QULDEXResources · Glossary
What is CAPA? Corrective and preventive action, explained
What does CAPA mean in an audit?
When an auditor records a finding, the organisation owes two things: put the immediate problem right, and make sure it does not come back. CAPA is the name for the second part and the record that proves it was done.
Three words are often mixed up. They are different actions, and an auditor will look for each one.
Fixes the instance that was found. Example: remove the access a leaver still had.
Removes the cause, so the same problem does not recur. Example: link account removal to the HR leaver process.
Removes the cause of a problem that has not happened yet. Example: apply the same link to contractor accounts.
Current ISO management system standards, including ISO 27001 and ISO 9001, no longer have a separate preventive action clause. Prevention is handled through risk planning (clause 6.1), and corrective action sits in clause 10.2. The term CAPA remains in everyday use, and ISO 13485 for medical devices still lists both actions.
What are the steps in a CAPA process?
Six steps take a finding from discovery to verified closure. Each one leaves a record.
- Record the finding
State what was found, where, against which requirement, and the evidence.
Record: finding - Correct the instance
Put right the specific case that was found, and note when and by whom.
Record: correction - Find the root cause
Ask why it happened until you reach something you can change: a missing step, an unclear owner, a tool gap.
Record: root cause - Plan the corrective action
Decide the change, name one owner and set a due date. Check whether the same cause exists elsewhere.
Record: action, owner, due date - Carry it out
Make the change and keep proof: the new procedure, the configuration, the training record.
Record: implementation evidence - Verify and close
After enough time has passed, a reviewer who is not the owner checks that the fix worked. Only then is the CAPA closed.
Record: effectiveness check, closure
What does a CAPA look like in practice?
An access review finds that three former employees still have active accounts.
| Step | What is recorded |
|---|---|
| Finding | Three leaver accounts active after their last working day. Requirement: access rights are removed on termination. |
| Correction | The three accounts are disabled the same day. |
| Root cause | IT learns about leavers by email from managers, and the email is sometimes late or missing. |
| Corrective action | The HR system now opens a removal ticket automatically on the leaver's last day. Owner: IT operations lead. |
| Preventive step | The same trigger is added for contractors, where no problem had yet been found. |
| Verification | At the next quarterly access review, an internal auditor samples leavers and finds no active accounts. The CAPA is closed. |
This is an illustration written for this page, not a customer record.
Which frameworks require corrective action?
Most audit frameworks ask for it. The clause differs; the evidence an auditor expects is much the same.
| Framework | Where | What it asks for |
|---|---|---|
| ISO 27001 | Clause 10.2 | React to a nonconformity, find its cause, act, review whether the action worked, and keep documented information as evidence. |
| ISO 9001 | Clause 10.2 | The same sequence for quality nonconformities, including those raised by complaints. |
| ISO 27701 | Improvement clause | Corrective action for nonconformities in the privacy information management system. |
| SOC 2 | CC4.2 | Control deficiencies are evaluated and communicated to those responsible for corrective action, and followed up. |
| NIST CSF 2.0 | ID.IM | Improvements are identified from evaluations, tests, exercises and incidents, and are acted on. |
Clause references are to the current editions listed under Sources. Check the edition your auditor is using.
What do auditors most often find wrong with CAPA?
Closed on the fix, not on the proof
The action was done, so the item was closed. Nobody checked later whether the problem returned.
Instead: keep the item open until an effectiveness check has been recorded.
The root cause is the finding, reworded
"Accounts were not removed because removal was missed" explains nothing and changes nothing.
Instead: keep asking why until the answer is something you can change.
No single owner or date
An action owned by a team with no due date slides from one audit cycle to the next.
Instead: name one person and one date, and escalate when the date passes.
How does QULDEX handle CAPA?
Each finding becomes a corrective action with an owner, a due date, reminders and escalation. It closes only when a reviewer has verified the evidence.
CAPA: common questions
What does CAPA stand for?
Corrective and preventive action. It is the process and the record for fixing the cause of a problem and stopping it from returning.
What is the difference between corrective and preventive action?
Corrective action removes the cause of a problem that has already happened. Preventive action removes the cause of a problem that has not happened yet.
Does ISO 27001 require preventive action?
Not as a separate clause. ISO 27001 handles prevention through risk assessment and treatment in clause 6.1, and requires corrective action for nonconformities in clause 10.2.
When can a CAPA be closed?
When the action has been carried out and a later check, by someone other than the owner, shows that it worked. Closing on completion alone is a common audit finding.
Sources
- ISO/IEC 27001:2022, Information security management systems: Requirements, clauses 6.1 and 10.2
- ISO 9001:2015, Quality management systems: Requirements, clause 10.2 and Annex A.4
- ISO 13485:2016, Medical devices: Quality management systems, clauses 8.5.2 and 8.5.3
- NIST Cybersecurity Framework 2.0, Identify: Improvement (ID.IM)
- AICPA, 2017 Trust Services Criteria (with revised points of focus, 2022), CC4.2. aicpa-cima.com
Track every corrective action to verified closure
See findings, owners, due dates and effectiveness checks in one place.