A CAPA is the formal loop a quality system runs whenever something does not meet a requirement. This free CAPA checklist takes one record from intake to closure: log the source, correct and contain, rate the risk and decide whether corrective action is needed at all, investigate, plan and approve the actions, implement them through change control, and check effectiveness against criteria set before any work started. Supplier-caused problems add a SCAR, and medical device manufacturers get the extra checks ISO 13485 asks for.
The wording differs between frameworks, but the skeleton is shared: react to the problem, decide whether its cause needs removing, act in proportion to the risk, and prove the action worked. The table summarises where each framework puts it. It is a summary, not the text, so check the current edition you are certified or inspected against.
| Framework | Where | What it expects |
|---|---|---|
| ISO 9001:2026 | 10.2 Nonconformity and corrective action | Control and correct the nonconformity and deal with its consequences; evaluate whether the cause needs eliminating, including whether similar nonconformities exist or could occur; implement, review effectiveness, update risks and opportunities if needed, and keep documented information. Published accounts say this clause changed little from 2015. |
| ISO 9001:2026 | 6.1 Risks and opportunities | No separate preventive action clause, as in 2015. Prevention comes through planning for risks, which the 2026 edition now treats separately from opportunities. |
| ISO 13485:2016 | 8.5.2 Corrective action and 8.5.3 Preventive action | Documented procedures for both, with actions proportionate to the effects. Corrective actions must be checked so they do not harm regulatory compliance or the safety and performance of the device, and their effectiveness reviewed. |
| FDA QMSR, 21 CFR Part 820 | In force since 2 February 2026 | Part 820 now incorporates ISO 13485:2016 by reference, plus FDA’s own supplemental provisions. The old Quality System Regulation section 820.100 on CAPA is gone; the requirement now arrives through clauses 8.5.2 and 8.5.3. |
A CAPA record is not a defect log and it is not an investigation method. Individual defects found at inspection are triaged in the Defect Reporting & Resolution Checklist, and only the ones that matter become CAPAs. When a CAPA needs a full team investigation, it calls the Root Cause Analysis (8D) Checklist and waits for its verified root cause. This checklist owns everything around that: the decision to act, the approved plan, the evidence and the closure.
Seven phases follow one CAPA record. A correction-only answer at triage skips straight to closure with a recorded reason. The investigation method decides which analysis task appears, supplier problems add the SCAR tasks, and medical device work adds the ISO 13485 checks. The quality manager approves the action plan and, after the effectiveness check, the closure.
Owned by the CAPA owner. Scope questions: supplier-caused (Yes/No), regulated medical device QMS (Yes/No). The source dropdown (Audit finding / Customer complaint / Internal nonconformity / Supplier / Trend / Near miss) is kept for the record and the trend report.
Assigned to the CAPA owner. Correction deals with the item in front of you; it does not touch the cause. The supplier task is shown only when “Supplier-caused?” is Yes.
Assigned to the quality manager. Scope question: is corrective action needed (Yes / No, correction only). No hides Phases 4 to 6 and shows the reason task. The reporting task is shown only for a regulated medical device QMS.
Assigned to the investigation lead and hidden for correction only. Scope question: investigation method (5 Whys / Fishbone / 8D using the RCA checklist), which shows the matching task. The SCAR tasks are shown only when “Supplier-caused?” is Yes.
Hidden for correction only. The device check is shown only for a regulated medical device QMS. The action plan approval is assigned from the quality manager field and halts the checklist until it is Approved.
Hidden for correction only. The effectiveness check is due 90 days after the implementation date; change the offset in the template to suit how often the problem could recur. The supplier verification is shown only when “Supplier-caused?” is Yes.
The closure approval is assigned from the quality manager field and halts the checklist until it is Approved. The supplier record task is shown only when “Supplier-caused?” is Yes.
A correction fixes the thing that went wrong. A corrective action removes the cause so it does not happen again. A preventive action removes the cause of a problem that has not happened yet. Most weak CAPAs record a correction and call it corrective action. Four examples:
| Problem | Correction | Corrective action | Preventive action |
|---|---|---|---|
| An audit finds a torque wrench past its calibration date | Calibrate it and assess the product it tightened since its last good check | Make the recall list flag instruments a month before they fall due | Apply the same advance flag to every other recurring check |
| A customer receives the wrong label on a carton | Replace the cartons and confirm stock at the customer | Add a barcode scan of label against order at packing | Fit the same scan to the two packing lines that have not had the error yet |
| A supplier ships resin outside the moisture limit | Return the lot and sort parts already moulded | The supplier changes its drying process under a SCAR | Ask for test certificates on other moisture-sensitive materials |
| An operator runs a new machine without the training record | Complete and record the training | Link machine access to the training record in the start-up procedure | Add the same link to the next machine on the installation plan |
Effectiveness criteria are written in Phase 5, before the action, so nobody adjusts the target to match the result. Good ones name a measure, a target and a period, for example:
“Action implemented” is not an effectiveness criterion. Neither is “operators retrained”. Both describe effort, not the result. If the criteria are not met, the cause was probably wrong, which is why the checklist sends a failed check back to the investigation.
Not every nonconformity deserves an investigation. Answering “No, correction only” at triage hides the investigation, plan and effectiveness phases, and the closure still needs the quality manager to accept the recorded reason.
The check falls due a set number of days after the implementation date, assigned to a named owner. Two approvals halt the checklist: the action plan before work starts, and the closure after the data is in.
Evidence, the SCAR response and the linked 8D sit on the tasks that produced them, and every step carries a name and a timestamp in the audit trail. The REST API and MCP server let another system open a CAPA run automatically.
CheckFlow is not an eQMS, and it does not replace a validated system your regulator expects you to use. It runs the human process of each CAPA, so every record follows the same steps whoever owns it. CheckFlow for compliance teams covers recurring regulatory checks, and CheckFlow for manufacturing covers the production side. ISO 13485 clause 4.1.6 expects software used in a medical device QMS to be validated before first use, in proportion to the risk.
Most CAPAs start with an audit finding. The ISO 9001 Internal Audit Checklist produces findings in a form this checklist can log directly, and out-of-tolerance results from the Calibration Management Checklist often open one too.
Log the nonconformity and its source, make the immediate correction and contain affected output, rate the risk and decide whether corrective action is needed, investigate the root cause, plan and approve actions with owners, dates and effectiveness criteria, implement through change control, check effectiveness after a set period, then close the record and feed the trend into management review.
Not as a separate clause. ISO 9001:2015 dropped the preventive action clause in favour of risk-based thinking under clause 6.1, and the 2026 edition keeps that approach. ISO 13485:2016 is different: clause 8.5.3 still requires a documented preventive action procedure, so medical device manufacturers keep the P in CAPA.
Every nonconformity needs a response, but not every one needs corrective action. ISO 9001 asks you to evaluate the need for action on the cause, in proportion to the effects. A low-risk one-off with an obvious cause can close with a correction and a recorded reason. Repeats, customer complaints and anything touching safety deserve the full loop.
Long enough for the problem to have come back if the fix had failed. A defect seen weekly can be judged in a month or two; one that appears at an annual audit needs the next audit. Set the period with the criteria in the action plan, not when the check falls due.
From 2 February 2026, 21 CFR Part 820 incorporates ISO 13485:2016 by reference, and the old section 820.100 no longer exists. FDA now looks for corrective and preventive action through clauses 8.5.2 and 8.5.3, alongside the supplemental provisions in Part 820 itself. Check the current regulation and FDA’s guidance for your device class.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
