You closed the CAPA. Did the problem actually go away?

Clause 8.5.2 is about corrective action. Its purpose is to remove the cause of a nonconformity so it does not happen again. Not to tidy up the symptom. To remove the cause.

The clause asks for a documented procedure. That procedure must cover:

• reviewing nonconformities, including complaints;
• determining their causes;
• evaluating whether action is needed so they do not recur;
• deciding and documenting the action needed, and carrying it out, including updating documents;
• verifying that the action does not harm your ability to meet regulatory requirements, or the safety and performance of the device;
• reviewing the effectiveness of the action taken.

Action must be taken without undue delay, and in proportion to the effect of the nonconformity. Records of every investigation and every action are kept.

Its partner clause, 8.5.3, covers preventive action: removing the cause of a potential problem before it happens. The same discipline applies.

CAPA does not stand alone. It is fed by complaint handling (8.2.2), control of nonconforming product (8.3), analysis of data (8.4) and internal audit (8.2.4). Its status is a required input to management review (5.6.2). Pull on CAPA and half your QMS moves with it.

CAPA is where your QMS shows whether it learns.

Every system has problems. Complaints come in. Stock arrives damaged. An audit finds a gap. Problems on their own are not the issue. What matters is what happened next.

A CAPA record shows the whole chain in one place: the trigger, the cause, the action, and whether it worked. That makes it a fast way to test the rest of the system. A weak CAPA file often points to weak complaint handling, weak audits, or both.

This area carries the heaviest weight on the Gap Heatmap, at 16. The live finding is specific: "No documented CAPA effectiveness checks." Plenty of teams open CAPAs and close them. Fewer can show that the fix held.

1. Do you have a documented CAPA process triggered by complaints, non-conformities and audit findings?

What "we do this" sounds like: "When something goes wrong, we deal with it straight away."

What you could put on the table: a CAPA SOP that names the triggers and the criteria for opening a CAPA. A CAPA log. And a visible link from each complaint, nonconformance report and audit finding to either a CAPA number or a recorded reason why no CAPA was needed.

"Dealing with it" is correction. It fixes this instance. Corrective action stops the next one. You need both, and your records should keep them apart.

2. Do corrective actions include a recorded root-cause analysis, not just a quick fix?

What "we do this" sounds like: "We know why it happened. It was human error."

What you could put on the table: a written investigation for each CAPA. The method you used, whether that was 5 Whys, a fishbone diagram or a simple timeline. The evidence you looked at. And a cause stated specifically enough that someone else could act on it.

"Human error" is rarely a root cause. It is where the investigation should start. Why was the error possible? Why did nothing catch it?

3. Does each CAPA include a documented effectiveness check before it is closed?

What "we do this" sounds like: "We closed it once the new procedure was signed off."

What you could put on the table: for each closed CAPA, an effectiveness criterion written when the action was decided. The data you checked after a defined period. A dated result showing whether the problem recurred. And the name of the person who verified it.

Signing off a new procedure shows the action was done. It does not show the action worked. The effectiveness check is the only part of the record that answers that question.

• A CAPA SOP that names triggers, responsibilities, timelines and closure criteria
• A CAPA log with status, owner, opened date and due date for every record
• Links from complaints, nonconformances and audit findings to CAPAs, or a documented decision not to open one
• A recorded root-cause investigation for each CAPA, with the method and evidence
• The actions taken, including any documents updated as a result
• A check that each action did not affect regulatory compliance or device safety and performance
• An effectiveness criterion set before closure, and a dated, signed effectiveness result
• CAPA status reported into management review
• Trend data showing whether the same problems keep coming back

These are patterns I see, not statistics.

Closing on action, not on effect. The training happened, the SOP was updated, the CAPA was closed the same week. Nobody went back to see if the problem returned.

Retraining as the answer to everything. If every root cause is "human error" and every action is "retrain staff", the investigation has stopped too early.

The CAPA that never closes. Some records sit open for a year or more, with no owner and no due date. An old open CAPA reads as a problem nobody owns.

Effectiveness criteria written after the fact. If you decide what "worked" means after you have looked at the data, the check proves very little.

Complaints with no route to CAPA. Complaints are logged and answered, but nobody decides whether each one needs a CAPA. The link is simply missing.

SAHPRA is phasing in mandatory ISO 13485:2016 certification, per its MD01 notice dated 18 September 2025. Phase 2 covered renewals from 1 June 2025, for manufacturers and for distributors and importers. Phase 3, from 1 April 2026, applies to companies already holding a certificate: holders "will be requested to submit". SAHPRA describes the requirement as mandatory. Amendments follow on 1 June 2027, and all new applications on 1 April 2028.

Your establishment licence is what lets you trade in devices. An inspection tests whether your system supports it. For CAPA, the inspector's job is to see evidence, not intentions. A closed record with no effectiveness check is still a claim.

Set aside 60 minutes with your CAPA log.

1. 10 minutes. List every CAPA closed in the last 12 months.
2. 15 minutes. For each one, mark whether the record holds a written effectiveness check, with a date and a name.
3. 10 minutes. Pick the three closed CAPAs with no effectiveness check and the highest risk to the device.
4. 15 minutes. For each of those three, write one line: "This action worked if, by [date], [measure] shows [result]." Use data you already collect, such as complaint counts, receiving rejections or temperature excursions.
5. 10 minutes. Put a check date in the calendar for each, with a named owner.

You have not reopened your whole CAPA history. You have put a real test against the three that matter most.