Requirements for CAPA management as they apply to the highly regulated world of medical device development can all be found within ISO 13485:2016, the MHRA guidelines, and FDA 21 CFR Part 820.100
CAPA refers to two distinct requirements for documented ‘Corrective Action’ and ‘Preventative Action’ procedures that should form part of your med tech Quality Management System. They should outline how your company deals with the identification and correction of existing or potential non-conformities in its processes and end products - and how it resolves to prevent them from occurring (or reoccurring) in the future.
As the supporting FDA material succinctly puts it:
The purpose of the corrective and preventive action subsystem is to collect information, analyze information, identify and investigate product and quality problems, and take appropriate and effective corrective and/or preventive action to prevent their recurrence
Both the Corrective Action and Preventative Action you undertake should be part of a seven-step process, that all needs to start with the capturing, recording and defining of the actual or potential problem, non-conformity or incident.
This includes not only providing for the swift reporting of existing failures but having proactive measures in place designed to regularly check that systems remain fit for purpose. Such proactive measures include risk assessments, failure modes and effects analysis (FMEA) as well as audits, management reviews and inspections.
In the first instance, your Quality Management System must have a way of receiving and logging a problem or potential problem with your end product that someone within or outside the organisation has raised. Even if further CAPA is not required or appropriate, there should be a place where the issue can be raised and logged for future auditing and tracking. The log must include a written description of the problem, the source of the information that initiated the action and a detailed explanation of the problem and the evidence that the problem itself exists.
One of the main issues around CAPA for a business is the frequency with which the process is invoked. If it’s triggered too much (and unnecessarily) it can exhaust time and resource. If it’s used too little, it implies the system is not working properly and nonconformities are remaining unaddressed. To counter this, the CAPA process should only be used for the resolution of systemic problems.
The problem described and documented above should be evaluated to determine the need for action and the level of action required to solve the issue. This includes assessing the actual risks to the company and or/their customers presented by the failure (particularly any danger to human health and life resulting from it). This is the point where the CAPA request should be actioned or denied.
The Quality Management system must have a documented process for investigating any confirmed issues that have been raised: this includes an objective for the actions that will be taken, the procedure to be followed, the personnel that will be responsible for the investigation and any other resources that will need to be accessed in the process.
The investigation will analyse and determine the root cause of the problem described, together with any contributing factors. This process involves collecting data, documenting and evidencing the cause of the issue that is being investigated.
Based on the analysis the team should develop an action plan to correct and/or prevent the problem from occurring in the future. The plan should list:
All of the required tasks listed and described in the action plan should be initiated, completed and documented. This will create a complete record of the actions taken to correct the problem and ensure it will not recur.
A thorough follow-up process should be undertaken and documented, which will include:
Digital Quality Management Systems can play a pivotal role in streamlining and automating the CAPA processes that are so integral to the safety of Medical Devices, and, by extension, the success of the companies who produce them.
The right QMS can digitise these processes, automate workflows, augment them with notification and reminders, such that the right stakeholders can be alerted and kept in the loop throughout an investigation and subsequent corrective activities. It can reduce the possibilities of errors being made and the danger of liabilities and losses. The right QMS should help you document and record every part of a CAPA process with the detail that the regulators require and in a way that will be easily auditable in the future.
According to the FDA, inadequate CAPA planning is one of the most common reasons for regulated companies in the States to receive a ‘483’ (a form used by the FDA to document and communicate concerns raised during inspections).
CAPA is given prominence in modern regulator's thinking, not only because it is a mechanism for raising and correcting potentially lethal product failures, but it is the mechanism by which they can be prevented from happening in the first place. It is part of a shift by regulators around the world from a paradigm of ‘inspect and correct’, to creating a culture of learning from errors and developing best practices through a process of constant, internal review.
Good CAPA management is all part of this proactive quality mindset, the risk-based approach to medical device development, that should feed into cycles of continuous improvement. Done right, it helps make companies more efficient and their products of incrementally higher quality.