CAPA in practice: from root cause to effectiveness review

CAPA is not an audit task list

A CAPA process should remove the cause of a problem and confirm that the problem does not recur. Completing a task — updating a form, training a team, or changing an instruction — is not yet evidence of effectiveness. The record must connect the observed fact with the final decision.

A minimum workflow covers:

1. an unambiguous description of the nonconformity or risk,
2. immediate containment,
3. evidence-based root cause analysis,
4. a corrective action with an owner and deadline,
5. implementation evidence,
6. a planned effectiveness review,
7. a decision to close, extend observation, or reopen the CAPA.

1. Separate the problem from its effect

“An employee made a mistake” is not a useful problem statement. It does not identify the expected condition, the observed condition, or the evidence supporting the gap. Record the process, requirement, event, time, scope, and impact.

Contain the situation before searching for the cause. Containment may block a batch, correct data, add a temporary control, or notify the process owner. It limits further impact but does not replace corrective action.

2. Analyse the mechanism, not the person

Methods such as 5 Why, cause diagrams, or barrier analysis help only when each question follows the previous answer and is supported by data. Mark a hypothesis as a hypothesis until it is tested.

Root causes usually sit in the process mechanism: an unclear criterion, missing validation, unavailable information, an ineffective control, or a mismatch between the instruction and real work. Naming a person without examining the system often allows the problem to recur.

3. Plan a change that can be verified

A corrective action needs an owner, due date, intended result, and implementation evidence. “Train the team” is incomplete. Identify the material version, affected people, knowledge check, and pass criterion.

The action plan should record:

• the CAPA identifier and linked finding,
• the verified root cause,
• action, owner, and deadline,
• dependencies,
• implementation evidence,
• effectiveness measure,
• review date and reviewer.

4. Do not confuse completion with effectiveness

Publishing a document does not prove that a process improved. Review effectiveness after a period appropriate to the risk and process frequency. Use a record sample, a later audit, complaints, an error metric, or observation of the control.

Set the criterion before collecting results. For example: “the next 30 orders have all mandatory fields complete, and the second-person control catches a missing field before publication.” A positive decision needs evidence. A negative result leads back to analysis instead of a cosmetic status change.

5. Build a closure pack

An auditable CAPA closure pack contains the problem statement, containment, root cause analysis, approved plan, implementation evidence, effectiveness result, and an authorised decision. The change history remains available after closure.

Pulsar GRC can connect a finding, risk, control, owner, and evidence in one trace. It does not choose the root cause or approve effectiveness on behalf of the organization.

Closure checklist

• Is the problem based on facts?
• Is containment separate from correcting the cause?
• Does the analysis identify a process mechanism and supporting evidence?
• Does every action have an owner, deadline, and intended result?
• Is implementation evidence tied to the correct change version?
• Was the effectiveness criterion set before measurement?
• Can the approver see the complete history and residual risk?

Feed the result into the ISO 9001 audit evidence pack. If the action concerns cybersecurity obligations in Poland, also use the NIS2 self-identification guide for SMEs.