Corrective and Preventive Action (CAPA)

Corrective and preventive action (CAPA) is a structured process for eliminating the causes of problems. Corrective actions remove the cause of a nonconformity, incident or audit finding that has already happened so it does not recur. Preventive actions remove the cause of a potential problem before it happens. Both require an owner, a due date and verification.

CAPA originated in quality management and is now standard practice in safety, environmental and fleet compliance programs. It is the step that turns findings into lasting fixes.

What Is Corrective and Preventive Action (CAPA)?

A CAPA process takes an input, such as an incident report, inspection finding or customer complaint, and moves it through investigation, action, and verification until the cause is eliminated. The two halves are distinct:

• Corrective action responds to something that already went wrong. A forklift strikes a rack, an audit finds expired training, or a spill reaches a storm drain.
• Preventive action responds to a risk that has not yet caused harm. A trend in near misses, a hazard identified in a risk assessment, or a lesson from another site that applies here.

It also helps to separate a correction from a corrective action. A correction fixes the immediate condition, such as cleaning up the spill. A corrective action fixes the reason it happened, such as replacing the failed container design and updating the storage procedure.

In the occupational safety world, ISO 45001:2018 addresses this in clause 10.2, "Incident, nonconformity and corrective action," which requires organizations to react to incidents and nonconformities, investigate causes, implement actions, review their effectiveness and retain documented evidence. Like other ISO management system standards built on the common high-level structure, ISO 45001 does not have a separate preventive action clause. Prevention is built in through planning to address risks and opportunities (clause 6.1).

OSHA standards also contain CAPA-style requirements. For example, after a Process Safety Management compliance audit, 29 CFR 1910.119(o)(4) requires the employer to promptly determine and document an appropriate response to each finding and document that deficiencies have been corrected.

Why CAPA Matters

Without a disciplined CAPA process, organizations fix symptoms and the same problems come back. Repeat findings at audits and repeat incidents of the same type are classic signs of a weak CAPA system.

OSHA's Recommended Practices for Safety and Health Programs advise that when a problem is identified, employers should take prompt action to correct the problem and prevent its recurrence. CAPA is how that expectation becomes a repeatable process with accountability, rather than a good intention.

A CAPA log is also strong evidence of a working safety program. Inspectors, auditors and customers look for proof that findings were tracked to closure, not just recorded.

Common Sources of CAPAs

• Audit and inspection findings
• Incident and near miss investigations
• Safety observations and employee hazard reports
• Risk assessments and job hazard analyses
• Regulatory inspections and citations
• Management reviews, customer complaints and lessons learned from other sites

The CAPA Process Step by Step

1. Identify and record the problem. Describe what happened or what could happen, where, when, and which requirement or expectation was not met.
2. Assess risk and take immediate containment. Rate severity and likelihood to set priority. Make the area safe now, such as tagging out equipment or isolating a spill, while the investigation proceeds.
3. Investigate the root cause. Use root cause analysis methods such as 5 Whys or a fishbone diagram to find the underlying system causes, not just the immediate trigger.
4. Plan actions. Choose actions that address each root cause, favoring stronger controls from the hierarchy of controls over training or signs alone. Assign an owner and a realistic due date for each.
5. Implement. Complete the actions and document the evidence, such as photos, revised procedures or training records.
6. Verify effectiveness. After a set period, check that the problem has not recurred and that the action had no unintended side effects. If it did not work, reopen the CAPA.
7. Close and share. Close the CAPA with a summary, and share the lesson with other sites or teams that have the same exposure. Sharing is where corrective action becomes preventive action elsewhere.

Example of a CAPA in Practice

Consider a hypothetical case: an employee slips on hydraulic oil near a press and sprains a wrist.

• Correction: clean the floor and place a drip pan under the press.
• Root cause: the press's hydraulic fitting has leaked for weeks, but leaks are not on the preventive maintenance checklist and operators were unsure how to report them.
• Corrective actions: repair the fitting, add hydraulic leak checks to the weekly PM checklist, and set up a simple maintenance reporting channel. Owners: maintenance lead and area supervisor. Due in 14 days.
• Preventive action: inspect the other six presses on site for the same fitting and add the leak check to their PM schedules.
• Verification: after 60 days, review PM records and conduct a floor walk to confirm no new leaks or slips.

Corrective Action vs. Preventive Action

The difference is timing. Corrective action is reactive: it addresses the cause of a problem that has occurred. Preventive action is proactive: it addresses the cause of a problem that could occur. The same fix can be both, depending on where it is applied. Repairing the leaking press was corrective; checking the other presses was preventive.

Many organizations now emphasize risk-based thinking over a separate preventive action form, but the goal is the same: use what you learn to stop harm before it happens, not only after.

Common CAPA Mistakes to Avoid

• Stopping at the correction. Cleaning up the spill without asking why it happened guarantees it will happen again.
• Defaulting to "retrain the employee." Training is sometimes needed, but it is rarely the root cause fix on its own.
• Vague actions. "Improve housekeeping" cannot be verified. "Install drip pans under presses 1 through 7 by May 15" can.
• No single owner. Actions assigned to a department or a committee tend to drift. Assign one named person.
• Closing without verification. An action marked complete is not proof that the problem is gone.
• Letting overdue actions pile up. A long list of open, overdue CAPAs signals to workers that reporting does not lead to change.

Best Practices for CAPA Management

• Use one central CAPA register for all sources rather than separate spreadsheets for audits, incidents and observations.
• Prioritize by risk so high-severity issues are addressed first.
• Track CAPA closure rate and overdue actions as key performance indicators and review them in leadership meetings.
• Escalate overdue actions automatically to the owner's manager.
• Involve the workers affected by the problem in choosing and testing the fix.
• Review CAPA data periodically for recurring root causes across sites.

How SMS360 Helps

SMS360's Actions Management module brings corrective and preventive actions from audits, incidents, observations and risk assessments into one register. Each action can be assigned to an owner with a due date, priority and supporting evidence, and automated reminders help keep work on schedule. Dashboards and reports show open, overdue and completed actions by site or department, giving managers a clear record of what was fixed, by whom and when.

Frequently Asked Questions

What is the difference between corrective and preventive action?

Corrective action eliminates the cause of a problem that has already occurred, such as an incident or audit finding, to prevent it from happening again. Preventive action eliminates the cause of a potential problem before it occurs, such as a hazard identified through a risk assessment or a near miss trend. Corrective action is reactive and preventive action is proactive, but both should address root causes.

What are the steps of a CAPA process?

A typical CAPA process has seven steps: identify and record the problem, assess risk and contain it, investigate the root cause, plan actions with owners and due dates, implement the actions, verify that they were effective, and close the CAPA while sharing lessons learned. Verification is the step most often skipped, yet it is the only way to confirm the problem is truly fixed.

Is CAPA required by ISO 45001?

ISO 45001:2018 requires corrective action in clause 10.2, including investigating incidents and nonconformities, determining causes, implementing actions and reviewing their effectiveness. It does not use a separate preventive action clause. Instead, prevention is addressed through planning actions to address risks and opportunities in clause 6.1, so the intent of preventive action remains part of the standard.

How do you measure CAPA effectiveness?

Measure CAPA effectiveness by checking whether the problem recurred after the action was completed, typically through follow-up inspections, audits or incident data over a defined period. Program-level measures include on-time closure rate, number of overdue actions, average days to close and the percentage of CAPAs that required reopening. Repeat findings of the same type indicate weak root cause analysis.