What is CAPA? Corrective and Preventive Action Explained

CAPA stands for corrective and preventive action. It is a structured process for investigating the root cause of a problem — such as a workplace incident, audit finding, or quality nonconformity — and implementing actions that both fix the immediate issue and prevent it from happening again. Management system standards including ISO 45001, ISO 14001, and ISO 9001 require it, and OSHA's regulatory framework includes corrective action obligations across multiple standards.

If you've been handed a CAPA to close and aren't sure what's expected, or if you're building a CAPA program from scratch, this article covers the concept, the process, the management system requirements that drive it, and the common mistakes that turn a CAPA into paperwork instead of prevention.

Corrective Action vs. Preventive Action: What's the Difference?

The two halves of CAPA address different triggers. Understanding the distinction matters because it affects how you document each action, what root cause analysis you perform, and how you verify effectiveness.

Corrective Action: responds to something that has already gone wrong, an incident, a nonconformity discovered during an audit, a process failure, or a regulatory citation. The goal is to identify why the problem occurred and eliminate the root cause so it does not recur. A corrective action is not the same as a correction: replacing a damaged guard rail is a correction (it fixes the immediate condition), but investigating why the guard rail failed and redesigning the mounting system to prevent future failures is the corrective action.

Preventive Action: responds to a potential problem, a risk identified through a hazard assessment, a near miss, a trend spotted in inspection data, or a change in operations that introduces new exposure. The problem hasn't happened yet, but the conditions that could cause it are present. The goal is to eliminate the source of potential nonconformity before it results in an incident or failure.

In practice, the two overlap. A strong corrective action often includes preventive elements, for example, after investigating a single equipment failure, you might extend the fix across similar equipment at other sites where the same failure hasn't occurred yet. That extension is preventive action.

Where Do CAPA Requirements Come From?

CAPA is not a single regulation. It is a process concept embedded in multiple management system standards and regulatory frameworks. The specific requirements depend on which standards or regulations apply to your organization.

ISO Management System Standards

ISO 45001 (occupational health and safety), ISO 14001 (environmental management), and ISO 9001 (quality management) all require corrective action processes under Clause 10.2 of each standard. When a nonconformity occurs, the organization must react to it, evaluate the need for action to eliminate its root cause, implement the action, review its effectiveness, and update risks and the management system if necessary.

An important nuance: ISO 45001 and ISO 9001 (both published in their current versions in 2015 and 2018 respectively) do not include a separate clause for preventive action. This is deliberate, the standards treat the entire risk-based management system approach (risk assessment, hazard identification, planning for risks and opportunities) as inherently preventive. Preventive action is woven throughout the system rather than isolated in a single clause. If your organization is certified to one of these standards, your auditor will expect to see a corrective action process, but will evaluate preventive action through your risk management and planning processes rather than through a standalone preventive action procedure.

OSHA and Regulatory Frameworks

OSHA does not have a single standard titled "CAPA." However, corrective action requirements appear across multiple OSHA standards and enforcement mechanisms. When OSHA issues a citation, the employer is required to abate the hazard within the timeline specified, and must certify that the corrective action has been completed. Many individual OSHA standards also require employers to take corrective action when specific conditions are identified, such as when monitoring reveals employee exposure above a permissible exposure limit or when an inspection uncovers a deficiency in a required written program.

Beyond formal citations, OSHA's enforcement procedures for reportable incidents (under 29 CFR 1904.39) include requiring employers to conduct an internal investigation, identify hazards, and implement corrective actions, with written documentation provided back to OSHA.

FDA and Regulated Industries

In pharmaceutical manufacturing and medical device production, CAPA has an even more formalized regulatory definition. FDA's Quality System Regulation (21 CFR Part 820) requires medical device manufacturers to establish and maintain CAPA procedures as part of their quality system. This is one of the most frequently cited areas during FDA inspections of device manufacturers. While this falls outside the typical EHS scope, many organizations, especially those in life sciences, apply the same CAPA discipline across both quality and safety programs.

What Does the CAPA Process Look Like?

Regardless of which standard or regulation drives your CAPA requirement, the underlying process follows a consistent sequence. The steps below represent the core lifecycle that most CAPA systems follow.

1. Identification

Every CAPA begins with a triggering event: an incident, a near miss, an audit finding, a customer complaint, a regulatory citation, or a trend identified in operational data. The key at this stage is to document the finding clearly, what happened, where, when, who was involved, and what the immediate impact was. A vague finding produces a vague investigation. The more specific you are about what went wrong (or what could go wrong, in the case of preventive action), the more useful the root cause analysis will be.

2. Root Cause Analysis

This is where most CAPAs either succeed or fail. Root cause analysis (RCA) means going beyond the immediate, visible cause of the problem to identify the underlying systemic reason it occurred. Common RCA methods include the 5 Whys (asking "why" iteratively until you reach a systemic cause), fishbone (Ishikawa) diagrams that categorize potential causes across people, process, equipment, materials, and environment, and fault tree analysis for more complex failure scenarios.

The most common failure at this step is stopping too early. "The worker didn't follow the procedure" is rarely a root cause, it's a symptom. Why didn't they follow it? Was the procedure unclear, inaccessible, contradicted by time pressure, or never trained? Those are the systemic causes that corrective action should target.

3. Action Planning

Once the root cause is identified, define the specific actions that will eliminate it. Each action should have three things: a clear description of what will be done, a responsible person assigned to carry it out, and a due date. Actions that lack any of these three elements tend to stall.

When planning actions, consider the hierarchy of controls. Elimination of the hazard is most effective; administrative controls and PPE are least effective. A CAPA that responds to a fall hazard by retraining workers on ladder safety (an administrative control) when a platform or guardrail system (engineering control) was feasible is a weaker corrective action, and an experienced auditor or OSHA inspector will notice.

4. Implementation

Execute the planned actions. This sounds straightforward, but implementation is where CAPAs most often stall. The responsible person changes roles, the due date passes without follow-up, or the action gets partially completed and marked done. Automated reminders, escalation to a supervisor when a due date is missed, and a workflow that requires documented evidence of completion all help prevent this.

5. Effectiveness Review

After the corrective action is implemented, verify that it actually worked. Did the root cause get eliminated? Has the nonconformity recurred? An effectiveness review typically happens after a defined waiting period, long enough for the problem to resurface if the fix didn't hold. This step separates a real CAPA program from one that just generates paperwork. Without it, you have no evidence that your corrective actions are actually preventing recurrence.

6. Closure

Once effectiveness is confirmed, the CAPA is closed and becomes part of the organization's permanent record. Closed CAPAs should remain accessible for audits, trend analysis, and future investigations. A closed CAPA that can't be retrieved during an ISO audit or OSHA inspection provides no compliance value.

What Mistakes Weaken a CAPA Program?

A CAPA program that exists on paper but doesn't drive real change is worse than useless, it creates a false sense of compliance. These are the most common failure patterns:

Treating the Symptom, Not the Cause. Retraining a single worker after an incident without examining why the unsafe condition existed in the first place is a correction, not a corrective action. Auditors, internal and external, will flag this.

No Due Dates or Accountability. A CAPA assigned to "the safety team" with no individual owner and no deadline is a CAPA that won't get done.

Skipping Effectiveness Verification. Closing a CAPA immediately after implementation without verifying that the fix held removes the only feedback mechanism in the process.

Overdue CAPAs Piling Up. When the backlog of open, overdue CAPAs grows, it signals a program that has lost management support, is generating more actions than the organization can absorb, or both. A high overdue rate is one of the first things a certification auditor or regulator will look for.

Isolated CAPAs with no Trend Analysis. Each CAPA addresses a single finding, but the real value comes from looking across CAPAs for patterns, the same root cause appearing at multiple sites, the same equipment type failing repeatedly, or the same type of audit finding recurring quarter after quarter.

How does EHS Software Support the CAPA Process?

Spreadsheet-based CAPA tracking breaks down quickly. Assignments get lost in email, due dates pass without anyone noticing, and pulling trend data across dozens or hundreds of CAPAs requires manual effort that rarely happens. EHS management software addresses these problems by centralizing the process in a structured, trackable system.

EHS Insight's CAPA Module supports the full CAPA lifecycle, from identification and assignment through review, follow-up, and closure. Each CAPA record captures the five critical pieces of information the process requires: the type of action (corrective or preventive), the responsible person, the finding, the action to be taken, and the due date.

One of the most valuable capabilities is cross-module integration. CAPAs in EHS Insight can be created directly from findings in other modules, including Incident Management, Audit Management, Work Observation, Quality Management, Management of Change, Lessons Learned, and Safety Drill records. When a CAPA is generated from a parent form (for example, an incident investigation), it links back to the source record, which provides the traceability that auditors and regulators expect.

To keep actions from stalling, the module provides configurable automated reminders before and after due dates, task escalation when deadlines are missed, and a review workflow that requires documented verification before a CAPA can be closed. Organizations can also assign One-Off Training directly from a CAPA form, so that training required as part of a corrective action is tracked within the same system rather than managed separately.

For trend analysis and program oversight, the module includes built-in reports: CAPAs identified and completed by month, completion time tracking, KPI charts, CAPA status by business entity, and workflow status reports that show how long CAPAs have been sitting at each stage of the process. These reports give EHS managers and leadership visibility into whether the CAPA program is actually driving timely resolution or whether actions are aging without attention.

Frequently Asked Questions

Is CAPA required by OSHA?
OSHA does not have a single standard specifically titled "CAPA," but corrective action requirements appear throughout OSHA's regulatory framework. When OSHA issues a citation, the employer must abate the cited hazard and certify completion. Many individual standards also require corrective action when specific deficiencies or exposures are identified. If your organization is certified to ISO 45001 or ISO 14001, corrective action is a formal requirement of those management systems under Clause 10.2.

What is the difference between a correction and a corrective action?
A correction fixes the immediate problem: for example, replacing a broken fire extinguisher. A corrective action addresses the root cause to prevent recurrence: for example, investigating why the fire extinguisher failed (missed inspection cycle, procurement of substandard equipment) and fixing the underlying process. Both are necessary, but only corrective action prevents the problem from happening again.

How long should a CAPA stay open?
There is no universal regulatory answer, it depends on the complexity of the root cause and the action required. Simple corrective actions may close within days. Actions requiring capital projects, engineering redesigns, or multi-site rollouts may take weeks or months. What matters is that the CAPA has a defined due date, that progress is tracked, and that effectiveness is verified before closure. A CAPA that stays open indefinitely without documented progress is a compliance risk.

What root cause analysis methods work best for CAPA?
The 5 Whys method works well for straightforward incidents where a single causal chain is likely. Fishbone (Ishikawa) diagrams help when multiple contributing factors may be involved. Fault tree analysis is appropriate for complex, high-consequence scenarios where multiple failure paths need to be mapped. The best method is the one your team will actually use consistently, a simple 5 Whys done thoroughly is more valuable than a complex fault tree done superficially.

Can EHS software help manage CAPAs?
Yes. EHS management software centralizes the CAPA process so that findings, root cause analyses, action assignments, due dates, and effectiveness reviews are all tracked in one system rather than scattered across spreadsheets and email. Key capabilities include cross-module integration with incident and audit records for traceability, automated reminders and escalation when deadlines are missed, and built-in reporting for trend analysis and program oversight.

Build a CAPA Process That Drives Real Prevention

A CAPA program that works doesn't just close findings, it eliminates root causes, prevents recurrence, and gives your organization the documented evidence that auditors and regulators expect. If your current process relies on spreadsheets, shared drives, or email chains, you're spending more effort managing the system than managing the risk.

EHS Insight's CAPA Module connects corrective and preventive actions to the incidents, audits, and observations that generated them, with automated tracking, configurable workflows, and the reporting you need to prove your program is working.