CAPA Should Not Be Cruel And Punitive Action

By Bob Marshall, Chief Editor, Med Device Online

In a recent guest column on Med Device Online, FDA inspectional observations were summarized for the most recent fiscal year indicating 400 of the 1,030 inspectional observations written by CDRH investigators pertained to procedures for corrective and preventive action (CAPA) not being adequately established (and followed). At 39 percent of all device-related 483s in FY 2017, CAPA was the most prevalent observation.

This isn’t anything new if you are at all familiar with the medical device industry. Corrective and preventive action has long been a leading cause of 483s and warning letters. What is a CAPA system supposed to be? Effective CAPA includes a systematic approach to identifying the root cause(s) of problems, or potential problems, and taking action to eliminate the causes thereby preventing occurrence or recurrence.

In a FDA presentation on the basics of corrective and preventive action, FDA’s Joseph Tartal explained, “Manufacturers should consider that their Corrective Action and Preventive Action documentation can demonstrate to FDA that the manufacturer’s quality system is effective and enables the manufacturer to identify problems quickly and implement effective corrective and preventive actions (or not).”

FDA’s own inspectional guide includes these objectives for an investigator when evaluating a medical device company’s CAPA system and records:

1. Verify that CAPA system procedure(s) that address the requirements of the quality system regulation have been defined and documented.
2. Determine if appropriate sources of product and quality problems have been identified. Confirm that data from these sources are analyzed to identify existing product and quality problems that may require corrective action.
3. Determine if sources of product and quality information that may show unfavorable trends have been identified. Confirm that data from these sources are analyzed to identify potential product and quality problems that may require preventive action.
4. Challenge the quality data information system. Verify that the data received by the CAPA system are complete, accurate and timely.
5. Verify that appropriate statistical methods are employed (where necessary) to detect recurring quality problems. Determine if results of analyses are compared across different data sources to identify and develop the extent of product and quality problems.
6. Determine if failure investigation procedures are followed. Determine if the degree to which a quality problem or nonconforming product is investigated is commensurate with the significance and risk of the nonconformity. Determine if failure investigations are conducted to determine root cause (where possible). Verify that there is control for preventing distribution of nonconforming product.
7. Determine if appropriate actions have been taken for significant product and quality problems identified from data sources.
8. Determine if corrective and preventive actions were effective and verified or validated prior to implementation. Confirm that corrective and preventive actions do not adversely affect the finished device.
9. Verify that corrective and preventive actions for product and quality problems were implemented and documented.
10. Determine if information regarding nonconforming product and quality problems and corrective and preventive actions has been properly disseminated, including dissemination for management review.

With all of this information available about the expectations of the CAPA process, I expect we would be doing better. It’s not like we don’t know what is coming. We aren’t defensive backs trying to watch the quarterback’s eyes to see where the ball will go. We are right in the huddle with the FDA, hearing the play called, even their play book (the inspector’s handbook) is publicly available. So why is CAPA still the primary contributor to 483s and warning letters?

Might I suggest there are two extreme and opposite approaches to the corrective and preventive action process driven by misguided thinking and emotion that clearly don’t help the issue.

CAPA De Minimis

I have seen this approach typically with smaller medical device companies that think less is better and with medium or large companies fearing exposure of their problems. With the former, there is pride in saying, “We don’t have any problems!” But that is simply unrealistic and not credible to investigators. I have often worked with startup companies building their initial quality management system and I advise them to find a couple of simple systemic issues to “seed” their CAPA system and help the organization learn how to tackle them. This can often come from initial internal audits as the system starts to generate documentation and records.

With larger companies in fear of exposing problems, it is important to keep in mind there are required inputs to a CAPA system. Ignoring those can appear as a higher-level systemic failure rather than a potentially isolated incident. When might an auditor expect to see a CAPA at a medical device company? Examples of internal and external data sources that should be reviewed for potential corrective and preventive action include:

• Process control data
• Test/inspection data
• Device History Records
• Internal audits
• Nonconforming material reports
• Rework and scrap/yield data
• Training records
• Supplier controls
• Complaints
• Customer feedback
• Servicing repairs
• Adverse event reports (MDR)
• FDA bulletins and other communication
• Information from similar competitor devices

The goal is not perfection. CAPA should be an early warning system and a means to ensure necessary improvements are made. Having few or no records in the systems, or ignoring problems that are otherwise discoverable can both lead to observations of an inadequate CAPA system.

CAPA De Maximis

On the other hand, I have seen companies that overuse their CAPA system and often include things that are not appropriate for various reasons. Some companies go so far as to “weaponize” the CAPA system, creating too many and using them as retaliation toward parts of the organization that aren’t engaged or are struggling. Both the creator of the CAPA and the CAPA lead must agree there is a real problem, and there must be commitment and resources assigned to get it done, lest the incomplete CAPA be a time bomb ticking in your file cabinet waiting for the FDA investigator to stop by for a friendly visit.

CAPAs opened on business processes can be particularly problematic. I once worked for a company that opened a CAPA because a particular Sales territory missed its target two years in a row. This is inappropriate and very difficult to close in a timely manner. It can become an audit or inspection liability. However, I have found it rare for an FDA investigator to question the reason for creating a CAPA. If it has been opened by the organization, the only thing that is important is that it is properly investigated and actioned in a timely manner.

You’ve heard of the five whys in root cause analysis? Sometimes “CAPA de Maximis” is aimed at the one who believed to be responsible for something regardless of why. When it gets personal it becomes Cruel And Punitive Action. CAPA should never be aimed at a person. It is a detailed examination of a process or situation. Whoville is not the place for CAPAs. They belong in the neighboring communities of Whatville, Whenville, Whereville, Whyville, and Howville.