Mastering CAPA Management in the Medical Device Industry

Mastering CAPA management is part of the proactive quality mindset that regulators demand, but it is also an absolute requirement for achieving commercial success in the medical device industry.

Requirements for CAPA management as they apply to the highly regulated world of medical device development can all be found within ISO 13485:2016, the MHRA guidelines, and FDA 21 CFR Part 820.100

What is CAPA management?

CAPA refers to two distinct requirements for documented ‘Corrective Action’ and ‘Preventative Action’ procedures that should form part of your med tech Quality Management System.  They should outline how your company deals with the identification and correction of existing or potential non-conformities in its processes and end products - and how it resolves to prevent them from occurring (or reoccurring) in the future. 

As the supporting FDA material succinctly puts it:

The purpose of the corrective and preventive action subsystem is to collect information, analyze information, identify and investigate product and quality problems, and take appropriate and effective corrective and/or preventive action to prevent their recurrence

Both the Corrective Action and Preventative Action you undertake should be part of a seven-step process, that all needs to start with the capturing, recording and defining of the actual or potential problem, non-conformity or incident.  

This includes not only providing for the swift reporting of existing failures but having proactive measures in place designed to regularly check that systems remain fit for purpose.  Such proactive measures include risk assessments, failure modes and effects analysis (FMEA) as well as audits, management reviews and inspections.

The 7 steps of CAPA management

1. Identify the issue

In the first instance, your Quality Management System must have a way of receiving and logging a problem or potential problem with your end product that someone within or outside the organisation has raised. Even if further CAPA is not required or appropriate, there should be a place where the issue can be raised and logged for future auditing and tracking. The log must include a written description of the problem, the source of the information that initiated the action and a detailed explanation of the problem and the evidence that the problem itself exists.

One of the main issues around CAPA for a business is the frequency with which the process is invoked.  If it’s triggered too much (and unnecessarily) it can exhaust time and resource.  If it’s used too little, it implies the system is not working properly and nonconformities are remaining unaddressed.  To counter this, the CAPA process should only be used for the resolution of systemic problems.

2. Evaluate the problem

The problem described and documented above should be evaluated to determine the need for action and the level of action required to solve the issue. This includes assessing the actual risks to the company and or/their customers presented by the failure (particularly any danger to human health and life resulting from it). This is the point where the CAPA request should be actioned or denied.

3. Investigate the failure

The Quality Management system must have a documented process for investigating any confirmed issues that have been raised: this includes an objective for the actions that will be taken, the procedure to be followed, the personnel that will be responsible for the investigation and any other resources that will need to be accessed in the process.

4. Analyse the root cause

The investigation will analyse and determine the root cause of the problem described, together with any contributing factors. This process involves collecting data, documenting and evidencing the cause of the issue that is being investigated.

5. Plan the resolution

Based on the analysis the team should develop an action plan to correct and/or prevent the problem from occurring in the future. The plan should list:

• Actions to be completed
• Required document or specification changes
• Any necessary process, procedures or system changes
• Employee training adjustments to be implemented
• Future monitors or controls necessary for preventing recurrence of the problem
• The people within the organisation who will be responsible for completing each task.

6. Implement the plan

All of the required tasks listed and described in the action plan should be initiated, completed and documented. This will create a complete record of the actions taken to correct the problem and ensure it will not recur.

7. Follow-up 

A thorough follow-up process should be undertaken and documented, which will include:

• Verification the implementation and completion of all changes, controls and training required
• Verification that the actions taken have been effective
• The addition of further information or comments that may be helpful in understanding CAPA actions.

How to make sure your CAPA process is effective and efficient

Digital Quality Management Systems can play a pivotal role in streamlining and automating the CAPA processes that are so integral to the safety of Medical Devices, and, by extension, the success of the companies who produce them. 

The right QMS can digitise these processes, automate workflows, augment them with notification and reminders, such that the right stakeholders can be alerted and kept in the loop throughout an investigation and subsequent corrective activities. It can reduce the possibilities of errors being made and the danger of liabilities and losses. The right QMS should help you document and record every part of a CAPA process with the detail that the regulators require and in a way that will be easily auditable in the future. 

According to the FDA, inadequate CAPA planning is one of the most common reasons for regulated companies in the States to receive a ‘483’ (a form used by the FDA to document and communicate concerns raised during inspections).

CAPA is given prominence in modern regulator's thinking, not only because it is a mechanism for raising and correcting potentially lethal product failures, but it is the mechanism by which they can be prevented from happening in the first place. It is part of a shift by regulators around the world from a paradigm of ‘inspect and correct’, to creating a culture of learning from errors and developing best practices through a process of constant, internal review.

Good CAPA management is all part of this proactive quality mindset, the risk-based approach to medical device development, that should feed into cycles of continuous improvement. Done right, it helps make companies more efficient and their products of incrementally higher quality.