CAPA (Corrective & Preventive Action) Checklist Template

Owned by the CAPA owner. Scope questions: supplier-caused (Yes/No), regulated medical device QMS (Yes/No). The source dropdown (Audit finding / Customer complaint / Internal nonconformity / Supplier / Trend / Near miss) is kept for the record and the trend report.

• Name the CAPA owner, quality manager and investigation lead — later tasks are assigned from these three fields
• Record the source and its reference — audit finding, customer complaint, internal nonconformity, supplier, trend or near miss, with the audit, complaint or report number
• Answer the scope questions — whether a supplier caused the problem, and whether this CAPA sits in a regulated medical device QMS
• Describe the nonconformity against the requirement — what the procedure, specification or contract required, what was found, and where
• Attach the evidence — the audit report, complaint, photos, measurements or records that show the gap

Assigned to the CAPA owner. Correction deals with the item in front of you; it does not touch the cause. The supplier task is shown only when “Supplier-caused?” is Yes.

• Make the immediate correction — rework the part, re-issue the document, recalibrate the gauge or complete the missed training
• Contain affected product or output — hold stock, stop shipments and check what has already gone out since the last good check
• Deal with the consequences — customer notices, credits, re-inspection or a re-audit, as the situation needs
• Quarantine the supplier’s material and tell the supplier — lot numbers, quantities and the date of the hold
• Record what was done and when — the correction and containment dates are the baseline for everything that follows

Assigned to the quality manager. Scope question: is corrective action needed (Yes / No, correction only). No hides Phases 4 to 6 and shows the reason task. The reporting task is shown only for a regulated medical device QMS.

• Rate the risk — severity and likelihood of recurrence on your own risk matrix, with the score recorded
• Search for earlier occurrences — the CAPA log, complaints and audit history for the same nonconformity here or at other sites
• Decide whether corrective action is needed — Yes, or No when a correction alone is proportionate to the risk
• Record why a correction is enough — for example a one-off, low risk, with the cause already known and removed
• Assess regulatory reporting — the regulatory lead decides under your complaint handling and vigilance procedures whether this must be reported

Assigned to the investigation lead and hidden for correction only. Scope question: investigation method (5 Whys / Fishbone / 8D using the RCA checklist), which shows the matching task. The SCAR tasks are shown only when “Supplier-caused?” is Yes.

• Choose the investigation method — 5 Whys, Fishbone, or 8D using the RCA checklist, in proportion to the risk rating
• Run a 5 Whys with the people who do the work — one chain of causes, stopping at a cause the organisation controls
• Draw a fishbone and test the likely causes — collect data on the two or three strongest candidates before picking one
• Run the Root Cause Analysis (8D) Checklist and link it here — paste the link to the 8D run and record its verified root cause
• Issue a supplier corrective action request (SCAR) — the nonconformity, the evidence and a date for the supplier’s root cause and actions
• Review the supplier’s response — send it back if the cause is “operator error” or the action is “retrain” with nothing else
• Record the root cause with its evidence — one or two sentences a stranger could check against the data

Hidden for correction only. The device check is shown only for a regulated medical device QMS. The action plan approval is assigned from the quality manager field and halts the checklist until it is Approved.

• Define a corrective action for each root cause — the change to the process, design, document, training or supplier that removes it
• Look for the same cause elsewhere — similar products, lines, sites and suppliers, each added to the plan or ruled out with a reason
• Write the effectiveness criteria now — the measure, target, period and data source that will prove the action worked
• Give each action an owner and a due date — one named person per action, never a department
• Check the actions do not affect device safety, performance or compliance — record the assessment, as ISO 13485 clause 8.5.2 expects
• Quality manager approval of the action plan — actions, owners, dates and effectiveness criteria agreed before work starts

Hidden for correction only. The effectiveness check is due 90 days after the implementation date; change the offset in the template to suit how often the problem could recur. The supplier verification is shown only when “Supplier-caused?” is Yes.

• Make the changes through change control — drawings, programs, equipment and settings changed and released together
• Update documents and train the people affected — procedures, work instructions and forms, with training records attached
• Record the implementation date — the date the last action was complete, which sets the effectiveness check due date
• Verify the supplier’s actions — evidence of their change, then tightened incoming inspection on the next lots
• Check effectiveness against the criteria — compare the data with the targets set in Phase 5 and record met or not met
• Reopen the investigation if the criteria are not met — return to Phase 4 with the new data rather than adding another action

The closure approval is assigned from the quality manager field and halts the checklist until it is Approved. The supplier record task is shown only when “Supplier-caused?” is Yes.

• Confirm every action is complete with evidence — or, for correction only, that the reason is recorded and the correction done
• Quality manager approval to close the CAPA — effectiveness shown, or the correction-only reason accepted
• Update the supplier’s performance record — the SCAR, its response time and the result, for the next supplier review
• Update the risks and opportunities register — add any new risk the CAPA revealed and revise ratings that changed
• Add the CAPA to the trend report — source, cause category, risk rating and days open
• Feed the management review — trends in nonconformities and corrective actions, with overdue and reopened CAPAs called out