Completing Corrective Actions (CAPAs) in an Electronic Quality Management System

Corrective Action is a process for controlling correction in a regulated manufacturing environment.

Our main Q1 goal at FreeQMS is to launch our Corrective Actions module. This module will tie heavily to our Audits Module – where our industry-first intelligent record linking will let users create (or maybe a better word is spawn) Corrective Action records directly from Audit findings. This reduces work for quality professionals and speeds the completion of post-audit actions. These improvements to corrective action, and quality management at large, will allow organizations to make corrections easier, and more quickly, which will improve return on investment from the quality system, and ultimately delivery better, safer products to customers.

Controlling the Corrective Action process is a requirement of at least the following quality management standards:

• ISO 9001 General Manufacturing

• ISO 13485 Medical Device and Life Sciences

• TS/IATF 16949 Automotive

• AS 9100 Aerospace

• SQF 2000 Food Safety

• ISO 22000 Food Safety

• 21 CFR Part 820 FDA Quality System Requirements

Additionally, and this is especially important for Medical Device customers, the Medical Device Single Audit Program (MDSAP) introduces new, more stringent requirements for the trending and analysis of Corrective Actions, in addition to 13485: 2016’s already robust requirements for Corrective Action Efficiency Checks, that we believe render legacy, paper systems largely obsolete. Companies will need to employ electronic trending to comply with new requirements.

We thought this would be a great time to explore, and explain, the modern Corrective Action Process – in a simplified manner meant for newcomers not just to EQMS, but Quality Management in general, and then take a moment to explain how each of these actions is simplified by electronic management.

Corrective Action

Corrective Action is a process for controlling correction is a regulated manufacturing environment.

This can be a confusing level of bureaucracy for newcomers to regulated manufacturing. If I run a business making sprinkler parts, that is not regulated, or ISO 9001 compliant, and I notice gum on the floor of the manufacturing area three days a row, then I would probably continue to pick it up until I found out who was putting it there, and then discipline that employee. There may be record of me writing up an employee, but no more.

Regulated manufacturers, on the other hand, must carefully track and monitor corrections as everything in the organization is supposed to happen like clockwork – in accordance with established procedures and policies. If there is an unexpected issue that happens in the course of following these procedures, then this issue most likely represents a Nonconformance.

Nonconformance 

Nonconformance is an area of quality management similarly steeped in bureaucracy, and dare we say it, philosophy, that is beyond the scope of this post. A simplified view of nonconformance is that there is something wrong. Some organizations use the term “NCR” or Nonconforming Report to describe the process of documenting things that are out of order. Some organizations may also use NCMR, or Nonconforming Material Record, to document a material (a somewhat generic term that typically means a material used in manufacturing) that has an issue.

No matter what they are called, Nonconformances are important because they are the most common spark for Corrective Action. In fact, nearly all Corrective Actions are done in response to “something being wrong” other than those which are done in a voluntary manner, such as a CAPA opened to take the organization to a new quality system, which are justified as the result of many systemic, yet loosely documented, issues.

Although FreeQMS will eventually launch a Nonconformance module, we currently offer the ability to generate Corrective Actions from our Audits module.

Creating Corrective Action Records from Within Audits

In most paper, or legacy quality systems, an auditor will perform an audit of an organization, or functional quality area. The auditor will record “findings”, which are basically written record of things being wrong – once again we are defining “things being wrong” as items that do not conform to the organization’s written procedures and policies. In our example above, the organization most likely calls for a manufacturing area, regardless of its clean room level or certification, that is a “Controlled Manufacturing Area” and is free of foreign biological material like gum. If there is gum on the floor, and an auditor finds this, they would write a finding against the organization’s procedure for Controlled Manufacturing Areas and cite the nonconformance as gum being on the floor.

In a paper system, the company would then open a nonconformance record, and then from the nonconformance record, open a corrective action record to resolve the nonconformance, and in turn resolve the finding.

In many cases recording a finding, then going through the work to generate a nonconformance, and then generating a corrective action from the nonconformance, represents a few too many steps. An audit finding is already deemed a nonconformance of at least “minor” severity by the auditing professional, or it would not be written up against the organization’s procedures. By any measure, this “something wrong” will need correction.

FreeQMS is about saving time, and automation, to produce ROI for organizations. That is why our Audits module (many other EQMS systems completely lack an Audits module and expect organizations track them through paper records in a Document Control module) will offer the ability to generate a Corrective Action record for each audit finding after the CAPA module goes live.

This is a no brainer, especially for Internal Audits. If an audit is being done, and nonconforming findings are being recorded, then Corrective records will need to be generated. There is little sense in taking the time to manually generate both records.

Once the Corrective Action record is created, it will need to be resolved.

When is a CAPA Required?

FreeQMS offers a free Supplier Management module for many reasons, one of them being that our management wants small businesses to be able to freely evaluate, and start using, a quality system.

Small companies, and first time manufacturers, often employ up-and-coming quality and engineering superstars who are new, or fuzzy, on corrective action. This section serves as both a refresher on the process, and an introduction to the concept of processing these records electronically.

Electronic management of corrections allows the organization to create, view, store, process, and sign CAPAs through the web browser, and sign them with a 21 CFR Part 11 signature process. No printing or scanning required.

An organization that decides to proceed with electronic management of CAPAs may choose to move all functional areas of corrections into the electronic system, or a single functional area such a Supplier Corrective Action Records (often abbreviated SCARs) to start.

But what constitutes a nonconformance requiring a corrective action in a regulated environment?

There is some gray area.

If we run a business making syringes, and I am walking in the manufacturing area and I find gum on the floor (non-controlled biologic), ONCE, and I tell no one, then I can probably pick it up. If I find it more than once, or someone other than management comes across it or notices it, or puts a written report in, then we should open a Corrective Action.

It is up to each organization to decide when, and how often, to generate CAPAs, but given that most regulations (including FDA 820) say that CAPAs must be at least considered for any written complaint, and should be generated for any systemic issue, it is quite likely that any issue occurring more than once will result in one of these records.

In a legacy system, a Correction number (or CAPA number) is generated in a log by Document or Record Control, and then a long series of forms are filled out. The files, forms, and records associated with the correction are often stored in a paper folder and are passed around between signatories at different points in the organization’s defined process.

This can easily become a burdensome process. It is so time consuming to make effective, documented corrections that organizations either avoid CAPA or treat them as a punishment handed out for political purposes (worst case).

Electronic systems greatly simplify this process.

Creating Electronic CAPAs

In an electronic system, such as FreeQMS, a Correction number is generated by the system – no independent log or wait time.

A CAPA administrator, or the Correction record coordinator, can then begin filling out the form and completing the steps in the Corrective And Preventive Action process.

Once again we will use our example of gum on the floor. Depending on the type of analysis we do we might ask “why there is gum on the floor?” The answer is often much more complicated than a surface issue of someone being dumb.

In an electronic system we may have to wait to proceed for permission to “start the CAPA”. In an electronic system, like FreeQMS, only a CAPA administrator should have the ability to create a CAPA. The administrator assigns a Coordinator, and then Coordinator receives automatic, permanently recorded notification that they are Coordinator, and a Task to complete the CAPA. There should be no confusion as to who is completing the CAPA, or that it must be done. Already, significant time is saved.

Once the coordinator is ready to proceed, they will move through the CAPA functional areas. Let’s give a brief summary of those areas, and how they might be performed in an electronic system.

Containment

Containment is the very first possible action where we will contain the damage or spread of a problem. In this case, we might put tape and a barrier around the gum, or a plastic cover over it.

Containment is not always necessary. We might be starting a CAPA from a systemic, or trended issue, that is impossible to immediately contain.

Containment is recorded in a web fill form in an electronic system. Record of the person documenting the containment is permanently posted to the record’s un-editable history log, including a timestamp with their name.

This is in sharp contrast to paper systems where the person performing the containment must fill out a form, physically sign, and then seek a review. In an electronic system the person does not have to request a containment form, hunt down the CAPA folder, worry about who is keeping the records, or potentially make Good Documentation Practices corrections to their work. This CAPA is only on the first stage and already considerable time is saved.

Investigation

Investigations are the reason that documented corrective action records are created and performed. Without the investigation, there would be no point in documenting a corrective action – just fix it and go.

A CAPA investigation, in a regulated manufacturing environment, is the process where educated professionals (sometimes called SMEs or Subject Material Experts) perform a documented investigation, often in-line as described in a company procedure, to find the true root cause of a nonconformance.

Most government officials, visiting companies, auditors, and regulators will treat the investigation and analysis portion of corrective actions as most important – this is where you show off your homework.

An investigation will often include:

• Detailed description of the nonconformance

• People involved

• Where it happened

• When it happened

• Items affected

• Risk to patient, product, end user

• Photos

• Material stock analysis

• And more

The investigator will attempt to document as much information as reasonably possible to determine the “scope” of an issue – a term that encompasses both the reach and severity of a problem. How many are affected? How badly are they affected?

Electronic investigations, once again, greatly trump paper systems, because they allow the investigator, or CAPA record administrator, to electronically deposit and store any information related to the investigation in one central, permanent source. Investigators can upload, and retrieve photos, documents, records, procedures and more to a CAPA record’s File Attachments tab. Any upload and view actions from this tab are permanently recorded in the history log. There is no longer any reason to hunt down and add or remove items from a physical CAPA folder. There is no longer any concern about items being lost or missing from the physical folder, or the need to establish an accounting ledger of what is deposited in the folder.

Once the investigation materials are gathered, the investigator, will perform a Root Cause Analysis.

Root Cause Analysis

Not all regulated manufacturing standards require a root cause analysis for corrections, often abbreviated an RCA, but they are always a best practice.

There are many different methods of analyzing, and getting to the bottom of, problems. So many that they fall outside the scope of this post. All root cause analysis methods have a common goal: getting to the bottom of an issue.

The point of an RCA is to have an SME look at a problem, and uncover and understand the true root causes of the issue so that the organization can make the best possible fixes to prevent this issue from becoming systemic – potentially bringing about catastrophic effects.

Any competent Corrective Action company procedure should call for some sort of root cause analysis – the person or team completing the CAPA should be challenged to get to the bottom of the problem.

Root Cause Analysis, once completed, poses another set of challenges for paper systems. RCAs are often completed on separate pages, or separate forms. They then have to be tracked, manually associated, and stored with the CAPA. In electronic systems, like FreeQMS, the RCA is part of the electronic record. It is completed through the web, on one central portal, where every team member can access and understand. Any documents, charts, or investigation performed with the RCA can also be electronically stored.

Corrections

Corrections is a confusing, yet industry standard, term. Corrections are the next line of defense in the CAPA process and are temporary actions to resolve the issue to keep it from harming the product. In this case removing the gum from the floor.

The typical, defining difference between a Containment action and a Correction is that a Correction comes as result of an investigation. This is not to say that Containment actions are wrong, but to reduce patient or end user risk, organizations have to have the freedom to immediately address problems. This means that Containments are often knee-jerk, “best guess”, see-a-problem-fix-a-problem actions. Corrections, on the other hand, are the result of a documented analysis and are deemed the best way to temporarily resolve a problem before Corrective Actions can be performed.

Corrections may sometimes be made, and documented, without a complete CAPA. The FDA, under 820 CFR for example, says that minor corrections may be made as part of Complaint Management records – if they are documented. Repeat, or similar corrections should not be made as part of Complaints.

If a CAPA is already open, and they are immediate actions needed to correct a problem, as a stop gap, then they are recorded as Corrections.

Electronic record of Corrections has all the same advantages discussed on Containment, with one additional step. Corrections are often made in the form of Deviations, or emergency training sessions. In an electronic system these records may be linked, so that they are connected in a living, evolutionary manner. Linked records can be easily found by operators.

Corrective Actions

Ah, the reason we are here!

Corrective Actions are long-term, systemic fixes based on our investigation and analysis.

To go back to our gum on the floor problem it is likely that our root cause analysis uncovered several factors leading up to this problem.

The FDA and other regulators do not accept human error as a cause for problems (somewhat confusing and frustrating) so it is most likely a combination of a lack of controls - allowing food into the manufacturing area, a lack of disciplinary actions, and a lack of training. Our root cause analysis would drill into and establish each one of these areas as an opportunity for improvement, in hopes of resolving the “root” of the issue and keeping it from sprouting into a tree of problems.

Our Corrective Actions would involve documented changes to these areas, which would most likely involve Change Orders for changes to documents, updates to training, physical live trainings, etc. Once again, these are all easily linked in an electronic system.

Physical, paper systems often require professionals to document “proposed” Corrective Actions and then seek the signature of a Quality Manager for permission to proceed with making corrections. This represents a lot of time lost to the organization. People must fill out forms, whether by hand or electronically, go and find the Quality Manager, drop off the actions, and then wait on a signature. If the Quality Manager has proposed changes, then the process grows far longer, and then this back and forth grows into a process so long that the organization is quickly losing more and more money.

FreeQMS offers a system-wide Task system. Users can use the Task System to assign Tasks to other users, who are then notified by email, and must complete the Task before the record is closed. Assignment, Viewing, Editing, and Closing of Tasks is all recorded to each record’s history tab.

A user who creates proposed Corrective Actions in an electronic management system can simply create a task to the record coordinator, or quality manager, to review the corrective actions, if required by your company’s procedure. The Quality Manager can then review the actions electronically and make updates if necessary (any edits are recorded in the history). When the Quality Manager is done, they mark their task complete, once again providing automatic notification to the person who issued the task. No more tracking people down, no more waiting outside closed offices.

Preventive Action

When we present FreeQMS or you read about the industry you will often hear Corrective Action referred to as CAPA. The PA stands for Preventive Action.

The difference between Corrective Action and Preventive Action often sways into the philosophical.

Corrective Actions should prevent the problem from occurring in the future. Preventive Actions are specifically meant to prevent the problem from happening again.

It is often hard to come up with a good example, that should not be handled under Corrective Actions. In this case we might introduce a new procedure for our gowning area that has a supervisor sign off as to whether gowned employees have deposited all personal items, and biologics, into a safe area. This should prevent all uncontrolled biologics (say sandwiches or snacks in addition to gum) from entering the manufacturing area, but once again, this could also be introduced as a Corrective Action to handle gum and have the side benefit of preventing other foods.

Preventive Actions are tricky in paper, legacy systems. Some companies place them on a separate form, as few CAPAs have PAs, they do not want an unnecessarily long form. If a PA is performed, it must be physically stored with, and associated with the CAPA. There is also the question of issuing PA numbers, whether they follow the same process, and when to get approvals.

 

Effectiveness Check

ISO 13485:2016 is heavy on "effectiveness checks" or sometimes colloquially called "efficiency checks".

Effectiveness checks are the quality system equivalent of not trusting employees.

Processes, like Corrective Action, control changes in an organization. Effectiveness Checks control employees.

The looming threat of the effectiveness check motivates employees to do quality work when correcting problems, and to do the extra leg work to truly investigate the actual root cause of issues, and to do the appropriate repairs.

Although it is not meant to be threatening or disciplinarian specifically, compliance with the effectiveness check requires companies to revisit corrective actions after a company-specified time period. Companies must do another analysis and investigation to ascertain the effectiveness of corrective actions, and then take additional action as necessary. All corrective actions should remain open, in an effective quality system, until the effectiveness checks are performed.

The problem with this requirement, under paper systems, is remembering or notifying the Quality Manager of open CAPAs, and which Effectiveness Checks are due. Quality Managers must regularly review logs, or rely on third party notifications like Outlook reminders, to keep up with Effectiveness Checks. If an organization specifies a six-month EC period, then someone must manually keep on top of revisiting each CAPA six months after the creation date.

Electronic systems greatly simplify this requirement by allowing automatic notification and reporting. EC periods can be set up so that CAPA coordinators receive automatic notification, and a corresponding system Task, to perform effectiveness checks.