CAPA Closure: Review Criteria and Approval Checklist
A complete pharmaceutical guide to deciding whether a corrective and preventive action is genuinely ready for closure, supported by complete investigation, implemented controls, effectiveness evidence, residual-risk acceptance, traceable records, and independent Quality approval.
When can a pharmaceutical CAPA be closed?
A pharmaceutical CAPA can be closed when its investigation and scope are complete, causes are evidence-supported, approved actions are implemented and verified, effectiveness criteria are satisfactorily met, linked product and quality-system records are resolved, residual risk is accepted, no critical commitment remains open, and an authorized Quality reviewer documents an independent, traceable approval.
The final quality decision
What CAPA closure means in pharmaceutical manufacturing
CAPA closure is the documented conclusion that the approved response has addressed the defined quality problem to an acceptable, evidence-supported state. It confirms completeness of the investigation and action lifecycle while transferring any justified continuing surveillance into controlled routine systems.
Facts are complete
The event history, batch and product impact, investigation scope, cause evaluation, risk, decisions, linked records, and action evidence form one coherent and reconstructable story.
Controls are established
Approved actions are not only marked complete; they are released, qualified or validated where required, used in routine work, and supported by objective implementation evidence.
Assurance is sufficient
Effectiveness results, residual-risk review, recurrence search, trend data, and unintended-effect assessment support closure at the level of rigor appropriate to patient and product risk.
Avoid ambiguous status labels
Action completion, implementation closure, effectiveness, and final CAPA closure
| Status | Question answered | Required evidence | What remains open |
|---|---|---|---|
| Action completed | Was the assigned deliverable finished? | Approved SOP, work order, software release, training record, validation report, supplier agreement, revised master record, or installed equipment. | Correct adoption, performance, sustainability, effectiveness, residual risk, and final Quality decision. |
| Implementation verified | Is the action approved, available, qualified where needed, correctly configured, and used as intended? | Field verification, system challenge, competency check, document issuance, configuration review, change-control completion, and release authorization. | Representative evidence that the original failure pathway and risk have actually improved. |
| Effectiveness evaluated | Did the action achieve predefined criteria under representative conditions without unacceptable new effects? | Leading and lagging metrics, sampled records, trend analysis, challenge results, recurrence review, process capability, and deviation/complaint data. | Residual-risk acceptance, complete dossier, governance review, and final approval. |
| CAPA closed | Is the entire record complete, scientifically justified, effective, traceable, and approved? | Criterion-by-criterion closure assessment, linked-record reconciliation, risk conclusion, approval signatures, closure date, and ongoing-monitoring transfer. | Only routine lifecycle monitoring and event-driven reopening triggers defined by the quality system. |
Regulatory and quality-system basis
Regulatory expectations that shape CAPA closure
Regulations and guidelines do not provide one universal closure form. Together, however, they establish the elements a defensible closure system should control: investigation, conclusions, follow-up, effectiveness, risk review, records, Quality oversight, and management visibility.
ICH Q10
ICH Q10 expects a structured, risk-proportionate investigation and CAPA system, evaluation of CAPA effectiveness, monitoring of process performance and product quality, assessment of changes for intended results and adverse effects, and management review of CAPA-related effectiveness.
ICH Q9(R1)
Quality-risk decisions should be science-based, linked to patient protection, proportionate in formality, transparent, and reviewable. New knowledge, audits, change controls, reviews, recalls, or investigation findings can require reconsideration after an earlier risk decision.
EU GMP Chapter 1
EU GMP expects appropriate CAPA after investigation and requires action effectiveness to be monitored and assessed using Quality Risk Management principles. It also expects management review and scrutiny of process or system causes before attributing failure to human error.
FDA and 21 CFR
FDA’s quality-systems model links corrective action to root-cause investigation, defined timeframes, documented action, and effectiveness evaluation. 21 CFR 211.192 requires thorough investigation, extension to associated batches and products, and a written record containing conclusions and follow-up.
Twelve evidence gates
CAPA closure review criteria
A mature closure review tests each part of the lifecycle. Passing one gate cannot compensate for a critical failure in another; an excellent effectiveness trend does not cure an unsupported root cause, and complete paperwork does not cure an unimplemented control.
Build one coherent evidence package
Documents required for CAPA closure
| Closure dossier component | Minimum content | Quality-review question |
|---|---|---|
| Initiation and triage | Source record, event date, detection point, initial classification, immediate actions, reporting assessment, and CAPA rationale. | Was the issue prioritized and controlled according to its actual or potential consequence? |
| Investigation report | Problem statement, chronology, scope, data sources, interviews, batch and system review, hypotheses, evidence testing, cause conclusion, and limitations. | Could another competent reviewer reproduce the reasoning from the evidence? |
| Impact and risk assessment | Patient, product, process, data, compliance, supply, and distributed-product impact; initial and residual risk; assumptions and uncertainty. | Were associated products and failure pathways considered, and is residual risk acceptable? |
| CAPA plan | Action-to-cause mapping, deliverables, owners, due dates, dependencies, interim controls, change route, effectiveness plan, and escalation rules. | Does each action control a verified cause or relevant systemic weakness? |
| Implementation package | Approved procedures, change control, qualification/validation, software or engineering release, training and competency, supplier confirmation, and field verification. | Is the permanent control active in the actual operating environment? |
| Effectiveness report | Approved protocol, baseline, criteria, population, sample selection, duration, raw-data references, analyses, deviations, results, and conclusion. | Does the evidence support effectiveness without retrospective criteria or selective data? |
| Linked-record index | Record numbers, titles, statuses, owners, versions, closure dates, and explanation for any item remaining under controlled monitoring. | Do related quality-system records tell the same story and contain no unresolved contradiction? |
| Closure assessment | Criterion-by-criterion decision, recurrence search, open-item review, unintended effects, residual risk, lessons learned, ongoing monitoring, and final recommendation. | Is the recommendation proportionate, traceable, and defensible? |
| Approval record | Names, roles, signatures, dates, electronic audit trail, comments, rejected cycles, conflict-of-interest control, and final closure date. | Did authorized roles approve after the complete evidence became available? |
Closure starts with a sound investigation
Investigation and root-cause criteria before closure
A CAPA cannot compensate for a weak investigation. Before closure, the reviewer should confirm that the cause statement explains the observed facts, the scope follows the failure mechanism, and alternative explanations were tested rather than dismissed.
Scope is evidence-based
- Potentially related batches and products are identified
- The review period covers when the causal condition existed
- Other lines, sites, methods, users, suppliers, and systems are considered
- Distributed product and complaint history are assessed
- Exclusions have technical justification
- New evidence triggered appropriate scope expansion
Cause is demonstrated
- The cause is a controllable mechanism, not a symptom
- Evidence supports necessary and contributing conditions
- Contradictory evidence is resolved transparently
- Human error is not used to hide design or system weakness
- The cause explains timing, location, and recurrence pattern
- Uncertainty is stated where evidence cannot be conclusive
Verify action quality, not activity count
Corrective and preventive action criteria before closure
Cause coverage
Every verified root and material contributing cause is addressed or has an approved, risk-based rationale. Systemic exposure is considered across related products and processes.
Control strength
Elimination, simplification, engineering, automation, interlocks, and design controls are considered before relying mainly on warnings, signatures, retraining, or inspection.
Implementation governance
Actions were routed through applicable change control, validation, document, training, supplier, regulatory, computerized-system, and engineering processes.
Field verification
The control is present and works where the task occurs, including applicable shifts, equipment, products, users, exceptions, interfaces, and worst-case conditions.
Questions for each action item
- Which specific cause or risk does this action control?
- Is the final deliverable identical to the approved action, or was a change authorized?
- Was the action implemented by the assigned owner within the approved timeframe?
- Are prerequisite actions and dependencies complete?
- Were qualification, validation, verification, or regulatory assessment requirements met?
- Were procedures, master data, specifications, records, drawings, and training updated consistently?
- Were obsolete documents, settings, materials, permissions, and workarounds removed?
- Does objective evidence show the control is being used rather than merely available?
- Were deviations during implementation investigated and assessed for impact?
- Did the action introduce any new product, process, data, human-factor, or supply risk?
A required closure input
Effectiveness evidence required for CAPA closure
The closure reviewer should be able to see what success meant before results were known, why the evidence represents the risk, and whether the action remained effective long enough to support the conclusion.
| Review area | Acceptable evidence | Warning sign |
|---|---|---|
| Prospective criteria | Metrics, thresholds, sample, duration, failure rules, and adverse-effect criteria approved before data review. | Criteria created or relaxed after the result was known. |
| Implementation maturity | The action was fully released, users competent, transition complete, and stabilization period justified before counting evidence. | Pre-implementation or mixed-state data are presented as post-CAPA performance. |
| Representative coverage | Relevant lines, shifts, products, strengths, methods, users, suppliers, campaign stages, and worst cases are included. | Only convenient daytime records or best-performing cases are selected. |
| Control performance | Challenge tests, adherence, alarms, interlocks, reviews, system logs, or process measures show that the action mechanism works. | Only an approved document or training-completion percentage is cited. |
| Outcome and recurrence | Rates use meaningful denominators; deviations, OOS/OOT, complaints, rejects, audit findings, and escapes are evaluated. | “No recurrence” is claimed despite little or no exposure. |
| Sustainability | The monitoring window covers adequate production and time, including drift, turnover, maintenance, changeover, or seasonal risk where relevant. | A short successful period is extrapolated indefinitely. |
| Data reliability | Population, selection, exclusions, raw evidence, query logic, calculations, and independent review are traceable. | Unfavorable observations, missing records, or exclusions are unexplained. |
| Final conclusion | Each criterion is addressed as met, not met, or inconclusive; uncertainty, residual risk, and ongoing monitoring are documented. | A generic “CAPA effective” checkbox replaces analysis. |
For a detailed protocol design, use the companion guide on CAPA effectiveness checks. The essential closure point is simple: a completed action with an ineffective, failed, or materially inconclusive result is not ready for final closure.
Decide what remains after action
Residual-risk assessment at CAPA closure
Residual risk is the risk remaining after verified controls operate. It should be evaluated using current evidence—not merely by copying the initial risk assessment and lowering occurrence or detection scores because an action was planned.
Assess the controlled state
Describe the implemented control, actual performance, remaining failure pathways, detection capability, population exposed, uncertainties, and the consequence if the control fails.
Check unintended effects
Determine whether the action shifts error downstream, creates a new mix-up route, masks a signal, increases data or ergonomic risk, affects yield, changes regulatory commitments, or burdens supply.
Authorize acceptance
Apply approved acceptance criteria and escalation rules. High-severity or uncertain residual risk may require senior Quality, medical, regulatory, technical, or management review and continuing control.
Not every unfinished item is equivalent
Can a CAPA close with open actions or monitoring?
Final closure normally means that all required CAPA actions and the approved effectiveness evaluation are complete. A site procedure may allow genuinely administrative or routine-monitoring activities to continue outside the CAPA only when the risk is controlled, ownership remains traceable, transfer is approved, and failure of the remaining task cannot undermine the closure conclusion.
| Remaining item | Closure position | Required control |
|---|---|---|
| Permanent action addressing a root cause | Keep the CAPA open. A planned or partly installed critical control cannot support final closure. | Maintain interim controls, due-date oversight, escalation, risk review, and verified completion. |
| Required validation, qualification, or regulatory approval | Keep open when the CAPA relies on the result or approval to establish control. | Track within the governing system, define dependencies, and prevent premature use or unsupported claims. |
| Effectiveness check not yet mature | Overall CAPA remains controlled and not finally closed, even if implementation tasks are complete. | Use a distinct implementation-complete status, approved monitoring plan, due date, accountable owner, and automatic escalation. |
| Routine monitoring after criteria were met | Closure may be appropriate if the approved effectiveness check is complete and residual risk is acceptable. | Transfer the metric, frequency, alert/action limits, owner, records, and reopening triggers to a routine process such as APR/PQR or management review. |
| Low-risk administrative housekeeping | Potentially transferable only if it has no bearing on implementation, effectiveness, compliance, or risk acceptance. | Document rationale, linked tracking number, owner, due date, and Quality approval; avoid using transfer to improve closure metrics. |
| Related systemic improvement beyond the original risk | May be managed in a separate approved program if the original CAPA is effective and adequately controlled. | Define interface, scope, governance, resources, milestones, and conditions that would require reopening the CAPA. |
Due dates are governance controls
Overdue CAPA, extensions, and closure pressure
A due-date extension should preserve patient and product protection while allowing necessary work—not retrospectively normalize delay. The request should be made before expiry where possible and approved by roles authorized in the procedure.
Extension package
- Current status and deliverables already completed
- Specific reason for delay and whether it was foreseeable
- Updated risk assessment based on current knowledge
- Effectiveness of interim controls and product-status review
- Impact on distributed product, commitments, and related records
- New realistic date, milestones, resources, and accountable owner
- Escalation level and approval obtained before the extension
System-level oversight
- Trend extensions by department, cause, action type, and risk
- Distinguish justified technical delay from weak planning
- Escalate repeated extensions and resource constraints
- Review aged CAPAs in management review
- Assess whether closure targets create poor-quality investigations
- Prevent due-date changes without audit trail or reason
- Use recurring delay as a quality-system improvement signal
New evidence changes the decision
What to do when effectiveness fails before closure
Contain and assess
Control current operations, identify potentially affected material and distributed product, assess reporting or recall implications, and determine whether the failed control changes prior batch or product decisions.
Reopen the reasoning
Determine whether the cause was wrong or incomplete, the action did not address the cause, implementation was weak, the measurement plan was incapable, or a new failure mechanism appeared.
Govern new action
Reopen or link CAPA according to procedure, revise risk and scope, preserve failed evidence, approve additional controls, establish new prospective criteria, and escalate systemic or repeated failure.
Separate ownership from approval
CAPA closure roles and approval responsibilities
CAPA owner
Compiles the dossier, confirms action and dependency status, explains changes and delays, links source records, assesses lessons learned, and makes a supported closure recommendation.
Process owner
Confirms that controls operate in routine practice, procedures and records align, resources are sustained, relevant personnel are competent, and ongoing monitoring has an accountable home.
Subject-matter experts
Evaluate technical adequacy, validation, statistical analysis, medical or toxicological impact, regulatory commitments, computerized systems, engineering controls, supplier evidence, or product science.
Quality reviewer
Independently challenges the investigation, action-to-cause logic, scope, effectiveness, data integrity, linked records, open items, residual risk, and compliance with the approved procedure.
Quality approver
Accepts, rejects, or returns the closure; records conditions and rationale; confirms required escalation; and supplies the authorized electronic or handwritten approval and effective closure date.
Management governance
Reviews high-risk, overdue, repeat, cross-site, resource-constrained, or ineffective CAPAs; ensures systemic lessons and adequate resources; and monitors closure quality, not only closure speed.
From owner submission to controlled close
Step-by-step CAPA closure workflow
Confirm closure status and procedure
Identify whether the request is for action completion, implementation completion, effectiveness completion, or final CAPA closure and apply the correct approved workflow.
Output: unambiguous review scopeReconstruct the CAPA chronology
Verify dates, detection, containment, investigation, decisions, approvals, extensions, action implementation, effectiveness windows, and linked-record sequence.
Output: complete lifecycle timelineVerify investigation and scope
Confirm that affected and potentially associated products, batches, systems, sites, suppliers, methods, data, and time periods were scientifically assessed.
Output: justified investigation boundaryChallenge cause conclusions
Check evidence for root and contributing causes, alternative hypotheses, contradictions, uncertainty, human-factor claims, and the explanatory fit to observed facts.
Output: supportable causal modelMap actions to causes and risks
Confirm that every material cause is controlled, action strength is proportionate, systemic scope is addressed, and no required action was silently deleted or transferred.
Output: complete cause–action coverageVerify implementation in the field
Review approved deliverables, change control, qualification or validation, document release, training and competency, configuration, obsolete-item removal, and routine use.
Output: objective implementation proofEvaluate effectiveness evidence
Compare prospective criteria with representative, reliable results; review recurrence, trends, control performance, duration, protocol deviations, and adverse effects.
Output: met, not met, or inconclusiveReconcile product and linked records
Confirm material disposition, batch impact, distributed status, complaints, OOS/OOT, deviations, changes, validations, training, supplier, audit, regulatory, and recall records.
Output: consistent quality-system recordAssess open items and overdue history
Determine whether any unfinished activity can undermine control; review extensions, interim measures, missed milestones, repeated delays, and inappropriate administrative transfer.
Output: no hidden closure blockerEvaluate residual and new risk
Use current evidence to assess remaining failure pathways, control dependency, uncertainty, unintended consequences, acceptance authority, and continuing monitoring.
Output: authorized risk conclusionWrite the closure conclusion
Address each criterion, evidence reference, limitation, exception, effectiveness outcome, residual risk, lesson, monitoring commitment, and rationale for the recommended disposition.
Output: traceable closure assessmentApprove, return, hold, or escalate
The authorized Quality approver records the decision and date. Rejected or conditional submissions return with defined deficiencies, owner, due date, and escalation where needed.
Output: controlled final dispositionSee what “ready” looks like
Pharmaceutical CAPA closure examples
These examples show the type of evidence that can support closure and the findings that should keep the record open. The precise criteria must follow the approved site procedure, product knowledge, regulatory commitments, and quality-risk assessment.
| CAPA scenario | Evidence supporting closure | Closure blocker |
|---|---|---|
| Wrong printed component detected during packaging | Scope covers potentially affected orders and similar components; product disposition is approved; barcode interlock is validated across configurations; master data and line procedures are controlled; representative orders and challenge tests meet prospective effectiveness criteria; no unauthorized override or recurrence appears. | Only retraining was completed, barcode verification remains pending, distributed-product impact is unresolved, or the effectiveness review excludes night shift and similar labels. |
| Repeated tablet-weight deviation | Feeder-response cause is supported by time-linked process data; refill method and automation are qualified; parameter changes pass change control; all presses and shifts are represented; reject rate and control-chart behavior improve against baseline without adverse hardness, friability, assay, or yield impact. | Three handpicked batches passed, but no refill-window data, statistical comparison, worst-case load, or evaluation of related tablet products is available. |
| Cleaning residue above acceptance limit | Product and equipment scope includes worst-case residues and locations; cleaning instruction, tools, disassembly, and sampling map are updated; validation covers dirty/clean hold time and operator variation; results meet limits without unfavorable trend; cross-contamination and material disposition are resolved. | A repeat sample passed after re-cleaning, but the original cause, affected equipment, prior batches, sampling recovery, or routine cleaning capability remains unresolved. |
| Laboratory transcription error | Data-flow mapping identifies manual transfer risk; a validated interface or controlled second-person verification is implemented; access, units, decimals, audit trail, exceptions, and failed-transfer handling are tested; sampled records and all exceptions meet criteria; related OOS and batch decisions are reassessed. | The analyst was retrained but the same manual pathway remains, the audit trail was not reviewed, or potentially affected historical results were not scoped. |
| Supplier raw-material variability | Supplier investigation supports a process cause; quality agreement, notification, specification, controls, and incoming strategy are approved; qualified lots span relevant campaigns or seasons; incoming attributes and manufacturing performance meet criteria; no material-related reject or adverse trend remains. | The supplier CAPA is accepted without objective verification, only one lot was received, technical-agreement changes are unsigned, or internal manufacturing impact remains open. |
| Computerized-system excessive privilege | Role design, independent master-data approval, leaver transfer, periodic review, audit-trail alerting, and prohibited-action challenges are validated; historical critical changes are assessed; all current accounts are reconciled; monitoring completes one justified access-review cycle with no unauthorized action. | Access is changed in production but validation, historical impact, service accounts, interface permissions, contractors, or audit-trail review remain incomplete. |
| Environmental-monitoring excursion in aseptic area | Organism, location, intervention, facility, personnel, airflow, cleaning, batch, and adjacent-area scope are evaluated; material disposition and sterility assurance decisions are approved; causal facility or practice controls are qualified; monitoring demonstrates control across relevant operations and conditions. | Repeat plates are acceptable but no scientific root cause, batch-impact assessment, contamination-control strategy review, or sustained monitoring is available. |
| Documentation omission during line clearance | Human-factors review identifies ambiguous handoff and form design; workflow is simplified, responsibilities clarified, and a forced verification introduced; competence is demonstrated in scenarios; stratified observation and omission rates meet criteria without hidden backlog or workaround. | Read-and-understand training is the sole action, the form remains ambiguous, or closure relies on signatures rather than observed correct performance. |
Control responsibilities beyond one department
Multi-site, supplier, and contract-manufacturer CAPA closure
Outsourcing an action does not outsource accountability. The final record should show which organization owns the investigation, action, technical evidence, product decision, regulatory communication, effectiveness data, and closure approval.
Global and local scope
Determine whether the cause, platform, supplier, method, equipment, document, software, or control exists at other sites. Record applicability assessments and the rationale for included and excluded locations.
Quality agreements
Confirm notification, investigation, change, deviation, data-access, sample, audit, effectiveness, record-retention, and approval responsibilities align with the executed agreement and marketing authorization.
Direct evidence
Do not close solely on an external statement that action is complete. Obtain sufficient controlled evidence, technical assessment, on-site or remote verification, batch performance, audit data, or effectiveness results appropriate to risk.
Convert evidence into disposition
CAPA closure decision matrix
| Decision | When it applies | Required next step |
|---|---|---|
| Approve final closure | All mandatory criteria are met, effectiveness is satisfactory, evidence is reliable, linked records are resolved, no critical open item remains, residual risk is acceptable, and ongoing controls are owned. | Record the criterion-by-criterion conclusion, authorized approval, closure date, monitoring transfer, lessons learned, and communication. |
| Return for correction | The underlying work may be adequate, but the dossier has correctable gaps such as missing reference, unsigned attachment, unclear calculation, or incomplete narrative that does not change risk. | Identify each deficiency, responsible person, due date, and required evidence; retain the review trail and repeat approval after correction. |
| Hold open | Required action, representative effectiveness data, necessary duration, validation, external evidence, product decision, or linked investigation is legitimately incomplete. | Maintain interim control, current risk review, accountable owner, justified date, escalation, and visible open status. |
| Escalate / reopen | Effectiveness failed, recurrence occurred, scope expanded, cause is unsupported, new risk emerged, product impact changed, data integrity is questioned, or repeated delay signals a systemic problem. | Contain, assess impact, initiate or reopen investigation/CAPA, revise actions and risk, consider reporting or recall obligations, and obtain governance oversight. |
| Close and transfer routine monitoring | Approved effectiveness criteria are met and residual risk is acceptable, but normal lifecycle monitoring should continue through APR/PQR, CPV, audit, complaint, supplier, or management-review systems. | Define metric, source, frequency, limits, owner, record, escalation, and reopening trigger in the receiving controlled process. |
Interactive educational tool
CAPA closure readiness decision tool
Select the current status of eight mandatory closure gates. The tool provides a conservative screening result for training and review preparation. It does not approve a real CAPA or replace the site procedure, scientific assessment, electronic workflow, or authorized Quality decision.
Ready-to-use final review
CAPA closure approval checklist
- The source event, requirement, risk, and reason for CAPA are clearly identified
- Immediate containment and correction protected product and process while permanent action was developed
- Affected batches, products, markets, systems, equipment, methods, suppliers, sites, and periods were assessed
- Distributed-product, reporting, recall, shortage, medical, and regulatory implications were resolved where applicable
- The investigation chronology, evidence, interviews, testing, hypotheses, and limitations are complete
- Root and contributing causes are mechanisms supported by facts rather than restated failures
- Human-error conclusions include evaluation of process, procedure, system, design, and organizational factors
- Initial and updated risk assessments are scientifically justified and proportionate to patient protection
- Every material cause has an approved action or a documented, authorized rationale
- Actions favor robust prevention and system improvement over weak reminders or training alone
- Action owners, due dates, changes, extensions, dependencies, and interim controls remain traceable
- All required actions are actually complete; none was transferred only to improve closure status
- Change control, validation, qualification, regulatory, supplier, engineering, and computerized-system requirements are complete
- Revised documents, master data, specifications, methods, records, drawings, and training are consistent
- Obsolete documents, access, settings, components, labels, tools, and workarounds were removed or controlled
- Implementation was verified in representative routine and worst-case conditions
- Effectiveness criteria were approved before results were reviewed
- Effectiveness evidence covers a justified population, sample, exposure, duration, and relevant variation
- Recurrence, related events, complaints, deviations, OOS/OOT, rejects, audit findings, and adverse trends were reviewed
- Unintended consequences and new failure pathways introduced by the action were assessed
- Product disposition and every linked quality-system record are complete and mutually consistent
- Raw evidence, metadata, calculations, attachments, exclusions, and review follow ALCOA+ principles
- Residual risk is based on implemented controls and actual evidence, not only planned score reduction
- Residual-risk acceptance and escalation have the required technical, Quality, medical, regulatory, or management approval
- Routine monitoring has a defined metric, source, frequency, owner, limit, record, and reopening trigger
- Lessons learned and potentially applicable systemic improvements were communicated to relevant functions or sites
- The closure conclusion addresses every criterion, limitation, deviation, and unresolved uncertainty
- The CAPA owner and process owner completed their attestations without replacing independent Quality review
- The authorized Quality approver signed and dated the final decision after all evidence was available
- The electronic audit trail or paper record preserves prior review cycles, comments, corrections, and final status
Make the decision reconstructable
CAPA closure documentation and ALCOA+
The closure record should preserve both favorable and unfavorable evidence. It should show what information existed at the time of approval, who performed each review, what changed during review, and why the authorized approver accepted the final state.
Data integrity expectations
- Attributable: identify originator, collector, calculator, reviewer, approver, and change author
- Legible: retain readable records, units, legends, context, and attachments
- Contemporaneous: record activities, observations, signatures, and decisions when performed
- Original: preserve source data or verified true copies with metadata
- Accurate: verify transcriptions, queries, classifications, formulas, and reconciliations
- Plus: maintain complete, consistent, enduring, and available evidence
Electronic workflow controls
- Role-based permission for drafting, review, approval, rejection, extension, and closure
- Secure signatures linked to the record and meaning of the signature
- Date/time, version, status, comment, and reason captured in the audit trail
- Mandatory fields and dependency logic that prevent premature closure
- Controlled reopening with reason, impact assessment, and retained history
- Validated reports, dashboards, notifications, escalation, and archival access
Apply ALCOA+ principles to the original investigation, action evidence, effectiveness data, reviewer comments, rejected approval cycles, extensions, calculations, and the closure decision—not only to the final signed page.
Prevent weak or premature closure
Common CAPA closure mistakes
| Weak practice | Why it fails | Better control |
|---|---|---|
| Closing because all tasks are checked | Task completion does not prove correct implementation, effectiveness, or acceptable residual risk. | Use separate implementation, effectiveness, and closure gates with objective evidence. |
| Copying the investigation conclusion | The closure assessment fails to address later action, effectiveness, new evidence, and residual risk. | Write a current criterion-by-criterion conclusion based on the full lifecycle. |
| Using training as the default CAPA | Training may not control poor design, confusing documents, workload, interfaces, or error-prone tasks. | Address system causes and verify competent behavior and outcome in routine conditions. |
| Claiming “no recurrence” without exposure | Zero events during no or minimal production supply little evidence. | Define meaningful opportunities, monitoring duration, detection capability, and control-performance tests. |
| Closing with pending effectiveness | The intended result has not yet been demonstrated. | Use an implementation-complete status while the overall CAPA remains controlled and visible. |
| Transferring unfinished actions | Administrative movement can conceal an uncontrolled cause and break accountability. | Transfer only routine or noncritical work under approved criteria, with a receiving owner and reopening trigger. |
| Ignoring linked-record conflicts | One record may say a batch, change, validation, or product impact is resolved while another remains open or contradictory. | Maintain a linked-record index and reconcile status, scope, decision, and dates before closure. |
| Accepting supplier completion statements | An external assertion may not show technical adequacy, implementation, or effectiveness. | Obtain and assess risk-appropriate objective evidence under the quality agreement. |
| Lowering residual risk automatically | A planned or documented action is not evidence that occurrence or detection actually improved. | Use implementation and performance data and state uncertainty and control dependencies. |
| Excluding unfavorable data | Selective evidence creates bias and data-integrity concern. | Reconcile the population, retain exclusions with rationale, and investigate anomalies. |
| Approving before evidence is final | Post-approval attachments or changes mean the signature did not cover the final record. | Freeze or version the review package and require reapproval after material change. |
| Measuring closure speed alone | Pressure to improve on-time metrics can drive shallow investigations and premature decisions. | Balance timeliness with repeat events, effectiveness failure, extension quality, aging, and audit findings. |
AEO quick answers
Frequently asked questions about CAPA closure
What is CAPA closure?
CAPA closure is the documented Quality decision that the investigation and scope are adequate, approved actions are implemented, effectiveness criteria are satisfactorily met, product and linked records are resolved, residual risk is acceptable, continuing controls are assigned, and the complete evidence package is approved.
When can a pharmaceutical CAPA be closed?
A pharmaceutical CAPA can be closed after objective evidence confirms complete investigation, justified causes, appropriate action, verified implementation, satisfactory effectiveness, resolved product impact, reconciled linked records, acceptable residual risk, no critical open commitment, and approval by authorized Quality personnel.
Who should approve CAPA closure?
The authorized Quality Unit should approve final CAPA closure according to the site procedure. Process owners and subject-matter experts provide technical evidence and recommendations, while additional management, medical, regulatory, validation, statistical, or specialist approval may be required according to risk and scope.
What is the difference between action completion and CAPA closure?
Action completion confirms that a deliverable was finished. CAPA closure is broader: it confirms implementation, effectiveness, investigation adequacy, product and system impact, linked-record resolution, residual-risk acceptance, documentation integrity, continuing monitoring, and independent Quality approval.
Can a CAPA be closed before the effectiveness check is complete?
Final CAPA closure should not be represented as complete while required effectiveness evidence is pending. A procedure may use an implementation-complete status, but the effectiveness task and overall record should remain visibly controlled with an owner, due date, monitoring plan, interim controls, and escalation.
Can a CAPA close with an open action?
A required action that controls root cause, product risk, validation, compliance, or effectiveness should remain open. Only genuinely administrative, routine-monitoring, or broader improvement work may be transferred under approved criteria when closure evidence remains valid and ownership, due date, monitoring, and reopening triggers stay controlled.
What documents are required for CAPA closure?
The closure dossier typically includes the source event, containment, investigation, scope and impact assessment, root-cause evidence, risk assessments, approved action plan, implementation records, change and validation evidence, training and competency, effectiveness report, linked-record index, residual-risk decision, monitoring transfer, closure assessment, and approvals.
What should a CAPA closure summary contain?
The summary should state the original problem and scope, verified causes, actions and implementation evidence, effectiveness results against each criterion, recurrence and adverse-effect review, linked-record status, deviations and limitations, residual risk, continuing monitoring, lessons learned, final rationale, approvers, and closure date.
How is residual risk evaluated at CAPA closure?
Residual risk is evaluated using the actual controlled state after implementation. Review remaining failure pathways, severity, likelihood, detectability where relevant, control performance, uncertainty, affected population, new risks, and ongoing surveillance, then obtain acceptance from roles authorized by the approved quality-risk procedure.
What happens if a CAPA effectiveness check fails?
Do not close the CAPA. Contain current risk, assess product and patient impact, investigate why effectiveness failed, reconsider cause and scope, review related and distributed product, revise actions and risk, reopen or link records according to procedure, and establish new prospective effectiveness criteria.
How should an overdue CAPA extension be handled?
Request extension before the due date where possible and document the delay reason, current status, updated risk, product impact, interim-control effectiveness, remaining deliverables, resources, milestones, new date, owner, and required approval. Repeated extensions should receive higher governance and management review.
Must root cause be confirmed before CAPA closure?
The investigation should reach the most supportable cause conclusion permitted by the evidence and document remaining uncertainty. When a single root cause cannot be conclusively demonstrated, closure requires a scientifically justified causal assessment, adequate scope, risk-proportionate controls covering credible causes, and effectiveness evidence supporting the controlled state.
How is supplier or multi-site CAPA closure managed?
Define global and local scope, responsibilities, evidence access, product decisions, change and regulatory interfaces, effectiveness ownership, and approval authority through quality agreements and linked records. The responsible pharmaceutical company should obtain sufficient objective evidence rather than relying only on an external completion statement.
Can a closed CAPA be reopened?
Yes. Reopen or formally link a new investigation when recurrence, new knowledge, audit findings, complaints, control failure, data-integrity concerns, scope expansion, or unacceptable residual risk undermines the original closure. Preserve the prior approved record and document the trigger, impact, decision, and new governance.
How do ALCOA+ principles apply to CAPA closure?
ALCOA+ principles require investigation data, action evidence, calculations, effectiveness results, exclusions, reviewer comments, extensions, audit trails, signatures, and closure conclusions to be attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring, and available throughout the record lifecycle.
What is the final CAPA approval checklist?
The final checklist confirms problem and scope, product impact, investigation and causes, action-to-cause coverage, implementation, change and validation status, effectiveness, recurrence, unintended effects, linked records, data integrity, residual risk, open items, ongoing monitoring, lessons learned, independent review, authorized Quality approval, and a dated closure record.
Primary regulatory references
.webp)
