Pharmaceutical CAPA Effectiveness: Why Closed Actions Don’t Stop Repeat Deviations
The CAPA dashboard is green. Ninety-five per cent of actions closed on time and nothing overdue by more than thirty days. Then the same deviation appears for the third time this year, on the same line, with the same explanation.
Both things can be true at once. Closure is being measured. Whether the action worked is not.
CAPA effectiveness is the difference between the two. CAPA, or corrective and preventive action, is the part of the quality system that is supposed to stop problems recurring. When it only records that something was done, the organisation pays to investigate the same failures repeatedly and carries the regulatory risk of being unable to show control.
What regulators expect from a CAPA system
The expectation is written down and is not complicated.
EU GMP Chapter 1 says that an appropriate level of root cause analysis should be applied when investigating deviations, suspected product defects and other problems. Appropriate corrective and preventive actions should be identified and taken, and the effectiveness of those actions should be monitored and assessed in line with quality risk management principles.
The same paragraph addresses two habits directly. Where the true root cause cannot be determined, the most likely cause should be identified and addressed. And where human error is suspected or identified as the cause, that conclusion should be justified, with care taken to ensure that process, procedural or system-based problems have not been overlooked.
ICH Q10, the international guideline on pharmaceutical quality systems, lists a CAPA system as one of four core elements, alongside process and product monitoring, change management and management review.
None of this prescribes tools or forms. It sets an outcome. Investigations should find causes, actions should address them, and the company should know whether they worked.
Why actions close and problems stay
Five weaknesses explain most of the gap.
The problem statement is vague. “Operator failed to follow SOP” describes an event. It does not describe a problem. An investigation that starts there has already narrowed its options to the operator.
The investigation stops at the first plausible cause. Root cause tools are used to fill in a form. The five whys reach the second “why” and arrive at a person. Nobody asks why the task was easy to get wrong.
Retraining is the default action. It is quick, easy to evidence and closes on time. It also assumes the cause was a lack of knowledge, which is rarely tested. If trained, experienced staff keep making the same error, the design of the task, the document or the equipment is the more likely cause.
Corrective and preventive actions are blurred. A correction fixes the instance. A corrective action removes the cause so that it does not recur. A preventive action stops it occurring elsewhere. Many records contain only the first, labelled as the second.
The effectiveness check is missing or meaningless. Either there is none, or it confirms that the action was completed: the SOP was revised, the training was delivered. That verifies implementation. It says nothing about whether the deviation rate changed.
TWO QUESTIONS
“Was the action completed?” and “Did the problem stop?” are different questions. Most CAPA metrics answer only the first.
Metrics that reward the wrong thing
What gets measured shapes behaviour. If management review tracks on-time closure and little else, the system will optimise for closure. Investigators choose actions that can be finished inside the target. Extensions are avoided by narrowing scope. Hard fixes that need capital, engineering time or a change to a validated process are replaced by easy ones.
Better indicators are available from data the site already holds: the recurrence rate by cause category, the proportion of root causes classified as human error, the proportion of actions that are retraining, the number of effectiveness checks that failed and what happened next, and the age of open CAPAs weighted by risk.
Recurrence only shows if deviations are categorised consistently. Where each investigator picks a category from a long list, the same underlying cause ends up spread across several headings and the trend disappears. A short, well-defined set of cause categories, applied by a small group of reviewers, makes repeats visible.
A system in which no effectiveness check has ever failed deserves a second look. Either every action worked first time, or the checks are not capable of failing.
EU GMP places ultimate responsibility for an effective quality system with senior management and expects periodic management review. Those reviews are where these indicators belong.
HOW TDP SUPPORTS THIS
TDP’s Compliance and Remediation service supports organisations facing recurring deviations, weak CAPA effectiveness or quality system weaknesses, with root-cause analysis, CAPA strategy and effectiveness check planning.
Compliance and Remediation →
Designing a CAPA effectiveness check that can fail
An effectiveness check should be designed when the action is approved, not when it falls due.
It needs four things. A measure that relates to the original problem, such as the number of occurrences of a specific deviation type. A success criterion stated in advance, for example no recurrence across the next twenty batches. A time window long enough for the problem to have had a fair chance to recur. And an owner who is not the person who implemented the action.
The window should reflect frequency. A problem that occurred once a quarter cannot be declared solved after four weeks.
A failed check is useful information. It should reopen the investigation with a different hypothesis, and that outcome should be treated as the system working.
The preventive half deserves the same discipline. Once a cause is confirmed, ask where else the same condition exists: other lines, other products, other sites and contract partners. A cause fixed on one line and left in place on three others will return as a new deviation with a different reference number, and it will not be counted as a repeat.
Proportionality matters. Not every minor deviation needs a formal effectiveness check, and EU GMP ties the level of root cause analysis to quality risk management. Applying the same heavy process to everything is one reason systems become overloaded and fall back on box-ticking. Keep the rigour for events that are significant, recurring or systemic.
The cost at inspection and beyond
Inspectors read CAPA records because they show how a company thinks. A deviation log with repeated events and retraining as the answer tells an inspector that the quality system detects problems and does not resolve them.
Commitments made to regulators raise the stakes. MHRA guidance on responding to a post-inspection letter asks companies to think about the wider, systemic issue, including other sites, and to state clearly what will be done and by when, using realistic timescales. If an inspector later finds that agreed action plans from a previous inspection have not been resolved, MHRA guidance says they will contact the Inspection Action Group, which can refuse or suspend a licence.
An ineffective CAPA raised in response to an inspection finding can therefore become a bigger problem than the finding itself. We covered the response in How to respond to an MHRA or FDA inspection finding.
The internal cost is less visible and just as real. Every repeat deviation consumes investigation time, delays batch review and adds to the backlog. EU GMP expects product quality reviews to consider the adequacy of previous corrective actions, so the pattern will surface eventually. It is cheaper to find it first.
Take an illustrative example. A packaging line records the same label reconciliation discrepancy five times in eight months. Each investigation concludes human error and retrains the shift. A sixth review looks at all five together and finds that every event followed a mid-batch reel change, where the procedure is ambiguous about who counts the removed labels. The procedure and the line clearance step are redesigned, and the effectiveness check is set as zero discrepancies across the next thirty batches involving a reel change.
Where to start
A full redesign is rarely needed. Three steps give a quick picture.
Pull the last twelve months of deviations and group them by actual cause, ignoring the category chosen at the time. Repeat themes tend to show quickly.
Sample twenty closed CAPAs and ask of each: was the cause a cause, was the action aimed at it, and is there evidence the problem stopped?
Look at what management review sees, and add at least one recurrence measure.
From there the work is about capability: investigators trained in root cause analysis who have time to do it, reviewers willing to reject a weak conclusion, and leaders who ask about recurrence before closure rates.
HOW TDP SUPPORTS THIS
TDP’s quality systems training is bespoke to your organisation and built around your products, processes and inspection risks.
Quality Systems Training →
How TDP can help
TDP’s Compliance and Remediation service supports organisations dealing with recurring deviations, weak CAPA effectiveness and wider quality system weaknesses. The work includes root-cause analysis using recognised methods, CAPA strategy and prioritisation, effectiveness check planning, and training and cross-functional alignment to embed the improvement. For teams that need ongoing capacity, our outsourced quality function can take on day-to-day quality system work.
If repeat deviations are consuming your team’s time, or you want an independent view of your CAPA system before the next inspection, request a call back to discuss where to begin.