During a recent internal audit I was performing for a new client, I noticed that they were not meeting one of the requirements of their CAPA procedure. Specifically, the procedure indicated that all CAPA plans must be written within seven calendar days of initiating the CAPA. Despite this requirement in their procedure, the client was indicating that CAPA plans were due within 30 calendar days on their CAPA form.
This example is a minor nonconformity, but the reason why this client was not following their procedure is more interesting. The procedure was 100% compliant with FDA regulations, but the procedure did not match how the company performed the process. The procedure and the process MUST match.
This client purchased their CAPA procedure from a consultant, changed the title, and had everyone in the company “read and understand” the procedure for training. If this sounds like your company, I’m not surprised, because this is not uncommon. To avoid the mistakes this client made, follow the following steps for writing your own CAPA procedure.
7 Steps for Writing an Effective CAPA Procedure
- Design your CAPA form first
- Identify which steps in your process are most important and specify how these steps will be monitored (i.e., risk-based approach)
- Write a procedure that follows your CAPA form and includes instructions for monitoring and measuring your CAPA process
- Conduct group CAPA training using the draft version of your form and procedure
- Make revisions to the form and procedure to clarify steps the trainees had difficulty with
- Ask the trainees to review the revised form and procedure
- Make final revisions and route the procedure for approval
The specific order of steps is important to creating a CAPA procedure—or any procedure. Writing a procedure that matches the form used with that procedure helps people understand the tasks within a process.
Make sure your CAPA procedure is clear and concise
Procedures are often unclear, because the author is more familiar with the process than the intended audience for the procedure. An author may abbreviate a step, or skip it altogether. As an author, you should use an outline format and match your CAPA form exactly. There should be nothing extra in the procedure and nothing left out. In fact, my CAPA procedure is only 4 pages.
The CAPA procedure is a 4-page procedure which includes a CAPA form, and CAPA log. The procedure is compliant with ISO 13485:2016 and 21 CFR 820.100.
Ensuring your CAPA procedure is risk-based
The biggest problems most companies have is that quality personnel has primary responsibility for the CAPA process. Quality personnel should be monitoring and measuring the CAPA process and reporting on process effectiveness to top management–not doing all the work associated with every CAPA. When you first initiate a CAPA, someone needs to perform an investigation to determine the root cause. This person will need to review records and analyze data. Based upon the data analysis, you may determine that a CAPA is not needed, but you will continue to monitor the process. Other times, the data analysis will verify that you have a systemic problem and a formal CAPA is needed. Based upon the severity of a quality problem, and the frequency of that problem, you should prioritize the CAPA as low, medium or high risk. Top management should prioritize resources for completing the CAPA based upon the risk. Quality should monitor implementation and closure of CAPAs and report to top management. Finally, sometimes you have a larger problem that requires a quality plan to make changes throughout your quality system. Implementing this risk-based approach will also meet the requirement in ISO 13485:2016 for implementing a risk-based process.
Verifying effectiveness of a CAPA is the most important step in the process
Most people verify CAPA effectiveness by verifying that all the actions planned were completed, but this is not a CAPA effectiveness check. An effectiveness check should use quantitative data from your investigation of root cause as a benchmark. Then you should verify that the performance after corrective actions are implemented resulted in a decrease in the frequency of the quality problem, a decrease in the severity of the quality problem, or both. Ideally, a process re-validation was performed, because validation protocols are required to include quantitative acceptance criteria for success.
Training on your new CAPA procedure
If you are interested in more training on CAPA, you might be interested in purchasing Medical Device Academy’s Risk-Based CAPA webinar. 99% of companies hold off on their training until a procedure is officially released as a controlled document. In my experience, however, these procedures seem to have a lot of revisions made immediately after the initial release. New users ask simple questions that identify sections of procedures that are unclear, or were written out of sequence. Therefore, you should always conduct at least one training session with users prior to final review and approval of a procedure. This will ensure that the final procedure is right the first time, and it will give those users some ownership in the new procedure.
After you train your initial group, and after you make the edits they recommended, ask those trainees to review and edit your changes to the procedure. Sometimes we don’t completely understand what someone is describing, and sometimes may be only half listening. Going back to those people to verify that you accurately interpreted their feedback is the most important step for ensuring that users accept your new procedure.
After you approve your new CAPA procedure, make sure everyone in your company is trained on the final version of the procedure. CAPA is a critical process (i.e., “the heart”) in your quality system. Everyone should understand it. You should also provide extra CAPA training for department managers, such as root cause analysis training, because they will be responsible for implementing CAPAs assigned to their department. You can use this 7-step process for any procedure, but ensure you use it for the most important process of all—your corrective and preventive action process.