A corrective action CAPA process is one of the most scrutinised elements in any ISO or GFSI audit. Auditors do not just check whether you have a CAPA form — they check whether your corrective actions are genuine, whether your root cause analysis goes deep enough, and whether you have verified that the problem has actually been solved.
Yet corrective action CAPA remains one of the most commonly misunderstood requirements across ISO 9001, ISO 14001, ISO 45001, BRCGS, FSSC 22000, and SQF. Organisations complete the paperwork. They close the action. They call it done. And then the same non-conformance appears at the next audit.
This guide walks you through every element of an effective corrective action CAPA — from describing the non-conformance correctly to verifying that your action has actually worked — with the exact level of detail that auditors expect to see.
⚠️ Important: A low number of CAPAs is an audit red flag. Auditors want to see that you are actively using your corrective action process — not hiding problems. An organisation with very few CAPAs in a year signals a system that is not identifying non-conformances honestly or reviewing effectively.
WHAT IS A CORRECTIVE ACTION CAPA?
CAPA stands for Corrective Action and Preventive Action. In modern ISO standards — ISO 9001:2015, ISO 14001:2015, ISO 45001:2018 — these are addressed under Clause 10.2 (Non-conformance and corrective action).
The distinction between the two elements:
✅ Corrective Action — a reactive response to an existing non-conformance. You fix what went wrong and prevent it from happening again.
✅ Preventive Action — a proactive response to a potential problem. You identify a risk before it becomes a non-conformance and eliminate it.
Under ISO 9001:2015 and its peer standards, preventive action is now embedded in risk-based thinking throughout the standard. But the principle remains: your corrective action CAPA system must not just fix problems — it must prevent their recurrence.
WHAT AUDITORS ACTUALLY CHECK IN YOUR CORRECTIVE ACTION CAPA PROCESS
Auditors evaluating your CAPA process are looking for five things:
✅ Non-conformance description — clear, specific, factual — not vague or generalised
✅ Root cause analysis — genuine investigation, not the first obvious answer
✅ Corrective action — addresses the ROOT CAUSE, not just the symptom
✅ Implementation evidence — documented proof the action was actually carried out
✅ Effectiveness verification — proof the problem has not recurred after closure
Common failure on each: vague descriptions, “human error” root causes, retraining without process change, marked complete with no evidence, closed without follow-up.
CORRECTIVE ACTION CAPA — STEP BY STEP GUIDE
CAPA STEP 1 — DESCRIBE THE NON-CONFORMANCE CORRECTLY
The starting point of every effective corrective action CAPA is a precise, factual description of what went wrong. A good non-conformance description answers five questions:
→ What — what specifically failed or was found non-conforming?
→ Where — where did it occur? Process, location, product, department?
→ When — when was it discovered? When did it likely occur?
→ Who — who discovered it? Who was involved?
→ How much — what is the scale? How many items, batches, or occurrences?
Weak example: “Customer complaint received.”
Strong example: “On 14 June 2026, customer ABC Ltd returned 3 units of product batch 2026-06-001 citing incorrect labelling on the allergen declaration. The error affects batch 2026-06-001 only. Discovered during customer complaint review on 16 June 2026.”
CAPA STEP 2 — CONTAIN THE IMMEDIATE PROBLEM
Before investigating root cause, contain the problem to prevent further harm:
→ Quarantine and segregate affected product or materials
→ Withdraw or recall where necessary
→ Notify affected customers or stakeholders
→ Suspend the process or activity until the cause is understood
Document what you did, when, and who authorised it. This demonstrates control and competence to the auditor.
CAPA STEP 3 — IDENTIFY THE ROOT CAUSE (RCA)
This is the most important — and most often inadequate — step. Root cause analysis requires you to dig past the obvious answer until you reach the fundamental, systemic reason why the non-conformance occurred.
Most common root cause analysis methods:
📌 5 Whys — ask why five times until you reach the systemic root cause. Best for simple to moderate problems.
📌 Fishbone (Ishikawa) — map potential causes across Man, Machine, Method, Material, Measurement, Mother Nature. Best for complex problems.
📌 Fault Tree Analysis — map backward from the non-conformance through all possible cause paths. Best for high-risk events.
📌 8D Report — 8 structured disciplines from problem definition to prevention. Best for customer complaints and repeat issues.
💡 The most rejected root cause in audits: “human error.” Human error is almost never a root cause — it is a symptom. Ask why the human made the error. Was the procedure unclear? Was training inadequate? Was the workload excessive? Was the tool defective? That is where the root cause lives.
CAPA STEP 4 — WRITE THE CORRECTIVE ACTION PLAN
Your corrective action must address the root cause directly. Every corrective action plan must document:
✅ Specific action — what exactly will be done? Not “improve training” — exactly what training, for whom, on what date, covering what content
✅ Responsible person — one named individual, not “the team”
✅ Target completion date — a specific date, not “ASAP”
✅ Resources required — what is needed to implement the action
✅ How effectiveness will be verified — what evidence will prove the action has worked
CAPA STEP 5 — IMPLEMENT AND DOCUMENT
Implement your corrective action and document every step with objective evidence:
→ Training records — signed attendance sheets and competency assessments
→ Revised procedure — new version with change record
→ Photographs — before and after for physical changes
→ System screenshots — for software changes
→ Supplier correspondence — for supply chain corrective actions
→ Meeting minutes — for process or culture change actions
CAPA STEP 6 — VERIFY EFFECTIVENESS AND CLOSE
Verifying effectiveness means confirming that your corrective action has actually eliminated the root cause. This is the step auditors check most carefully.
Effectiveness verification must be:
✅ Planned — agreed at CAPA opening, not added as an afterthought
✅ Evidence-based — not just a statement that the problem is fixed
✅ Time-bound — verified after a defined period, not immediately
✅ Signed off — by someone with authority to confirm the system is working
If the corrective action is not effective — reopen the CAPA. Do not quietly archive it.
THE 6 MOST COMMON CORRECTIVE ACTION CAPA FAILURES
❌ FAILURE 1 — Vague non-conformance description
Fix: Use the 5W framework — What, Where, When, Who, How much
❌ FAILURE 2 — Superficial root cause (human error)
Fix: Keep asking why until you reach a systemic process failure
❌ FAILURE 3 — Corrective action addresses symptom not root cause
Fix: Map your corrective action directly to your stated root cause
❌ FAILURE 4 — No implementation evidence
Fix: Collect documentary evidence during every implementation step
❌ FAILURE 5 — No effectiveness verification
Fix: Plan verification at CAPA opening — not after closure
❌ FAILURE 6 — CAPAs never reviewed at management review
Fix: Include CAPA trend analysis as a standing management review agenda item
CORRECTIVE ACTION CAPA REQUIREMENTS BY STANDARD
ISO 9001:2026 — Clause 10.2: React to non-conformances, evaluate root cause, implement correction, verify effectiveness
ISO 45001:2018 — Clause 10.2: Same framework — extended to include OH&S incidents and near-misses as CAPA triggers
ISO 14001:2026 — Clause 10.2: Environmental non-conformances must follow the same CAPA process
BRCGS Issue 9 — Clause 3.7: CAPAs raised for all non-conformances — timescale based on risk rating
FSSC 22000 V7 — Clause 10.2: Full CAPA process required — food safety non-conformances must include risk assessment
SQF Edition 10 — Clause 2.5.3: CAPA must include root cause, corrective action, verification, and management review reporting
THE BOTTOM LINE
A corrective action CAPA that satisfies auditors is not complicated — it is thorough. It describes the problem precisely, identifies the real root cause, implements actions that address that root cause, and verifies that the problem does not recur.
The organisations that get CAPA right are not the ones with the fewest non-conformances. They are the ones that investigate every non-conformance genuinely, implement real actions, and demonstrate improvement over time.
👉 Download your free CAPA form template at standardsunlimited.com/free
CorrectiveAction #CAPA #ISO9001 #QualityManagement #RootCauseAnalysis #NonConformance #ISO45001 #BRCGS #FSSC22000 #AuditReady #Compliance #ContinualImprovement