QULDEXResources · Template
CAPA log template: fields, example and how to use it
What is a CAPA log?
Every nonconformity needs a record of what was done about it. The CAPA log is that record, kept as one line per action so that status, ownership and overdue items can be seen at a glance.
ISO 27001 asks for documented information on the nature of each nonconformity, the actions taken and the results of corrective action. A complete log supplies all three.
The requirement, what was found, and the immediate fix.
The cause, the change that removes it, the owner and the date.
Evidence, an effectiveness check by someone else, and the closure decision.
CAPA log template
Fourteen fields. The example follows one action.
| Field | Example | What to write |
|---|---|---|
| CAPA reference | CA-2026-031 | A unique number |
| Source | Internal audit IA-2026-07, finding F-03 | Where it came from |
| Requirement | Access rights removed on termination (A.5.18) | The clause or internal rule not met |
| Finding | 3 of 25 sampled leavers had active accounts | What was found, with the evidence |
| Severity | Minor nonconformity | Using your grading criteria |
| Correction | Three accounts disabled 12 Oct 2026 | The immediate fix, and when |
| Root cause | IT learns of leavers by manager email, which is sometimes late | Why it happened |
| Corrective action | HR system opens a removal ticket on the last working day | The change that removes the cause |
| Owner | IT operations lead | One named person |
| Due date | 30 Nov 2026 | With escalation if missed |
| Status | Implemented, awaiting verification | Open, in progress, implemented, verified, closed |
| Evidence of completion | Workflow configuration; first five automatic tickets | What proves the action was done |
| Effectiveness check | Jan 2027 access review: no active leaver accounts; internal auditor | When, by whom, and the result |
| Closure | Closed 20 Jan 2027 by head of internal audit | Date and approver |
The example values are illustrative. Copying pastes the table as rows and columns into a spreadsheet or document.
How do you fill it in?
- Log the finding when it is raised
Do not wait for the report; record it with its evidence.
- Record the correction separately
The immediate fix is not the corrective action.
- Find the cause before choosing the action
Ask why until you reach something you can change.
- Give one owner and one date
And decide when and how effectiveness will be checked.
- Close only after verification
A different person confirms the fix worked.
What goes wrong most often?
Correction logged as corrective action
The three accounts were disabled, so the item is closed.
Instead: record what stops it happening again.
No effectiveness check
The action was done; nobody looked later.
Instead: set a check date when the action is raised.
Owner closes own action
The person who did the work signs it off.
Instead: have a reviewer close it.
Do you need a template at all?
Each finding becomes an action with an owner, a due date and escalation, closed only after a reviewer verifies the evidence.
CAPA log template: common questions
What should a CAPA log include?
The source and requirement, the finding, severity, correction, root cause, corrective action, owner, due date, status, evidence, effectiveness check and closure.
Is a CAPA log required by ISO 27001?
The standard requires documented information about nonconformities, actions taken and results. A log is the usual way to keep it.
How long should CAPA records be kept?
At least through the certification cycle, and in line with your retention policy.
Is this template free?
Yes. It is on this page, with no form to fill in.
Corrective actions tracked to verified closure
The record lives with the audit, linked to its controls, findings and report.