Corrective vs Preventive Action: A Practical CAPA Guide

Every company fixes problems. Fewer fix them for good. The difference is usually not effort but structure: whether someone asks why the problem happened, removes that cause, checks a few weeks later that it is really gone, and makes sure the same weakness is not waiting somewhere else.

That structure is what CAPA, short for corrective and preventive action, describes. This guide explains the three terms people mix up most (correction, corrective action and preventive action), walks through the CAPA process, shows how to write a CAPA that gets closed properly, and covers how to verify effectiveness, which is the step most CAPAs skip.

What is CAPA?

CAPA stands for corrective and preventive action. It is a quality management process for dealing with problems systematically: find the real cause of a problem, act on it, and prove the action worked. The term is used across manufacturing, medical devices, pharmaceuticals, food, logistics and services, and a CAPA is often recorded in a form or a quality management system so it can be tracked and audited.

A CAPA can be triggered by many things: customer complaints, internal audit findings, defects, service failures, supplier problems, incidents, or a trend that is heading the wrong way. The common thread is that someone decided this problem deserves more than a quick fix.

Correction vs corrective action vs preventive action

These three are easy to confuse, because they often happen in the same week and in the same document. The question each one answers is different.

Example 1: a manufacturing defect

A batch of machined parts is found to be out of tolerance.

• Correction: sort the batch, rework what can be reworked and scrap the rest.
• Corrective action: the root cause is a worn clamping fixture; replace it and add a wear check to the machine's maintenance schedule.
• Preventive action: three other machines use the same fixture type and have not produced bad parts yet; put them on the same wear-check schedule and add the failure mode to the risk analysis.

Example 2: customers charged twice

Several customers complain that one payment was taken twice.

• Correction: refund the duplicate charges and apologise to each customer.
• Corrective action: the root cause is a payment retry that fires when the bank responds slowly, even if the first attempt succeeded; change the retry so it checks the first attempt's status before charging again.
• Preventive action: review other flows with the same retry pattern (subscription renewals, top-ups) before they fail the same way, and set up a daily check for duplicate charges.

Example 3: wrong information from the contact centre

Customers say agents told them they could return a product within 30 days, but the policy changed to 14 days.

• Correction: contact the affected customers and honour what they were told.
• Corrective action: the root cause is that the knowledge base article was not updated when the policy changed, because nobody owned it; update it and assign an owner.
• Preventive action: link every policy document to the knowledge base articles that quote it, so any policy change triggers a review of those articles.

A useful test: if the only thing that happened is that the affected customers or products were fixed, you have a correction. If the cause is gone, you have a corrective action. If you also closed the same gap where it has not bitten yet, you have preventive action.

The CAPA process, step by step

Companies use different names and numbers of steps, but most CAPA processes follow the same logic.

1. Identify the problem

Write down what happened, where, since when and how much, against a baseline. Keep causes and solutions out of the problem statement. "Complaints about X rose from 15 to 140 a month since June" is a problem statement. "Complaints rose because the new system is buggy" is a guess.

Also decide whether this problem needs a CAPA at all. Opening a CAPA for every small issue clogs the system; a good rule is to open one when a problem repeats, affects many customers, has a cost, safety or compliance impact, or when the cause is unclear.

2. Contain it

Protect customers while you investigate: hold suspect stock, add a temporary check, switch a feature off, call the customers already affected. Containment is not the fix, and it should have an end date. It belongs in the CAPA record so everyone knows what is temporary.

3. Investigate the root cause

Find the cause that, if removed, would stop the problem coming back, and verify it with evidence. Use 5 Whys to follow a chain of causes, a fishbone diagram to map candidate causes before you choose, or the root cause analysis template to document evidence. A verified root cause explains when the problem started and why it happens in some places and not others.

Also ask why your existing checks did not catch the problem earlier. In 8D language this is the escape point, and it often deserves its own action.

4. Take corrective and preventive action

Plan actions that remove the verified cause (corrective) and close the same gap in similar processes, products or regions (preventive). Each action needs an owner, a due date and a clear link to the cause it addresses. If an action does not address a cause in the investigation, ask why it is there.

5. Verify effectiveness

Check, with data, that the actions worked: the problem stopped and has not come back. Define the metric, target and time window before you act. This step is covered in detail below.

6. Standardise and close

Update procedures, work instructions, checklists, training material, system settings and risk analyses so the fix is part of how work is done. Share the lesson with teams that run similar processes. Then close the CAPA formally, with a named person signing off.

For serious customer complaints, many teams run these steps as an 8D. 8D adds team formation, a structured problem description (is/is-not) and recognition at the end, and the result is usually recorded as a CAPA.

How to write a CAPA that gets closed properly

A CAPA that drifts for months usually has a weak problem statement, a vague root cause or actions nobody can verify. Writing each field well from the start is what makes closure possible.

Illustrative example, not customer data.

A few rules that keep CAPAs closable:

• One problem per CAPA. If the investigation finds two unrelated causes, split them.
• Numbers in the problem statement, with a baseline, so you can tell later whether it improved.
• Evidence for the root cause: data, a test, a reproduction, not just agreement in a meeting.
• Every action linked to a cause, with an owner and a date.
• Success criteria written before acting, so nobody moves the goalposts afterwards.
• A realistic scope. A CAPA that tries to redesign the whole company never closes.

Next step: start from a filled-in example with our free corrective action plan template. It has a CAPA plan, an action log with overdue highlighting and an effectiveness check with 30/60/90-day results.

How to verify effectiveness

Effectiveness verification answers one question: did the actions solve the problem? Not "were the actions completed", which is a different and much weaker question. A training session can be completed and change nothing.

A practical approach:

1. Choose the metric before you act. It should measure the problem itself: complaint rate, defect rate, repeat incidents, audit findings. For the example above: charge-after-cancel tickets per month and accounts charged after cancelling.
2. Record the baseline, both before the problem started and at its peak.
3. Set a target and a time window. For example: at or below the old baseline at 30, 60 and 90 days after the fix is live. Pick a window long enough to cover the normal cycle of the problem; a monthly billing issue needs at least a few billing cycles.
4. Check that the cause is gone, not only the symptom. If the root cause was a billing job ignoring a flag, test that job directly as well as watching complaints.
5. Look for side effects. Did the fix create a new problem somewhere else?
6. Decide honestly. If a check fails, reopen the investigation. The root cause may have been wrong, or only one of several. Adding more actions on top of an unverified cause rarely helps.

Many teams record the result as PASS or FAIL for each check and close the CAPA only when every check passes.

Common CAPA mistakes

• Closing on "retrained staff". Training is sometimes part of the answer, but on its own it assumes the problem was people not knowing what to do. Ask what in the process allowed the mistake, and change that. If you do retrain, check whether the error rate actually fell.
• No effectiveness check, or an effectiveness check that only confirms the action was completed.
• Recording a correction as a corrective action. Refunding customers or reworking parts fixes this instance, not the cause.
• "Human error" as the root cause. People make mistakes in every process; the root cause is why the process let the mistake through.
• Actions not linked to the root cause. A long list of good ideas that do not address the verified cause.
• Containment that never ends, hiding the problem and costing money every day.
• Too many CAPAs. Opening one for every small issue buries the important ones. Use clear criteria.
• Working from a sample. If the evidence is a few complaints someone remembered, the root cause may be the loudest one, not the biggest.
• No preventive look-across. The same weakness often exists in similar products, sites or flows.

What about preventive action in ISO 9001 and FDA rules?

Standards treat preventive action differently, which is a common source of confusion. A short summary, not legal or compliance advice:

• ISO 9001. The 2015 edition dropped the separate preventive action requirement. Prevention moved into planning, as actions to address risks and opportunities (often called risk-based thinking), while nonconformity and corrective action stayed in the improvement section. A new edition, ISO 9001:2026, was published in September 2026 and keeps the same top-level clause structure (clauses 4 to 10); certified organisations have a transition period. Check exact wording against your own copy of the standard.
• ISO 13485 (medical devices). ISO 13485:2016 keeps separate clauses for corrective action and preventive action.
• US FDA medical device rules. CAPA used to be spelled out in 21 CFR 820.100. Since 2 February 2026, the FDA's Quality Management System Regulation (QMSR) incorporates ISO 13485:2016 by reference, so CAPA requirements for device makers now come through that standard, alongside FDA-specific requirements.

Whatever your standard says, the practical logic is the same: fix what happened, remove its cause, look for where else it could happen, and prove it worked. If you work in a regulated industry, your quality and regulatory team should confirm what applies to you.

Where customer feedback fits in CAPA

For many companies, the "identify" step starts with customers: complaints, support tickets, survey comments and reviews. That is also where it often goes wrong. A rising problem can sit unnoticed in thousands of comments, or be filed under the wrong category, and by the time it reaches a CAPA the investigation works from a handful of examples someone remembered.

This is the part Pivony helps with. Pivony brings tickets, NPS surveys, call centre transcripts, app reviews and other feedback into one place, groups what customers say by meaning, and overlays your segment and operational data, so a CAPA starts from which issue, which segment, which channel and since when, based on all of your feedback rather than a sample. Watching the same feedback after the fix also gives the effectiveness check a second, customer-side signal. The CAPA itself, with its owners, actions and sign-off, stays in your quality process.

Related reading

• 8D problem solving: the eight disciplines, with an example
• Root cause analysis in customer feedback: the complete guide
• 5 Whys root cause analysis: how it works, with CX examples
• Fishbone analysis: complete guide for CX teams
• Free root cause analysis template
• Free 8D report template
• Free FMEA template

Next step

Download the free corrective action plan template and write your next CAPA from the filled-in example. If the problem starts in customer complaints, request a free root cause audit on a sample of your tickets, reviews or survey comments, or book a demo.