regulatory rules. Recent FDA warning letters indicate that companies have failed to use their CAPA system appropriately (https://www.pharmout.net/services/gmp-consulting/fda-483-inspections-citations/) and have made the following findings:

The CAPA had no due date or actions were not completed promptly
The CAPA was inadequate
The CAPA was inappropriate

The FDA has proceeded to warn companies that their failure to comply may result in legal action including, but not limited to, seizure, injunction, and civil money penalties.

A company could go out of business if they do not have a good CAPA procedure and do not prioritise closing CAPAs.

The importance of a good CAPA procedure and training

The CAPA procedure must include a detailed description of the information required as there are several steps to take and carefully document before a CAPA can be closed. The procedure should detail what information is required to initiate, classify (Critical, Major, Minor), investigate, risk assess, justify, communicate, implement, approve, close, trend, review and document the CAPA.

The CAPA procedure must also assign responsibilities for the various steps. For example, who is the CAPA owner and who is accountable to complete the required steps, implement actions, review, follow-up and close-out?

For the CAPA procedure to work, there must then be enough employees trained in the process and resources allocated to manage the CAPA system. The training should include:

how to initiate and complete the CAPA form
how to scope and perform a root cause investigation (RCA).
both operational staff and subject matter experts to ensure that staff with sufficient experience handle CAPAs.
a method to demonstrate that the assigned staff are competent in the CAPA process.

CAPA timeframes

It’s expected that a CAPA has a date assigned for the closure of the CAPA. PIC/S PE009-15, Part I, which was recently adopted in Australia, states that “the decisions that are made during and following quality defect investigations should…. be timely” and in ISO13485 that corrections should be completed “without undue delay”.

Beyond that, the timeframe is not described and this must be defined in the CAPA procedure. The timeframe should consider the:

criticality of the issue,
potential for the issue to affect future batches,
complexity of the action(s),
overall impact on the company.

In relation to regulatory audit findings, the FDA has stated in warning letters that companies must “correct any violations promptly” and that they may re-inspect to verify that companies have completed corrective actions to address violations. The FDA expects a response to a warning letter within 15 days, and if actions are not completed within that timeframe, reasons for the delay must be stated and a schedule for completing the actions must be provided.

Is the CAPA appropriate and adequate?

Recent FDA warning letters show that, in some cases, the CAPA raised by a company did not adequately investigate or address the issue and covered only one batch where it was clear that it should have been expanded to more batches and other products.

In another example, the FDA found that the CAPA was not appropriate as it did not consider that changes were required to ensure that no further product was manufactured with the non-conformance. There are examples of CAPAs where the scope of the CAPA and investigation was limited and not justified, no risk assessment was performed, or the root cause was too narrow.

Did you find the root cause?

PIC/S PE 009-15 Guide to Good Manufacturing Practice for Medicinal Products, Part I states:

“An appropriate level of root cause analysis should be applied during the investigation of deviations, suspected product defects and other problem”

“ … appropriate CAPAs should be identified and taken in response to investigations”

“The effectiveness of such actions should be monitored and addressed in line with QRM principles”.

Consequently, it’s important to perform a robust root cause investigation (RCA). There are numerous tools available to help with RCA including 5W/2H, 5 WHY tool, fishbone diagram and brainstorming (see e.g. ispe-pda-guide-to-improving-quality-culture.pdf).

If a true root cause cannot be established, it’s acceptable to document the most probable root cause(s) and scope the CAPA based on this.

Corrective and Preventive Action raised as a result of an audit finding

If a CAPA is raised in response to an audit or inspection finding, the same criticality should be assigned to the CAPA as was assigned to the audit finding. That is, if the audit finding was classified as major, then the CAPA classification should also be major.

Also consider if one or more CAPAs are required, and which regulatory clauses are applicable. For example, if the finding is broad and affects more departments and processes, it may be an idea to raise more than one CAPA for the finding. The CAPAs should be linked and the plan for investigation of the various areas clearly outlined.

Need help with your Quality Management System (QMS)? PharmOut has experienced industry professionals who can assist you writing your SOPs or managing your QMS project, contact us to discuss.

CAPA raised as a result of an audit finding

The important final steps before closing the CAPA

Identifying that a CAPA is required and initiating the CAPA form are the first important steps in the CAPA process. However, all steps involved in the CAPA process are important, and it’s equally important that the CAPA is closed before the due date, or an extension is otherwise justified. If an extension is sought, it should be carefully documented and justified – ideally this should not be done for CAPAs raised after an inspection, unless specifically agreed with the inspector.

It takes time and resources to close a CAPA.

Someone needs to monitor and regularly follow up on actions.
Completed actions need to be reviewed to ensure that all implementation actions were completed and match the actions documented in the CAPA.
The CAPA record needs to be checked for completion and may have to go back and forward for correction, and ensure all actions are verified (i.e., reference to the document, attaching a copy to the CAPA record).
The CAPA need to be approved by Quality department before closure.
There may be some administrative tasks to complete (updating the tracking register and trending, etc).
An effectiveness review is also required, to demonstrate that the CAPA was effective.

Is the CAPA effective?

Once the CAPA is complete, a good effectiveness check should demonstrate that the CAPA did in fact achieve what was intended. It should be clear:

who is doing this check,
what will be checked,
where will the data/information be recorded and tracked,
when will the data/information be checked,
if the data qualitative or quantitative data,
who will gather the data/information,
how the data/information gathered will be used to determine the effectiveness,
if further action is required,
how will the outcome be communicated to the right people?

Review the company’s CAPA procedure

So, how can you demonstrate that a CAPA will satisfy the requirements of a significant finding during a regulatory audit? It may be time to review your CAPA procedure.

Below are listed some specific considerations to address the recent FDA warnings about CAPA:

Conclusion

FDA has raised concerns that companies are failing to close CAPAs as promised, and that the CAPAs raised are inadequate and/or inappropriate. It may be time to review your CAPA procedure, and associated tools and forms, to make sure every detail is covered. Also review who is responsible for what, how many staff are involved with the CAPA process and their training and competency in the process.