ISO 9001 Corrective Action (CAPA): Five Steps From Finding to Closure

A customer complaint, an internal audit finding, a defect that keeps coming back on the line — whether a quality management system really works shows in how it responds to nonconformities. Corrective and preventive action (known in Turkish as DÖF) aims not just to fix the problem but to stop it happening again.

In many companies, though, CAPA forms sit in spreadsheets and folders, deadlines slip and records are rushed to completion before the audit. This article covers what ISO 9001:2015 clause 10.2 requires, the steps of an effective process, and how to run them as a digital workflow.

What clause 10.2 requires

When a nonconformity occurs, the standard expects the organisation to:

• React to it: control and correct it, and deal with the consequences.
• Review it, determine its root cause, and check whether similar issues exist or could occur elsewhere.
• Implement the action needed and review its effectiveness.
• Update risks and the quality management system where necessary.
• Retain documented information on the nonconformity, the actions taken and the results.

Where CAPA records come from

A CAPA record can originate from many places. Recording the source shows which areas generate the most issues:

• Customer complaints and returns
• Internal and external audit findings
• Nonconformities in production or service delivery
• Supplier-related problems
• Occupational health and safety incidents and near misses
• Management review and employee suggestions

Corrective vs preventive action

Corrective action removes the root cause of a nonconformity that has already happened. Preventive action addresses a potential one that hasn’t happened yet. ISO 9001:2015 no longer has a separate clause for preventive action; risk-based thinking took its place. Many organisations still keep the CAPA label and open preventive records for potential risks — which fits perfectly well with a risk-based approach.

Root cause analysis with the 5 Whys

A superficial fix brings the problem back. The 5 Whys technique asks “why?” repeatedly to move from symptom to root cause:

1. A product shipped with the wrong label. Why?
2. The label was printed incorrectly. Why?
3. The printer template was an old revision. Why?
4. The template change was never communicated to the line. Why?
5. Document revisions had no distribution or read confirmation.

Here the lasting fix isn’t reprinting labels — it’s repairing document distribution.

Don’t leave the analysis to one person. A short session with the process owner, the operator on the floor and the quality officer produces far more realistic answers than a form filled in at a desk. Where there are several causes, a fishbone (Ishikawa) diagram helps group them under people, method, machine, material and measurement.

An effective CAPA process in five steps

1. Approval: the new record is assessed, confirmed as a real nonconformity and assigned an owner.
2. Deadline: a realistic due date is set.
3. Work: the owner carries out root cause analysis and actions, attaching evidence such as photos and documents.
4. Quality review: the quality team checks whether the action is adequate and effective, and sends it back if not.
5. Closure: once effectiveness is confirmed, the record is closed and retained.

How to verify effectiveness

The question before closure is simple: has the root cause gone? Allow a reasonable period after the action and check whether the same nonconformity recurs. In the label example, evidence would be subsequent shipments free of the error and confirmation that the relevant staff have read the new revision.

Common mistakes

• Treating a correction (sorting out defective parts) as corrective action.
• Writing “human error” as the root cause and stopping there.
• Setting deadlines but never following them up.
• Closing records without verifying effectiveness.
• Keeping occupational health and safety issues invisible to the quality system.
• Finding an outdated document revision as the root cause but never updating the document, so the error reappears on another line.
• Never analysing closed records; repeated CAPAs from the same source point to a systemic issue.

CAPA in HibritİK Quality Management

HibritİK Quality Management runs CAPA through the same five-step flow — approval, deadline, work, quality review, closure:

• Each record captures the source (e.g. complaint, internal audit), 5-why root cause fields, attachments and an OHS flag.
• Automatic reminders go out when a deadline is approaching or overdue.
• The document library handles folders, revisions, distribution and read acknowledgement; revision requests follow an approval chain (Manager → Quality Officer → QMR → General Manager) configurable per folder.
• Internal audit forms are organised as group → category → question, answered OK / Not OK.
• Supplier evaluation scores four criteria from 0 to 5.

Records export to Excel, and CAPA and document work can be followed from the mobile app too. For the wider picture, read digitalising ISO quality management, and for tracking follow-up work with approvals see our task approval guide.

Conclusion

CAPA is how a quality system learns. Every record that reaches the root cause, meets its deadline and is verified as effective becomes evidence at the next audit. Start your 14-day free trial to bring your quality processes into one place, or get in touch with questions.