CAPA Procedure: SOP Structure and Step-by-Step Workflow
A practical guide to defining responsibilities, investigating causes, implementing actions, and demonstrating that improvements work.
What is a CAPA procedure? A CAPA procedure is an approved standard operating procedure that defines how an organization identifies quality problems, investigates their causes, plans and implements corrective or preventive actions, verifies effectiveness, and authorizes closure. It assigns responsibilities, records, timelines, and escalation rules so that improvements are controlled and traceable.
A clear CAPA procedure turns an investigation into an accountable improvement plan. In pharmaceutical operations, it helps QA, QC, production, engineering, and validation teams agree on what must change, who will do the work, and what evidence will demonstrate success.
This brief focuses on SOP design and execution. For the broader concepts and related quality systems, read the WebOfPharma CAPA guide.
Inside this guide
Why Is a CAPA Procedure Needed?
A procedure establishes consistent decision rules across departments. Without them, one team may close a record after retraining while another expects months of performance data. Clear requirements reduce these differences and make quality decisions easier to review.
The procedure should support cGMP by connecting quality signals to appropriate investigation, follow-up, and documented control. Its purpose is to improve the operation, not simply increase the number of completed forms.
When should CAPA be initiated?
Apply the site's approved criteria to significant failures, recurring deviations, adverse trends, audit findings, complaints, and credible potential failures. Consider the seriousness of the consequence, recurrence, breadth of the weakness, and need for coordinated action.
A separate CAPA record is not automatically necessary for every minor event. Suitable actions may be controlled within the originating quality record when the procedure permits it and the rationale is documented. Necessary investigation and follow-up must still occur.
Correction
Resolves the immediate problem—for example, replacing a damaged component or correcting a traceable transcription error.
Corrective and preventive action
Corrective action addresses the cause of an existing problem; preventive action addresses the cause of a potential problem before it occurs.
Recommended CAPA SOP Structure
A useful SOP combines document control, clear responsibilities, decision criteria, and an operational workflow. The following structure is a practical model to adapt to the site's quality system.
| SOP section | What to include |
|---|---|
| Document control | Title, SOP number, version, effective date, preparation/review/approval, and revision history. |
| Purpose and scope | Objectives, covered sites and functions, applicable quality events, and boundaries. |
| Definitions | Correction, containment, corrective action, preventive action, root cause, effectiveness, and closure. |
| Responsibilities | Initiator, investigation lead, CAPA owner, action owners, QA reviewers, and management. |
| Initiation and risk assessment | Triggers, required information, initial priority, product-impact review, and escalation criteria. |
| Investigation and action planning | Evidence expectations, cause evaluation, scope assessment, action approval, and change-control links. |
| Implementation and effectiveness | Completion evidence, outcome criteria, observation period, reviewer, and handling of failure. |
| Tracking and closure | Statuses, milestones, extension rules, overdue escalation, and closure authority. |
| Records and attachments | Forms, tracker, evidence index, retention references, and associated procedures. |
Write instructions around decisions. For example, state who assesses whether similar equipment is affected and where that assessment is recorded. “Review other equipment if necessary” leaves both responsibility and the decision basis unclear.
Who Is Responsible for the CAPA Procedure?
QA normally oversees the process, while the department owning the problem delivers the technical actions. The SOP should distinguish accountability for the overall record from responsibility for individual tasks.
| Role | Practical responsibility |
|---|---|
| Initiator | Reports the issue, preserves relevant evidence, and records immediate actions. |
| Investigation lead | Coordinates evidence review, technical input, causal analysis, and the investigation conclusion. |
| CAPA owner | Maintains the plan, coordinates dependencies, tracks progress, and escalates barriers. |
| Action owner | Completes a defined deliverable and submits evidence by its approved due date. |
| QA / quality authority | Challenges adequacy, reviews risk and evidence, and approves key decisions under the site system. |
| Management | Provides resources and resolves significant or persistent barriers. |
CAPA Procedure: Step-by-Step Workflow
The workflow below separates ten practical stages. Containment, risk review, and documentation continue throughout the process; they are not one-time activities.
Identify and describe the problem
Record the source, date, location, product or process, expected requirement, actual observation, and known extent. Avoid assumptions such as “operator carelessness” before investigation.
Output: A factual problem statement linked to the originating record.
Contain the issue and assess immediate impact
Apply justified controls such as batch hold, equipment restriction, segregation, or additional checks. Preserve settings, records, and other evidence before routine activity changes the conditions. Assess potentially affected batches and operations.
Output: Documented containment and an initial product-impact assessment.
Initiate the record and assign priority
Apply initiation criteria, issue a unique identifier, and assign an owner. Set an initial risk-based priority and milestones. Urgent protective action should not wait for completion of administrative routing.
Output: An authorized record with accountable ownership and initial dates.
Investigate and evaluate the causes
Review relevant batch records, SOPs, training, maintenance, laboratory data, and previous events. Use tools such as 5 Whys or fishbone analysis to generate hypotheses, then test them against evidence. Explain the mechanism and any remaining uncertainty.
Output: A supported causal conclusion and a documented scope assessment.
Reassess risk and wider applicability
Update the risk assessment using investigation findings. Determine whether similar products, methods, equipment, or sites share the weakness. A serious consequence should not be dismissed solely because a numerical risk score appears low.
Output: Updated priority, affected scope, and interim-control decisions.
Develop and approve the action plan
Link each action to a supported cause or justified potential failure. Define the deliverable, owner, resources, due date, dependencies, and completion evidence. Decide how effectiveness will be measured before implementation.
Output: An approved, measurable plan with outcome criteria.
Implement the approved controls
Execute changes through the applicable change-control process. Assess document updates, training, qualification, validation, and regulatory implications. Confirm that tools, instructions, and competent personnel are ready before routine use.
Output: Operational controls supported by traceable implementation evidence.
Verify that actions were completed correctly
Check the actual deliverables: the released SOP, verified configuration, completed work order, or demonstrated competency. A statement that an action is “done” is not enough without supporting evidence.
Output: Verified implementation and a clear status of awaiting effectiveness, where applicable.
Check effectiveness under relevant conditions
Compare performance with the predefined criteria using suitable batches, tests, cycles, or operating exposure. Review recurrence and unintended effects. Classify the outcome as effective, ineffective, or inconclusive.
Output: A documented outcome assessment; failures trigger risk review and further action.
Approve closure and continue monitoring
Confirm that required evidence, linked activities, effectiveness results, and residual-risk decisions support closure. Record approval and the actual closure date. Transfer ongoing oversight to the appropriate routine monitoring process.
Output: Authorized closure with defined follow-up responsibility.
Practical Example: CAPA for Repeated Setup Errors
Tablet press feeder clearance
Problem: Recurring tablet-weight excursions occur after feeder reassembly. Production stops the affected operation, segregates potentially affected tablets, and initiates product-impact review.
Investigation: Measurements and controlled checks support inconsistent feeder clearance as the mechanism. The instruction relies on visual positioning and provides no objective verification method.
Action: Engineering introduces a suitable controlled gauge. Production revises the setup instruction and assesses setter competence by observed demonstration. QA reviews related equipment for the same vulnerability.
Implementation evidence: Approved change documentation, gauge-control records, released instructions, and qualification records.
Effectiveness: A justified monitoring plan covers representative setters, material lots, and batches. Review setup conformity and relevant tablet-weight performance against predefined criteria.
Closure: QA reviews the outcome, linked records, and residual risk. If criteria are not met, reassess the cause and controls instead of closing on the basis of training completion.
How to write a measurable CAPA action
Weak: “Improve operator training.”
Stronger: “By the approved implementation date, revise the feeder setup instruction to specify gauge-based clearance verification and qualify every authorized setter through observed demonstration before independent use.”
The stronger action defines a deliverable and readiness condition. Its separate effectiveness plan evaluates sustained performance.
CAPA Records, Timelines, and Tracking
The record should preserve the problem statement, investigation, risk rationale, actions, approvals, evidence, and effectiveness conclusion. Apply ALCOA+ principles so that entries remain attributable, understandable, complete, and traceable to the original information.
Track initiation, investigation approval, implementation, effectiveness review, and closure separately. Useful statuses include open, under investigation, in progress, implemented—awaiting effectiveness, closed, and ineffective/reopened. Overdue is a flag that can apply to any relevant milestone.
How should CAPA deadlines be set?
Set deadlines according to risk, technical complexity, resources, and required operating exposure. There is no universal 30-day closure period for every pharmaceutical CAPA. An equipment change and its effectiveness study may need different milestones.
Document extension requests, remaining risk, interim controls, revised dates, and approval. Preserve the original deadline and any overdue history. Escalation should lead to a decision or resource commitment rather than repeated reminders alone.
CAPA Closure Checklist
Before approving closure, confirm that the record answers the following questions.
- Is the investigation conclusion supported?
- Has the affected scope been assessed?
- Does each action have completion evidence?
- Are required linked changes resolved?
- Were effectiveness criteria met?
- Was residual risk reviewed?
- Is routine monitoring assigned?
- Are approval and closure dates recorded?
Common CAPA Procedure Mistakes
- Blaming the person too early: Examine task design, instructions, equipment, and work conditions before accepting a human-error conclusion.
- Using retraining for every problem: Select controls that address the demonstrated mechanism.
- Ignoring related operations: Document whether the same weakness exists elsewhere.
- Confusing signatures with outcomes: Training attendance does not establish improved execution.
- Closing without relevant exposure: A quiet period without production may provide no evidence of effectiveness.
- Changing criteria after seeing results: Preserve the approved plan and justify any amendments transparently.
GMP Context for a CAPA SOP
Within its scope, 21 CFR 211.192 requires thorough investigation of specified discrepancies and specification failures, extension to potentially associated batches or products, and written conclusions and follow-up. It does not prescribe the ten-step format presented here.
ICH Q10, section 3.2.2, describes CAPA as an element of the pharmaceutical quality system and supports structured investigation with effort proportionate to risk. It also addresses evaluation of action effectiveness. ICH Q10 is guidance; applicable regional requirements and the approved site system determine operational obligations.
The workflow and SOP outline in this article are practical educational models, not an approved manufacturing-site procedure. Their use requires adaptation to the operation and its quality-system controls.
Frequently Asked Questions
What should a CAPA SOP contain?
Include purpose, scope, definitions, responsibilities, initiation criteria, investigation, risk review, action planning, implementation, effectiveness checks, tracking, escalation, closure, and record controls.
What is the difference between a CAPA SOP and a CAPA form?
The SOP defines the process and decision rules. The form captures evidence and decisions for an individual case. A completed form does not replace compliance with the procedure.
Who approves a CAPA?
The site's SOP defines approval authority. QA or the designated quality authority normally reviews key decisions, with technical and departmental input appropriate to the issue.
Does every deviation require a separate CAPA?
No. Apply approved criteria and document the rationale. Significant, recurring, or systemic issues generally need broader action; some suitable actions can remain controlled within the source record.
Must every record include both corrective and preventive actions?
No. Select actions justified by the investigation and wider applicability assessment. Do not invent an unnecessary action merely to fill a form field.
How many batches prove CAPA effectiveness?
There is no universal number. Justify the observation plan using the failure mechanism, risk, variability, frequency, and relevant operating conditions.
What happens if the effectiveness check fails?
Reassess product risk and containment, investigate whether the cause or action was inadequate, and reopen or initiate a linked record according to procedure. Preserve the failed outcome.
Can CAPA close immediately after implementation?
Implementation alone does not demonstrate effectiveness. If the site system closes actions before later outcome review, that remaining obligation must retain controlled ownership, dates, and escalation.
Authoritative References
- 21 CFR 211.192 — Production record review.
- ICH Q10 — Pharmaceutical Quality System, particularly section 3.2.2.
.webp)
