TLDR

Under the FDA's Quality Management System Regulation (QMSR), effective February 2, 2026, corrective action and preventive action are two distinct, separately evaluated QMS processes with different triggers, different documented inputs, and different required outputs. Corrective action responds to a confirmed nonconformity; preventive action responds to a potential failure identified through data analysis before any event occurs. FDA investigators now assess these processes independently under Compliance Program 7382.850. Organizations that still operate a single merged CAPA SOP, treating preventive action as a follow-on step inside a corrective action record, carry measurable inspection risk under the current regulatory framework.

What QMSR Changed for CAPA

The Quality Management System Regulation (QMSR), which became effective on February 2, 2026, is a substantive overhaul of 21 CFR Part 820. It harmonizes FDA's medical device quality requirements with ISO 13485:2016 by incorporating that standard by reference, creating a dual-layer regulatory obligation: manufacturers must comply with both the QMSR's specific statutory requirements and the entirety of ISO 13485:2016.

For CAPA practitioners, the implications are significant. Under the legacy Quality System Regulation (QSR), section 820.100 addressed "Corrective and Preventive Action" as a single combined process. The language was broad enough that industry practice largely treated corrective and preventive action as two phases of the same workflow. A nonconformance would trigger a CAPA record, a root cause investigation would be conducted, corrective actions would be assigned, and then a "preventive action" field would be populated, often describing steps to prevent recurrence of the same event. This blending was not FDA's original intent, but the structure of section 820.100 allowed it to persist for decades.

In the QMSR preamble, Comment #20 makes the FDA's position explicit: the agency's intent was always that corrective action and preventive action function as ISO 13485:2016 defines them, as separate processes with distinct triggers, inputs, and documentation requirements. QMSR removes the regulatory ambiguity. ISO 13485:2016 addresses corrective action in clause 8.5.2 and preventive action in clause 8.5.3. These are independent QMS processes with separate procedural requirements, not sub-steps of a unified workflow.

FDA investigators conducting inspections under Compliance Program 7382.850 now evaluate each process on its own terms. An organization that runs both through one SOP is not automatically in violation, but the documentation that process generates must satisfy the distinct requirements of each clause independently. In practice, that outcome is difficult to achieve with a single-form CAPA record.

Corrective Action Under QMSR: What the Regulation Requires

Corrective action, as defined under ISO 13485:2016 clause 8.5.2, is the process of eliminating the root cause of a detected nonconformity to prevent its recurrence. The trigger is always reactive: something has already occurred. A product nonconformity, a complaint, a deviation CAPA, a supplier failure, a failed inspection, an audit finding. In every case, a confirmed adverse condition has been identified, and the corrective action process begins from that documented event.

The standard and the QMSR require that the corrective action procedure produce specific documented evidence. This includes: a review of the nonconformities encountered; a determination of the causes of those nonconformities; an evaluation of the need for action to ensure that nonconformities do not recur; the determination and implementation of the action required; records of the investigation and its results; and verification or validation that the corrective action taken does not adversely affect the ability to meet applicable requirements or the safety and performance of the device.

The root cause investigation is the analytical core of the corrective action process, and it is the element FDA investigators scrutinize most closely. Common inspection findings include: corrective actions that address only the symptom rather than the systemic cause; investigations closed without documented evidence of root cause determination; and effectiveness checks that verify the action was completed rather than verifying the nonconformity did not recur in a defined observation period.

The depth and rigor of the root cause investigation also determines the scope of the corrective action taken. An investigation that identifies "operator error" as the root cause without examining training record completeness, work instruction clarity, or process design factors will typically produce a corrective action that does not hold. FDA warning letters frequently reference situations where the same or similar nonconformity recurred after a closed corrective action record because the underlying root cause was not fully addressed.

Under QMSR, the risk-based approach required throughout ISO 13485:2016 applies directly to corrective action. The extent of investigation and urgency of action must be proportionate to the effect of the nonconformity encountered. A one-off documentation error in a low-risk process may warrant a focused correction and a brief investigation. A recurring product failure with field impact requires a comprehensive investigation, a formal risk assessment, and potentially a systemic process review. Both must be documented, but the calibration must be defensible and traceable.

Preventive Action Under QMSR: A Proactive, Data-Driven Process

Preventive action, defined in ISO 13485:2016 clause 8.5.3, is the process of eliminating the cause of a potential nonconformity to prevent its occurrence. The trigger is always proactive: nothing has happened yet. The preventive action process begins when data or analysis reveals that conditions exist which, if left unaddressed, are likely to produce a nonconformity in the future.

This distinction in trigger is the most operationally important difference between corrective and preventive action, and it is the one most consistently misunderstood in organizations that rely on a merged CAPA procedure. Preventive action does not start after a problem occurs. It starts with data.

The inputs that can initiate a preventive action include: trend analysis of in-process monitoring data; quality metrics that show gradual degradation before reaching a nonconformance threshold; risk assessments that identify high-probability failure modes with insufficient current mitigations; supplier performance data trending toward a potential qualification failure; internal audits or management reviews that surface systemic vulnerabilities; and customer feedback indicating growing dissatisfaction with a characteristic not yet reaching formal complaint status.

ISO 13485:2016 clause 8.5.3 requires organizations to: determine potential nonconformities and their causes; evaluate the need for action to prevent occurrence; determine and implement the action needed; record the results of the investigation; and review preventive actions taken. Critically, information about preventive actions must be submitted as an input to management review. This creates a formal feedback loop between the preventive action process and senior leadership oversight, and it means preventive action activity must be traceable to the management review record.

Under QMSR, FDA now expects to see active preventive action programs during inspections, not just corrective action records. An organization that can only demonstrate reactive CAPA, with no documented preventive actions sourced from trend data, risk analysis, or management review inputs, presents a visible gap. FDA investigators look for evidence that the organization systematically analyzes data beyond direct nonconformances and translates that analysis into documented, time-bound preventive measures.

The Documentation Each Process Requires

Because QMSR and ISO 13485:2016 treat corrective and preventive action as separate processes, the documentation each one produces must be distinct. An FDA Form 483 observation citing inadequate corrective action will be assessed against the specific requirements of clause 8.5.2. A citation for inadequate preventive action will be assessed against clause 8.5.3. A merged CAPA record that combines both must satisfy each set of requirements simultaneously, and the record must clearly demonstrate which portions of the documentation belong to which process.

For corrective action, the minimum required documentation covers: the identified nonconformity and its source; the investigation findings and determined root cause; the corrective actions taken; documentation of the investigation results; evidence of effectiveness verification with defined criteria; and records of any updates to procedures, specifications, or training that resulted from the action.

For preventive action, the minimum required documentation covers: the potential nonconformity identified and its source data; the analysis that established the likelihood of occurrence; the preventive actions taken and their rationale; the results of those actions; and records submitted to management review with traceability back to the source data.

Effectiveness verification deserves particular attention in both processes. For corrective action, the verification confirms that the action taken actually eliminated the root cause and that the nonconformity has not recurred within a defined observation period. The verification method, timing, and pass/fail criteria must be predetermined and documented at the time the corrective action plan is finalized, not assigned retrospectively. For preventive action, effectiveness monitoring confirms that the potential nonconformity has not materialized after the preventive measure was implemented, over a defined observation period assessed against the source data that originally triggered the action.

A chronic inspection finding across both processes is that effectiveness checks are left open indefinitely or closed with narrative notes rather than structured evidence. FDA investigators consider this inadequate. The effectiveness evaluation must be structured, with criteria established before implementation, executed at a defined point, and documented with objective evidence.

Risk-Based Proportionality and the Connection Between Both Processes

QMSR's incorporation of ISO 13485:2016 brings an explicit risk-based approach to both corrective and preventive action. The level of investigation, the scope of corrective action, and the urgency of preventive action must all be calibrated to the risk level of the actual or potential failure being addressed. This proportionality is not optional language. It is a documented requirement that FDA investigators evaluate when reviewing CAPA records.

The two processes also intersect in a meaningful operational sense. When a corrective action resolves a nonconformity, the investigation findings and the nature of the root cause should feed back into the risk assessment and preventive action program. If a root cause investigation reveals a failure mode that the organization's current risk analysis did not adequately control, that finding becomes an input to a preventive action for all potentially affected processes or products. The corrective action process generated the intelligence; the preventive action process applies it systematically across the broader system.

A well-structured QMS under QMSR reflects this relationship explicitly. Corrective action records reference the risk assessment updates that followed. Preventive action records trace their input to a specific trend report, risk register output, or corrective action finding. Management review minutes document both processes and draw documented connections between them. When this architecture is present, the CAPA system demonstrates the systemic, risk-based quality thinking that QMSR was designed to codify.

Building a CAPA Program That Meets QMSR Requirements

Quality teams managing CAPA under QMSR need separate, documented procedures for corrective action and preventive action that each satisfy their respective ISO 13485:2016 clause requirements. The procedures do not need to be managed in entirely separate systems, but the workflows, record structures, and documentation outputs must be distinct and independently defensible.

The critical operational gap that QMSR exposes is in preventive action sourcing. Organizations that only initiate preventive actions from within a corrective action record, as a "prevent recurrence" checkbox, are not running a true preventive action program under clause 8.5.3. Preventive action has entirely different inputs: trend monitoring, supplier quality metrics, customer feedback analysis, internal audit outputs, and risk assessment findings. The function responsible for CAPA must have formal mechanisms to receive and analyze these data sources and convert them into documented, time-bound preventive action records.

From a process design standpoint, the key steps for corrective action are: initiation from a confirmed nonconformance source; containment where patient or product safety risk exists; formal root cause investigation using a documented methodology; determination and implementation of corrective actions; effectiveness verification with predefined criteria; and records submitted to management review. For preventive action, the key steps are: formal data collection and trend monitoring across QMS inputs; identification of potential failure conditions with documented analysis; risk evaluation to determine whether action is warranted; determination, implementation, and documentation of preventive actions; and effectiveness monitoring with formal management review reporting.

Cloudtheapp's CAPA module is built to support this separation with structural rigor. The platform maintains distinct workflows for corrective action and preventive action, each with dedicated record forms, role-based routing, configurable root cause analysis frameworks, and automated effectiveness verification scheduling. Quality Managers can configure each workflow independently to match existing SOPs without custom coding, and management review reporting is generated directly from CAPA record data.

Preparing for FDA Inspection Under the New Compliance Program

CAPA remains one of the most frequently cited areas in FDA inspections and Form 483 observations across both pharmaceutical and medical device manufacturers. The findings that carry the most enforcement weight are those that show systemic failure: ineffective root cause investigations; closed corrective actions where the nonconformity recurred; preventive action programs that are absent or undocumented; and effectiveness verifications that exist on paper but cannot be supported with objective evidence.

QMSR raises the compliance threshold by directly incorporating ISO 13485:2016 requirements. FDA investigators now have the full specificity of clauses 8.5.2 and 8.5.3 as the compliance benchmark. An organization that meets the general intent of CAPA but cannot demonstrate the specific documented outputs required by those clauses will accumulate observations.

The path to inspection readiness requires procedural clarity, documented execution, and a preventive action program that operates from real data inputs rather than as a formality embedded inside corrective action records. When these two processes are structurally distinct, their records are independently complete, and effectiveness verification is evidence-based and systematic, the CAPA program becomes one of the most defensible elements of the QMS rather than one of the most cited.

Cloudtheapp supports medical device and life sciences manufacturers in building compliant, inspection-ready CAPA systems as part of a fully validated, FDA-compliant eQMS, built on ISO 13485:2016 and 21 CFR Part 820 requirements from the ground up.

If your organization is working through QMSR compliance or building a CAPA program that meets the separate requirements of ISO 13485:2016 clauses 8.5.2 and 8.5.3, request a demo to see how the Cloudtheapp CAPA module operates in practice, or start a 30-Day Free Trial to explore the full platform in your own environment.