CAPA Root Cause and Effectiveness Checks

A CAPA closed on implementation leaves the effectiveness review undone. Defining the check before the investigation starts shapes the root cause that follows.

In FY2025 and FY2026, CAPA appears in 54 of the 75 device warning letters that allege quality-system violations. The share is 72%. Vellum counted the sections each letter cites. In FY2025, CAPA appears in 32 of the 45 such letters and design controls in 31 of them. In FY2026, through letters posted October 27, 2026, CAPA appears in 22 of the 30 letters and design controls in 21 of them.

A record can fail on its root cause even when every corrective action is complete. An investigation can stop at the first plausible explanation. The record then looks finished. A reviewer who asks why a second and a third time can find nothing behind the answer.

Define the effectiveness check before the investigation starts. The check should name the measure, the time window, and who verifies the result independently. The root-cause analysis then has a target: it must explain the failure well enough for the check to show the failure is gone. ISO 13485:2016 clause 8.5.2 requires a review of whether the corrective action was effective.

A root cause written as operator error or documentation gap can stop at the first person in the chain. The system that allowed the error stays unexamined. Organizing the investigation around systemic factors leads to a corrective action that changes the process. Process design, training adequacy, and detection controls are the usual places to look.

Which of your open CAPAs could not name its effectiveness check today?

Sources: ISO 13485:2016 clause 8.5.2 and the FDA’s warning letters issued from October 1, 2023 through September 30, 2026 and posted through October 27, 2026.