Separating CAPA Workflows Under QMSR: What Manufacturers Actually Need to Change

CAPA — corrective and preventive action — has been a fixture of device quality systems for decades, and it’s also been, historically, one of the most reliable predictors of FDA enforcement action. CAPA deficiencies have featured in over 60% of device-related Warning Letters, a pattern that predates QMSR and hasn’t gone away with it. What QMSR changes is more specific: it mandates that corrective and preventive actions be managed as genuinely distinct workflows, not a single combined process — and that structural change has real operational implications.

Why “CAPA” Was Never Really One Thing

The term CAPA collapses two conceptually different activities into a single acronym. Corrective action responds to a problem that has already occurred — a complaint, a nonconformance, an audit finding — and works to eliminate its root cause so it doesn’t recur. Preventive action is forward-looking: it identifies potential problems before they occur, based on trend data, risk analysis, or near-miss identification, and acts to prevent them from ever manifesting.

Under the prior QSR, many manufacturers managed both through a single unified process, often triggered reactively — a complaint or nonconformance would generate a “CAPA” that nominally addressed both correction and prevention in one record. QMSR’s incorporation of ISO 13485 pushes manufacturers toward treating these as distinct workflows with different triggers, different evidence requirements, and different closure criteria.

What Separation Actually Looks Like Operationally

Different entry points. Corrective action workflows should trigger from confirmed nonconformances — complaints, audit findings, field failures, deviation reports. Preventive action workflows should trigger from trend analysis, risk assessments, near-miss data, and proactive signal detection — sources that don’t require an actual failure to have occurred first.

Different root cause expectations. A corrective action’s root cause analysis needs to explain why a specific event happened. A preventive action’s analysis needs to explain why a potential failure mode is credible enough to warrant action before it happens — a different, more probabilistic kind of justification that many quality teams aren’t accustomed to documenting rigorously.

Different effectiveness verification. Corrective action effectiveness is verified by confirming the specific nonconformance doesn’t recur. Preventive action effectiveness is harder to verify by definition — you’re trying to prove something didn’t happen because of an intervention — which typically requires longer-term trend monitoring rather than a single follow-up check.

Separate metrics and management review inputs. Combining corrective and preventive actions into a single CAPA count obscures a genuinely important signal: a quality system generating lots of corrective actions but few preventive actions is reactive by definition, and that pattern itself is something FDA inspectors are now positioned to notice under QMSR’s expanded risk-based thinking expectations.

Why FDA Cares About This Specifically

QMSR’s risk management integration — connecting to ISO 14971 principles — treats CAPA as one of the clearest places where risk-based thinking is either genuinely operating or merely documented as a formality. A combined CAPA process makes it easy to satisfy the letter of the requirement (something got documented and closed) without demonstrating the substance FDA is actually looking for: coherent evidence that the organization is both fixing what’s broken and anticipating what could break next.

Recent inspection data reinforces this. CDRH reporting identifies CAPA among the top observation categories under QMSR, and FDA is increasingly cross-referencing pre-inspection intelligence — MDRs, consumer complaints, GUDID data — against a manufacturer’s own risk files and CAPA records before an inspection even begins. A CAPA program that looks procedurally complete but doesn’t show a defensible separation between reactive correction and proactive prevention is precisely the kind of gap this cross-referencing is designed to surface.

Common Pitfalls in Separating CAPA Workflows

Treating separation as a labeling exercise. Simply renaming an existing combined process into “corrective” and “preventive” categories without changing the underlying triggers, data inputs, or effectiveness criteria doesn’t satisfy the intent of the requirement — and is unlikely to hold up under inspection scrutiny that’s specifically probing for genuine risk-based reasoning.

Underinvesting in trend data infrastructure for preventive action. Preventive action depends on having reliable, timely access to trend data — complaint patterns, near-miss reports, supplier performance metrics — that many manufacturers haven’t historically prioritized building. Without that infrastructure, preventive action workflows tend to remain thin or symbolic regardless of how they’re formally documented.

Losing traceability between the two workflows. Corrective and preventive actions are distinct, but they’re not unrelated — a corrective action addressing a specific nonconformance should often inform whether a related preventive action is warranted elsewhere in the system. Manufacturers that separate the workflows so completely that this connection is lost risk missing genuinely related risk signals.

Inconsistent effectiveness check timing. Because preventive action effectiveness is inherently harder to verify quickly, manufacturers sometimes apply corrective-action-style short-interval effectiveness checks to preventive actions, generating a false sense of closure before enough time has passed to actually confirm the anticipated failure mode didn’t materialize.

A Practical Path to Compliant Separation

For manufacturers actively restructuring their CAPA program under QMSR, the sequence that tends to work is: map current CAPA records against whether they were genuinely reactive or proactive in origin, rather than assuming existing categorization is accurate; rebuild intake criteria so corrective and preventive actions have distinct, clearly defined triggers; invest in the trend-monitoring infrastructure needed to generate credible preventive action signals, not just reactive ones; and redesign management review inputs to report corrective and preventive action metrics separately, so the balance between reactive and proactive quality activity is visible to leadership rather than obscured in a combined count.

CAPA separation isn’t a paperwork requirement — it’s QMSR’s way of forcing a genuine answer to a question every quality system should already be able to answer: is this organization primarily fixing problems after they happen, or is it demonstrably getting better at preventing them? Manufacturers that can answer that question with real data are the ones most likely to navigate QMSR inspections without the CAPA-related findings that have historically driven the majority of device Warning Letters.

This article reflects FDA’s QMSR, effective February 2, 2026, and its incorporation of ISO 13485 quality system principles. It is intended for general regulatory and educational purposes and does not constitute regulatory or legal advice for a specific quality system.