Under the FDA's Quality Management System Regulation (QMSR), effective February 2, 2026, corrective action and preventive action are two distinct, separately evaluated QMS processes with different triggers, different documented inputs, and different required outputs. Corrective action responds to a confirmed nonconformity; preventive action responds to a potential failure identified through data analysis before any event occurs. FDA investigators now assess these processes independently under Compliance Program 7382.850. Organizations that still operate a single merged CAPA SOP, treating preventive action as a follow-on step inside a corrective action record, carry measurable inspection risk under the current regulatory framework.

What QMSR Changed for CAPA

The Quality Management System Regulation (QMSR), which became effective on February 2, 2026, is a substantive overhaul of 21 CFR Part 820. It harmonizes FDA's medical device quality requirements with ISO 13485:2016 by incorporating that standard by reference, creating a dual-layer regulatory obligation: manufacturers must comply with both the QMSR's specific statutory requirements and the entirety of ISO 13485:2016.

For CAPA practitioners, the implications are significant. Under the legacy Quality System Regulation (QSR), section 820.100 addressed “Corrective and Preventive Action” as a single combined process. The language was broad enough that industry practice largely treated corrective and preventive action as two phases of the same workflow. A nonconformance would trigger a CAPA record, a root cause investigation would be conducted, corrective actions would be assigned, and then a “preventive action” field would be populated, often describing steps to prevent recurrence of the same event. This blending was not FDA's original intent, but the structure of section 820.100 allowed it to persist for decades.

In the QMSR preamble, Comment #20 makes the FDA's position explicit: the agency's intent was always that corrective action and preventive action function as ISO 13485:2016 defines them, as separate processes with distinct triggers, inputs, and documentation requirements. QMSR removes the regulatory ambiguity. ISO 13485:2016 addresses corrective action in clause 8.5.2 and preventive action in clause 8.5.3. These are independent QMS processes with separate procedural requirements, not sub-steps of a unified workflow.

FDA investigators conducting inspections under Compliance Program 7382.850 now evaluate each process on its own terms. An organization that runs both through one SOP is not automatically in violation, but the documentation that process generates must satisfy the distinct requirements of each clause independently. In practice, that outcome is difficult to achieve with a single-form CAPA record.

Corrective Action Under QMSR: What the Regulation Requires

Corrective action, as defined under ISO 13485:2016 clause 8.5.2, is the process of eliminating the root cause of a detected nonconformity to prevent its recurrence. The trigger is always reactive: something has already occurred. A product nonconformity, a complaint, a deviation CAPA, a supplier failure, a failed inspection, an audit finding. In every case, a confirmed adverse condition has been identified, and the corrective action process begins from that documented event.

The standard and the QMSR require that the corrective action procedure produce specific documented evidence. This includes: a review of the nonconformities encountered; a determination of the causes of those nonconformities; an evaluation of the need for action to ensure that nonconformities do not recur; the determination and implementation of the action required; records of the investigation and its results; and verification or validation that the corrective action taken does not adversely affect the ability to meet applicable requirements or the safety and performance of the device.

The root cause investigation is the analytical core of the corrective action process, and it is the element FDA investigators scrutinize most closely. Common inspection findings include: corrective actions that address only the symptom rather than the systemic cause; investigations closed without documented evidence of root cause determination; and effectiveness checks that verify the action was completed rather than verifying the nonconformity did not recur in a defined observation period.

The depth and rigor of the root cause investigation also determines the scope of the corrective action taken. An investigation that identifies “operator error” as the root cause without examining training record completeness, work instruction clarity, or process design factors will typically produce a corrective action that does not hold. FDA warning letters frequently reference situations where the same or similar nonconformity recurred after a closed corrective action record because the underlying root cause was not fully addressed.

Under QMSR, the risk-based approach required throughout ISO 13485:2016 applies directly to corrective action. The extent of investigation and urgency of action must be proportionate to the effect of the nonconformity encountered. A one-off documentation error in a low-risk process may warrant a focused correction and a brief investigation. A recurring product failure with field impact requires a comprehensive investigation, a formal risk assessment, and potentially a systemic process review. Both must be documented, but the calibration must be defensible and traceable.

Preventive Action Under QMSR: A Proactive, Data-Driven Process

Preventive action, defined in ISO 13485:2016 clause 8.5.3, is the process of eliminating the cause of a potential nonconformity to prevent its occurrence. The trigger is always proactive: nothing has happened yet. The preventive action process begins when data or analysis reveals that conditions exist which, if left unaddressed, are likely to produce a nonconformity in the future.

This distinction in trigger is the most operationally important difference between corrective and preventive action, and it is the one most consistently misunderstood in organizations that rely on a merged CAPA procedure. Preventive action does not start after a problem occurs. It starts with data.

The inputs that can initiate a preventive action include: trend analysis of in-process monitoring data; quality metrics that show gradual degradation before reaching a nonconformance threshold; risk assessments that identify high-probability failure modes with insufficient current mitigations; supplier performance data trending toward a potential qualification failure; internal audits or management reviews that surface systemic vulnerabilities; and customer feedback indicating growing dissatisfaction with a characteristic not yet reaching formal complaint status.

ISO 13485:2016 clause 8.5.3 requires organizations to: determine potential nonconformities and their causes; evaluate the need for action to prevent occurrence; determine and implement the action needed; record the results of the investigation; and review preventive actions taken. Critically, information about preventive actions must be submitted as an input to management review. This creates a formal feedback loop between the preventive action process and senior leadership oversight, and it means preventive action activity must be traceable to the management review record.

Under QMSR, FDA now expects to see active preventive action programs during inspections, not just corrective action records. An organization that can only demonstrate reactive CAPA, with no documented preventive actions sourced from trend data, risk analysis, or management review inputs, presents a visible gap. FDA investigators look for evidence that the organization systematically analyzes data beyond direct nonconformances and translates that analysis into documented, time-bound preventive measures.

The Documentation Each Process Requires

Because QMSR and ISO 13485:2016 treat corrective and preventive action as separate processes, the documentation each one produces must be distinct. An FDA Form 483 observation citing inadequate corrective action will be assessed against the specific requirements of clause 8.5.2. A citation for inadequate preventive action will be assessed against clause 8.5.3. A merged CAPA record that combines both must satisfy each set of requirements simultaneously, and the record must clearly demonstrate which portions of the documentation belong to which process.

For corrective action, the minimum required documentation covers: the identified nonconformity and its source; the investigation findings and determined root cause; the corrective actions taken; documentation of the investigation results; evidence of effectiveness verification with defined criteria; and records of any updates to procedures, specifications, or training that resulted from the action.

For preventive action, the minimum required documentation covers: the potential nonconformity identified and its source data; the analysis that established the likelihood of occurrence; the preventive actions taken and their rationale; the results of those actions; and records submitted to management review with traceability back to the source data.

Effectiveness verification deserves particular attention in both processes. For corrective action, the verification confirms that the action taken actually eliminated the root cause and that the nonconformity has not recurred within a defined observation period. The verification method, timing, and pass/fail criteria must be predetermined and documented at the time the corrective action plan is finalized, not assigned retrospectively. For preventive action, effectiveness monitoring confirms that the potential nonconformity has not materialized after the preventive measure was implemented, over a defined observation period assessed against the source data that originally triggered the action.

A chronic inspection finding across both processes is that effectiveness checks are left open indefinitely or closed with narrative notes rather than structured evidence. FDA investigators consider this inadequate. The effectiveness evaluation must be structured, with criteria established before implementation, executed at a defined point, and documented with objective evidence.

Risk-Based Proportionality and the Connection Between Both Processes

QMSR's incorporation of ISO 13485:2016 brings an explicit risk-based approach to both corrective and preventive action. The level of investigation, the scope of corrective action, and the urgency of preventive action must all be calibrated to the risk level of the actual or potential failure being addressed. This proportionality is not optional language. It is a documented requirement that FDA investigators evaluate when reviewing CAPA records.

The two processes also intersect in a meaningful operational sense. When a corrective action resolves a nonconformity, the investigation findings and the nature of the root cause should feed back into the risk assessment and preventive action program. If a root cause investigation reveals a failure mode that the organization's current risk analysis did not adequately control, that finding becomes an input to a preventive action for all potentially affected processes or products. The corrective action process generated the intelligence; the preventive action process applies it systematically across the broader system.

A well-structured QMS under QMSR reflects this relationship explicitly. Corrective action records reference the risk assessment updates that followed. Preventive action records trace their input to a specific trend report, risk register output, or corrective action finding. Management review minutes document both processes and draw documented connections between them. When this architecture is present, the CAPA system demonstrates the systemic, risk-based quality thinking that QMSR was designed to codify.

Building a CAPA Program That Meets QMSR Requirements

Quality teams managing CAPA under QMSR need separate, documented procedures for corrective action and preventive action that each satisfy their respective ISO 13485:2016 clause requirements. The procedures do not need to be managed in entirely separate systems, but the workflows, record structures, and documentation outputs must be distinct and independently defensible.

The critical operational gap that QMSR exposes is in preventive action sourcing. Organizations that only initiate preventive actions from within a corrective action record, as a “prevent recurrence” checkbox, are not running a true preventive action program under clause 8.5.3. Preventive action has entirely different inputs: trend monitoring, supplier quality metrics, customer feedback analysis, internal audit outputs, and risk assessment findings. The function responsible for CAPA must have formal mechanisms to receive and analyze these data sources and convert them into documented, time-bound preventive action records.

From a process design standpoint, the key steps for corrective action are: initiation from a confirmed nonconformance source; containment where patient or product safety risk exists; formal root cause investigation using a documented methodology; determination and implementation of corrective actions; effectiveness verification with predefined criteria; and records submitted to management review. For preventive action, the key steps are: formal data collection and trend monitoring across QMS inputs; identification of potential failure conditions with documented analysis; risk evaluation to determine whether action is warranted; determination, implementation, and documentation of preventive actions; and effectiveness monitoring with formal management review reporting.

Cloudtheapp's CAPA module is built to support this separation with structural rigor. The platform maintains distinct workflows for corrective action and preventive action, each with dedicated record forms, role-based routing, configurable root cause analysis frameworks, and automated effectiveness verification scheduling. Quality Managers can configure each workflow independently to match existing SOPs without custom coding, and management review reporting is generated directly from CAPA record data.

Preparing for FDA Inspection Under the New Compliance Program

CAPA remains one of the most frequently cited areas in FDA inspections and Form 483 observations across both pharmaceutical and medical device manufacturers. The findings that carry the most enforcement weight are those that show systemic failure: ineffective root cause investigations; closed corrective actions where the nonconformity recurred; preventive action programs that are absent or undocumented; and effectiveness verifications that exist on paper but cannot be supported with objective evidence.

QMSR raises the compliance threshold by directly incorporating ISO 13485:2016 requirements. FDA investigators now have the full specificity of clauses 8.5.2 and 8.5.3 as the compliance benchmark. An organization that meets the general intent of CAPA but cannot demonstrate the specific documented outputs required by those clauses will accumulate observations.

The path to inspection readiness requires procedural clarity, documented execution, and a preventive action program that operates from real data inputs rather than as a formality embedded inside corrective action records. When these two processes are structurally distinct, their records are independently complete, and effectiveness verification is evidence-based and systematic, the CAPA program becomes one of the most defensible elements of the QMS rather than one of the most cited.

Cloudtheapp supports medical device and life sciences manufacturers in building compliant, inspection-ready CAPA systems as part of a fully validated, FDA-compliant eQMS, built on ISO 13485:2016 and 21 CFR Part 820 requirements from the ground up.

If your organization is working through QMSR compliance or building a CAPA program that meets the separate requirements of ISO 13485:2016 clauses 8.5.2 and 8.5.3, request a demo to see how the Cloudtheapp CAPA module operates in practice, or start a 30-Day Free Trial to explore the full platform in your own environment.

This post created by and appeared first on Cloudtheapp

Corrective action and preventive action are two distinct processes with different triggers, different inputs, and different required documented outputs under ISO 13485:2016. Corrective action responds to a known failure. Preventive action responds to a potential failure identified through trend analysis, risk assessment, or data review before anything breaks. Under the FDA's Quality Management System Regulation (QMSR), effective February 2, 2026, these processes are evaluated separately under the new Compliance Program 7382.850. A combined SOP that treats preventive action as a checkbox inside a corrective action record creates measurable inspection risk, not because the format is wrong, but because the process structure typically fails to produce the documented PA outputs the regulation requires.

Corrective Action vs. Preventive Action: What ISO 13485 and FDA QMSR Actually Require

Few topics generate more debate among quality professionals than corrective and preventive action procedures. The argument tends to center on the wrong question: single SOP or separate SOPs? The more important question is whether your CAPA process produces the documented evidence each clause specifically requires. Under ISO 13485:2016 and the FDA's QMSR, these are not interchangeable processes, and the regulatory expectations for each are distinct.

Correction, Corrective Action, and Preventive Action: Three Different Things

Before getting into what each clause requires, it helps to establish what these three terms actually mean. They are frequently conflated in quality systems, and the conflation is itself a compliance risk.

A correction addresses the immediate problem. It fixes the nonconforming output: the product is reworked, quarantined, or disposed of. A correction does not investigate why the problem occurred and does not address the root cause.

A corrective action addresses the root cause of a known nonconformity. It is initiated after a problem has been identified, and its purpose is to eliminate the cause so the problem does not recur. The trigger is a confirmed failure.

A preventive action addresses a potential nonconformity before it occurs. Its trigger is not a failure but a signal: a trend in data, a risk identified through a quality risk assessment, a pattern in near-misses, or a systemic vulnerability identified through process review. No product has failed yet. The purpose is to eliminate the conditions that could produce a failure.

ISO 13485:2016 defines all three. The QMSR incorporates these definitions by reference. Treating corrective and preventive action as a single continuous process is one of the most common sources of CAPA-related audit findings in medical device inspections.

What ISO 13485:2016 Clause 8.5.2 Requires for Corrective Action

Clause 8.5.2 of ISO 13485:2016 establishes the documented requirements for corrective action. The organization must take action to eliminate the cause of nonconformities to prevent recurrence. The required process elements include:

Reviewing nonconformities, including complaints. Determining the causes of nonconformities. Evaluating the need for corrective action to ensure nonconformities do not recur. Planning and implementing necessary action. Verifying effectiveness of the corrective action taken. Ensuring that information on actions taken is communicated to personnel responsible for ensuring product quality.

Each of these elements must be documented. The root cause investigation must produce an identifiable, specific cause. Effectiveness verification must demonstrate, with objective evidence, that the corrective action resolved the problem and prevented recurrence. A corrective action record that identifies "human error" as the root cause and closes with retraining as the only action does not satisfy this clause for any systemic issue.

The clause also requires that corrective action be appropriate to the effects of the nonconformities encountered. Proportionality is expected. A minor typographical error in a work instruction does not require the same depth of investigation as a recurring sterility breach. The initiation criteria for a corrective action should reflect this proportionality in writing, not rely on individual judgment.

What ISO 13485:2016 Clause 8.5.3 Requires for Preventive Action

Clause 8.5.3 addresses preventive action with structurally similar but functionally distinct requirements. The organization must determine action to eliminate the causes of potential nonconformities. The required process elements include:

Determining potential nonconformities and their causes. Evaluating the need for action to prevent occurrence of nonconformities. Planning and implementing necessary action. Recording results of investigations and action taken. Reviewing the preventive action taken.

The critical word in Clause 8.5.3 is "potential." The trigger for a preventive action is not a failure that has occurred. It is a signal in your data, your risk management system, your process performance trends, or your internal audit findings that points to a failure that has not yet happened. If your preventive action process only opens records in response to actual events, it is not functioning as a preventive action process. It is a second corrective action process with a different label.

The documented inputs for a preventive action include the data or risk signal that triggered the action, the potential nonconformity identified, the cause analysis for why that potential failure could occur, the action taken to eliminate that cause, and the effectiveness review confirming the risk was addressed. These are different inputs than a corrective action record. The documented output requirements are also different.

The Core Difference: Triggers, Inputs, and What Must Be Documented

This is the distinction that matters most operationally. Corrective action and preventive action do not differ only in timing. They differ in what evidence is required to open a record, what the investigation must produce, and what must be documented to close it.

For corrective action: the trigger is a confirmed nonconformity. The investigation must identify the specific root cause of that nonconformity. Closure requires documented evidence that the root cause was addressed and that effectiveness was verified.

For preventive action: the trigger is a data signal, risk assessment output, trend analysis, or process review that identifies a potential problem. The investigation must identify the potential cause. Closure requires documented evidence that the potential cause was addressed and that the risk signal is no longer present.

A combined SOP that uses a single record for both types of actions can technically satisfy these requirements, but only if the procedure explicitly defines separate trigger criteria, separate investigation logic, and separate documentation requirements for each type. In practice, most combined SOPs do not do this. Preventive action gets treated as a question at the bottom of a corrective action form: "What preventive actions were taken?" The answer is typically a copy of the corrective action. That is not a preventive action. It is a correction with extra steps.

What QMSR Changed for CAPA in 2026

The FDA's QMSR, effective February 2, 2026, replaced the Quality System Regulation (QSR) under 21 CFR Part 820. It incorporates ISO 13485:2016 by reference, making Clauses 8.5.2 and 8.5.3 directly enforceable as U.S. federal law. (FDA.gov)

Two changes under QMSR directly affect how CAPA records are evaluated during inspections.

The FDA's legacy Quality System Inspection Technique (QSIT) was replaced by Compliance Program 7382.850. Under QSIT, FDA investigators followed a structured four-subsystem approach that focused on whether CAPA records existed. Under the new compliance program, investigators can follow audit trails into internal audit records, management review documentation, and supplier audit findings, which were largely off-limits under QSIT. This gives investigators a broader view of whether preventive action is actually being triggered by quality data, or whether it appears only on paper.

The QMSR also mandates that corrective and preventive actions be managed as separate processes. Under the old QSR, a combined procedure was commonly accepted. Under QMSR's ISO 13485 incorporation, an FDA Form 483 observation for inadequate separation of CA and PA processes is a realistic inspection finding, particularly when the CAPA record does not demonstrate that preventive action was triggered by an independent data source.

Do Separate Clauses Mean Separate SOPs? The Real Answer

No regulatory document states that corrective action and preventive action must be in separate SOPs. This is an important clarification. The compliance requirement is not about document format. It is about whether each process has defined trigger criteria, defined investigation logic, and defined documented outputs that satisfy its respective clause.

A combined SOP that clearly defines what triggers a corrective action (a confirmed nonconformity), what triggers a preventive action (a data signal or risk finding), and that maintains separate record types for each with distinct required fields can satisfy QMSR and ISO 13485:2016.

The compliance risk is not the combined SOP itself. The risk is what most combined SOPs actually produce in practice: preventive action records that are either absent, or that are copies of the corrective action with different language, or that are marked "not applicable" without justification.

If your combined SOP can demonstrate that preventive actions are triggered independently, investigated against potential causes rather than confirmed ones, and closed with evidence that the potential cause was addressed, the format is defensible. If it cannot demonstrate those things, the format is not the problem. The process is.

Why Preventive Action Fails in Most Quality Systems

Several patterns explain why preventive action is the most consistently underperformed process in regulated quality systems.

No defined data sources. Corrective actions have obvious triggers: a nonconformity occurred. Preventive actions require someone to analyze trend data, process performance metrics, management review outputs, and risk registers and identify patterns that point to future problems. If no one is assigned to perform that analysis on a defined schedule, preventive actions never get initiated. The data exists. No one looks at it.

No trigger criteria. Most CAPA SOPs define initiation criteria for corrective actions: severity thresholds, number of occurrences, customer impact. Preventive action trigger criteria are rare. Without defined criteria, the decision to open a PA depends entirely on individual judgment, which means it rarely happens.

PA treated as part of CA closure. The most common failure mode: after a corrective action is investigated and implemented, the CAPA record asks what preventive actions were taken. The answer points back to the corrective action. This conflates the two processes and produces no independent preventive action analysis.

Effectiveness reviews not defined separately. Corrective action effectiveness asks whether the nonconformity recurred. Preventive action effectiveness asks whether the potential problem that was identified no longer represents a risk. These are different questions. A combined CAPA system that applies one effectiveness review to both produces documentation that satisfies neither.

Building Trigger Criteria That Make PA a Real Process

The most direct fix for an underperforming preventive action process is defining, in writing, what actually triggers one. Here is a practical framework for building those criteria.

Tier 1 criteria trigger a preventive action automatically, without analysis. These include: quality risk assessment outputs that identify a high-severity, moderate-probability failure mode; internal audit findings that identify a systemic vulnerability with no current nonconformity; management review inputs showing a sustained negative trend in a key process metric; and near-miss events that reveal a systemic exposure.

Tier 2 criteria trigger a PA decision review, not an automatic opening. These include: two or more minor nonconformities in the same process area within a defined period; supplier performance data trending toward but not yet below the acceptance threshold; and post-market surveillance signals that do not rise to the level of a complaint but indicate a pattern.

The key difference from corrective action initiation criteria: PA triggers are forward-looking. They describe data patterns and risk signals, not confirmed failures. Defining them explicitly eliminates the dependence on individual judgment that causes PA to be perpetually undercounted.

What FDA Investigators Look for in CAPA Records

Under Compliance Program 7382.850, FDA investigators evaluating CAPA records are looking for several things that go beyond whether records are closed on time.

Evidence that preventive action is triggered by data, not by corrective actions. If every PA record in your system is linked to a CA event, investigators will note that no independent preventive action process is functioning. The expectation is that trend analysis, risk management outputs, and management review data feed the PA process independently.

Root cause investigation specificity. "Human error" as a root cause is not, by itself, a defensible conclusion for a systemic issue. Investigators expect to see specific causal factors identified, with corrective actions addressing those specific factors.

Effectiveness verification with objective evidence. A CAPA closed with "retraining completed" is not verified as effective unless follow-up data confirms that the nonconformity did not recur. Investigators look for the verification record and the data that supports it.

Connection between CAPA and management review. Management review is required to include CAPA status as an input under ISO 13485 Clause 5.6.2. If management review records do not reflect CAPA data and trends, that gap is visible during inspection.

Internal audit findings feeding the PA process. If your internal audit program identifies vulnerabilities that do not result in preventive action records, investigators will examine why. A finding with no PA attached is not automatically a problem, but a pattern of audit findings with no PA activity raises questions about whether the PA process is genuinely functioning.

How Cloudtheapp Supports Separate CA and PA Processes

Managing corrective action and preventive action as genuinely separate processes requires a quality system that enforces separate trigger criteria, separate record types, separate investigation workflows, and separate effectiveness verification steps. Attempting to manage this in a combined spreadsheet or a single document template produces exactly the documentation gaps that generate CAPA-related inspection findings.

Cloudtheapp's AI-powered, FDA-validated eQMS includes dedicated applications for corrective action and preventive action, each with configurable trigger criteria, defined required fields, workflow routing, and effectiveness review checkpoints. Because the platform is validated to 21 CFR Part 11 and ISO 13485:2016, every action in the system generates a timestamped audit trail that satisfies the record-keeping requirements both clauses demand.

The no-code Designer allows quality teams to configure their specific CA and PA trigger criteria directly into the workflow, so the system enforces initiation criteria consistently regardless of who is making the assessment. Trend data from nonconforming products, audit findings, and management review inputs feed directly into the PA process, eliminating the manual analysis step that most organizations skip.

For organizations currently managing CAPA in spreadsheets or a combined document system, Cloudtheapp's platform provides a structured, validated path to separation that does not require an implementation project or IT involvement. Request a demo to see how the CA and PA workflows operate in the context of your specific industry and device type.

Conclusion

Corrective action and preventive action are not two names for the same process. They have different triggers, different investigation requirements, and different documented outputs under ISO 13485:2016 Clauses 8.5.2 and 8.5.3. Under QMSR and the new FDA inspection framework, the expectation that both processes function independently is now enforceable at clause level, not just at the subsystem level of the legacy QSIT.

The debate about combined versus separate SOPs misses the real question. The question is whether your CAPA system produces documented evidence that preventive action is genuinely triggered by data, investigated against potential causes, and closed with effective risk reduction. If it does, the SOP format is defensible. If it does not, no SOP format protects you from an inspection finding.

This post created by and appeared first on Cloudtheapp

Emma Johnson

Sales Engineer at Cloudtheapp

This post created by and appeared first on Cloudtheapp

Wael Zebdeh

CTO at Cloudtheapp

This post created by and appeared first on Cloudtheapp