CAPA form template

A corrective and preventive action form is the record that carries one quality problem from the event to a verified fix: the problem, what was done to contain it, the investigation and root cause, the actions with owners and dates, a planned effectiveness check, and a signed closure. Device makers keep it under the FDA QMSR, which brought ISO 13485 into 21 CFR 820; drug makers keep it to meet the investigation and quality-unit duties of 21 CFR 211.

The form above is built around the deviation that most often turns into a CAPA in a QC lab. Raise the deviation itself in your deviation system first; our deviation management software comparison shows which tools carry the link from a deviation to its CAPA.

1. 01

   Pick who the CAPA is for

   Device maker or drug maker. The toggle changes the governing requirement printed in the header and the wording of the extent field.

2. 02

   Link the source

   Every CAPA starts from a record: a deviation, a complaint, an audit finding or a trend report. Put its number in the header so either record leads to the other.

3. 03

   Write the problem, then contain it

   Facts and numbers first. Containment is what you did to the product and the material this week; it is not the CAPA.

4. 04

   Work the why chain to a cause you can remove

   Each answer becomes the next question. Stop when the answer is something a procedure, a system or a design change can remove.

5. 05

   Plan actions with owners and dates

   Corrective actions remove the cause found. Preventive actions take the same fix to places where the problem has not happened yet.

6. 06

   Set the effectiveness criteria before the plan is signed

   A number, a window and the data you will read. The form flags a check dated before the last action is due.

7. 07

   Sign twice, for two different things

   The first signature approves the plan. The second, weeks or months later, verifies the result against the criteria and closes the CAPA.

Print it from the Record tab for a paper CAPA signed in ink, or Copy it as plain text into your quality system. The record checks above the form list what a reviewer will look for before each signature.

The pre-filled CAPA follows a reference standard used in six release assays after its retest date. It is a lab problem with a system cause, which is why it shows the gap between containment and a real corrective action. Here is how its key entries are written.

Containment is a correction, not the CAPA

FDA draws the line in the QMSR preamble: a correction “may also refer to scrap, repair, rework, or adjustment and relates to eliminating a nonconformity, whereas ‘corrective action’ relates to the elimination of the cause of nonconformity and to prevent recurrence.” Quarantine, holds and re-tests go in section 2. Section 4 holds only what removes the cause.

Preventive means somewhere it has not happened yet

FDA kept corrective and preventive action as two clauses when it adopted ISO 13485, and said its earlier reading of preventive action “did not apply solely to preventing recurrence of quality problems.” In the example, the expiry block on reagents and columns is preventive: none has failed, but the same gap is there.

Size the effort to the risk

For devices FDA expects the action to be “appropriate to the magnitude of the problem and commensurate with the risks encountered.” For drugs, a CAPA follows from § 211.192: a discrepancy is “thoroughly investigated, whether or not the batch has already been distributed”, and the written record “shall include the conclusions and followup.” Deviations from a written procedure are “recorded and justified” (§ 211.100(b)).

Effectiveness is decided before it is measured

The device rule, in FDA's words: manufacturers “must verify or validate corrective and preventive actions to ensure that such actions are effective and do not adversely affect the finished device.” FDA's Q10 guidance says the same for drug manufacturing: “the effectiveness of the actions should be evaluated.” Write the criteria before the plan is signed, so the result cannot be fitted to the data.

The form carries two signature blocks because they record different acts. The first approves the investigation, root cause and plan. The second, after the check, verifies that the result met the criteria and closes the CAPA. § 11.50(a) asks each electronic signature to show the printed name, the date and time, and “the meaning (such as review, approval, responsibility, or authorship)”. One signature cannot carry both meanings. For a drug maker the quality control unit has the authority to review records “to assure that no errors have occurred or, if errors have occurred, that they have been fully investigated” (§ 211.22(a)). For devices, FDA reads ISO 13485's “approved” as a signature and date, and accepts electronic signatures that meet its requirements.

• Printed and signed in ink: the paper is the record. FDA's 2003 guidance says that when paper printouts meet the predicate rules and are relied on, using a computer to make them does not trigger Part 11.
• Signed in a quality system: both signatures fall under Part 11. The name, date and time and meaning must appear on every display and printout (§ 11.50(b)), each signature is linked to this CAPA so it cannot be copied to another (§ 11.70), and every later edit to the root cause is trailed without hiding the first entry (§ 11.10(e)). Test your system's output with the signature manifestation check and its trail with the audit trail review checklist.

A paper or spreadsheet CAPA log works for a handful a year. Past that, the gaps are links and dates: a deviation with no CAPA number, an action past due with no one told, an effectiveness check nobody scheduled. Our comparison of Part 11 compliant CAPA software reads each vendor against the signature and audit-trail rows above, and the eQMS comparison covers suites where CAPA, deviations and change control share one record.

The rule text and guidance this form is built from, each read on the date shown.

1. 21 CFR Part 11, Electronic Records; Electronic Signatures, eCFRread 2026-10-22
2. 21 CFR 211.192, Production record review, eCFRread 2026-10-22
3. 21 CFR 211.22, Responsibilities of quality control unit, eCFRread 2026-10-22
4. 21 CFR 211.100, Written procedures; deviations, eCFRread 2026-10-22
5. 21 CFR 820.35, Control of records, eCFRread 2026-10-22
6. Medical Devices; Quality System Regulation Amendments, final rule, 89 FR 7496 (2024), Federal Registerread 2026-10-22
7. Q10 Pharmaceutical Quality System (guidance, April 2009), FDAread 2026-10-22
8. Part 11, Electronic Records; Electronic Signatures: Scope and Application (2003), FDAread 2026-10-22