Corrective and preventive action (CAPA) is often a thorn in the side of medical device manufacturers. Problems with CAPA top the list of reasons for 483s and warning letters from FDA year after year, and many companies struggle to identify when they should even initiate a CAPA.
When companies are uncertain about what should trigger a CAPA, they tend to make one of two mistakes:
They get “CAPA happy.” In this case, every incident is treated as CAPA-worthy, which leads to mountains of paperwork and enormous stress. As the CAPAs pile up, the backlog slows progress to a crawl and the company may suffer “death by CAPA.”
They ignore CAPA-worthy issues. On the other hand, some companies don’t escalate issues to CAPA when action is warranted. This underuse of the CAPA process leaves them vulnerable to 483s and warning letters from FDA, and has an adverse effect on the safety and efficacy of their devices.
The problem in both situations is uncertainty or misconceptions about when to initiate the CAPA process. So today, I want to share my thoughts on what events should really trigger a CAPA.
First, let’s take a step back and look at the bigger picture. Your CAPA process is meant to investigate and address systemic quality issues, such as a component that repeatedly fails inspections during manufacturing. Keep this in mind as we get deeper into the different events that may trigger a CAPA.
Some companies escalate every one-off event into a CAPA, but this dilutes the effectiveness of their CAPA process and creates as many problems as it solves. You should also be aware that the most effective approach to CAPA focuses heavily on preventive actions.
Many companies rely solely on a reactive approach, attempting to catch and correct problems as they arise. The best CAPA processes are proactive, with a focus on preventing systemic issues from ever occurring in the first place.
While a CAPA may come from any area of your QMS that presents a systemic quality issue, there are a few main areas that often trigger a CAPA:
A nonconformance is a product or process that doesn’t fulfill a specific requirement established by the company, such as a disconnected process or defective product. A nonconforming product is one which does not conform to the device manufacturer’s specific requirements. There are a multitiude of different ways that a product could be nonconforming; perhaps a certain component does not meet specifications or has been assembled incorrectly.
Similar to a CAPA, a nonconformance triggers a process, which involves controlling the nonconforming product and investigating the cause of the issue and the likelihood it will occur again.
However, it’s important to note that not all nonconformances will trigger a CAPA. This is a trap that many medical device companies fall into. They initiate a CAPA for every nonconformance and end up on the “CAPA happy” end of the spectrum.
In reality, a single nonconformance will rarely require a CAPA. In some cases, nonconformances are minor enough that a manufacturer may decide that the device can still be used as-is.
Now, there are situations in which nonconformances should trigger a CAPA. For instance, you may notice that a specific type of nonconformance—like a problem with a certain component—has appeared repeatedly. Even worse, the component is used in several of your products. At this point, you are probably looking at a systemic issue and a CAPA may be warranted.
FDA defines a complaint as any communication that alleges deficiencies in your product after it has been placed on the market.
As with nonconformances, a complaint should trigger an investigative process that identifies the issue, how it affects the customer, and the root cause of the problem. Similar to a nonconformance, a single complaint will probably not trigger a CAPA. Again, you are looking for indications of a systemic issue, like multiple complaints about the same issue with your product.
However, there is one big caveat here: in the absence of a systemic problem, you may still initiate a CAPA when an adverse event occurs, such as an injury to a patient or end user.
Incidents like these always warrant a more thorough investigation and should trigger a CAPA. The risks to patients, providers, and your company are too large to treat these events as one-off incidents.
In short, when a complaint raises a serious issue, you don’t need to wait until you can spot a trend to take action. There is no set number of complaints that determine whether a CAPA should be initiated. You have to look at the big picture and evaluate each situation in light of many factors, such as the time between complaints and the circumstances surrounding them.
Audits, both internal and external, may uncover issues that need to be addressed. However, if these issues exist, your goal should be to discover them during internal audits so that you can address them before an FDA inspection or ISO audit.
As before, you need to evaluate whether the issues you discover during your internal audits are systemic in nature before initiating a CAPA. Medical device companies will often escalate every problem to CAPA as they perform their internal audit in an attempt to be thorough. Again, however, this is usually unnecessary.
If your audit uncovers a nonconformance, for example, you don’t need to immediately launch a CAPA investigation. You can instead issue a request for more records to help you understand the extent of the nonconformance. From there, you can decide whether the issue is systemic in nature and requires a CAPA.
Change management may be known by different terminologies (change control, change requests, change orders etc.), but the bottom line is that it’s a system that should be used regularly and may be triggered by any of the previous systems we’ve talked about.
For example, if you have single incidents of complaints or nonconformances, these may trigger a change in your documentation, labeling, product, design or specifications. It’s possible that the whole incident can be handled this way without initiating a CAPA.
There should be a deep connection between CAPA and risk management within your organization. Whenever you believe an issue may warrant a CAPA, your first turn should be to your risk management documents. Has this issue already been assessed and documented? If not, then it’s time to update them. If so, did you calculate the risk appropriately?
Also, remember that choosing to initiate a CAPA is an exercise in risk management. Risk is the combination of the likelihood of harm and the severity of that harm. As we’ve seen, CAPAs are generally initiated when the problem is systemic, meaning there is a higher likelihood of occurrence. Still, an adverse event involving injury to a patient may also trigger a CAPA because of its severity.
One of the easiest and most effective ways to create a proactive CAPA process is to switch from a paper-based QMS to an eQMS built specifically for medical device companies.
With Greenlight Guru’s QMS software, you have dedicated risk-based CAPA management software that allows you to automate inefficient processes and remove excess documentation associated with CAPAs. You’ll have a single, up-to-date workflow to help you visualize and understand how each element of CAPA connects back into your quality system.
If you’re ready to turn CAPA from a headache into an effective and efficient tool in your QMS, then get your free demo of Greenlight Guru today.
Looking for an all-in-one QMS solution to advance the success of your in-market devices and integrates your post-market activities with product development efforts? Click here to take a quick tour of Greenlight Guru's Medical Device QMS software →