TL;DR
- CAPA (Corrective and Preventive Action) is a formal quality-system requirement under 21 CFR 820.100 for devices and expected practice under 21 CFR 211.192 for drugs, not just a generic "fix it" plan.
- FDA's adequacy review, per its Regulatory Procedures Manual, weighs whether a CAPA addresses the underlying system and related facilities, not just the single cited instance.
- A CAPA plan that states an intended fix without documentation to support it is a repeated pattern FDA has cited as inadequate in real enforcement cases.
- Prevention (the "P" in CAPA) is frequently the weakest part of submitted plans — a corrective action that doesn't include a documented check for the same failure elsewhere in the facility routinely falls short.
How to Draft a CAPA Plan FDA Inspectors Will Actually Accept
A CAPA plan is one of the most commonly submitted, and most commonly rejected, documents in FDA compliance work. The gap between a CAPA that gets accepted and one that gets rejected usually isn't effort, it's structure — specifically, whether the plan actually demonstrates the fix addresses the root cause and won't recur elsewhere.
What CAPA Actually Means, Regulatorily
For medical devices, CAPA is a formal Quality System Regulation requirement under 21 CFR 820.100, which requires procedures for identifying quality problems, investigating their cause, verifying the corrective action's effectiveness, and preventing recurrence. For drugs, there's no single section titled "CAPA," but 21 CFR 211.192 (production record review) and related CGMP provisions establish the same underlying expectation: investigate discrepancies, determine root cause, and take documented corrective action. FDA inspectors and reviewers use "CAPA" as shorthand across both contexts even though the exact regulatory citation differs.
The Checklist: What a CAPA Plan Actually Needs
1. A specific, evidence-based root cause — not a guess. "Operator error" as a standalone root cause is a common rejection trigger. FDA's adequacy review looks for evidence the investigation actually traced the failure to a specific, addressable cause: a missing procedure step, an inadequate training record, a equipment calibration gap, a design flaw in a form.
2. A correction distinct from a corrective action. A correction fixes the immediate instance (the specific batch, the specific device). A corrective action fixes the system that allowed it to happen. A CAPA plan that only describes the correction, without a separate corrective action addressing the underlying system, is incomplete by definition.
3. A documented scope assessment across related products and facilities. If a failure could plausibly affect other product lines, other shifts, or other facilities using the same process, the CAPA plan needs to say so explicitly and describe how that was checked, not leave FDA to assume the scope was actually assessed.
4. A realistic timeline with interim controls. A CAPA that promises a fix in six months with no interim control in place for the intervening period reads as an unmanaged risk, not a plan. Interim controls — enhanced inspection, additional testing, temporary process holds — show the firm is managing risk while the permanent fix is implemented.
5. A defined method for verifying effectiveness. This is where the "preventive" half of CAPA often goes missing. A plan needs to state how the firm will confirm, after implementation, that the same failure hasn't recurred — a follow-up audit, a defined monitoring period, a specific metric being tracked.
6. Supporting documentation, not just assertions. If the plan says training was completed, attach or reference the training records. If it says a procedure was revised, reference the specific document control number and revision date. FDA's Regulatory Procedures Manual repeatedly treats an assertion without documentation as inadequate on its face.
7. A named owner and a completion date for each action item. A CAPA plan with no accountable owner for a given action item is a common way firms lose track of implementation, and it reads to a reviewer as a plan that hasn't been operationally committed to.
The Most Common Way CAPA Plans Fail
The single most common gap is treating the "P" in CAPA as an afterthought. A corrective action that fixes the cited instance but includes no documented check for the same root cause elsewhere in the facility — same equipment type on a different line, same procedure gap in a different department — routinely gets flagged as inadequate, because it addresses the symptom FDA happened to see without addressing the broader exposure.
A Worked Example, Generically
Say an investigator finds a lab technician recorded a test result before the test was actually run — a data-integrity finding. A weak CAPA states: "Technician retrained on procedure SOP-114." A stronger CAPA states the root cause (SOP-114 didn't require contemporaneous timestamping and the LIMS system allowed backdated entry), the correction (the specific result was invalidated and retested), the corrective action (SOP-114 revised to require system-enforced timestamping, LIMS configuration updated to block backdated entries), the scope check (all technicians using the same LIMS module across two shifts were audited for the same pattern going back 90 days), and the verification method (a 60-day monitoring period with weekly audit of entry timestamps, reported to the quality unit).
FAQ
How long does FDA give a firm to submit a CAPA plan?
There's no single fixed deadline across all contexts — a CAPA submitted as part of a Warning Letter response typically falls under that letter's overall response window, commonly 15 working days per FDA's Regulatory Procedures Manual, though the CAPA's full implementation timeline can extend well beyond that.
Does FDA require a specific CAPA template?
No. FDA doesn't mandate a specific document format — the adequacy review is about substance (root cause, scope, verification, documentation) rather than a required layout.
Can a CAPA plan be rejected even if the fix is technically correct?
Yes. FDA's enforcement history includes cases where the underlying fix was reasonable but the response was rejected because the CAPA plan lacked supporting documentation, didn't address related facilities or products, or provided no verification method — the plan's completeness matters as much as the fix itself.
Is a CAPA plan the same thing as a Warning Letter response?
No. The written Warning Letter response is the document sent to FDA; the CAPA plan is what that response needs to describe in enough operational detail to satisfy FDA's adequacy factors. A response can reference or attach the CAPA plan as supporting material.
Related reading
- What actually makes an FDA warning letter response "adequate" enough to close out?
- How do you build a CGMP data integrity remediation plan FDA will actually accept?
- What is CGMP? FDA's Core Manufacturing Standard, Explained
Sources: 21 CFR 820.100 (eCFR), 21 CFR 211.192 (eCFR), FDA Regulatory Procedures Manual, Chapter 4. Byline: The Argus Regulatory Analysis Team. Published 2026-07-16.