Corrective and Preventive Action: ISO 13485’s Proven Engine

Corrective and preventive action is the clause where ISO 13485 stops being a filing system and starts being a safety system. Every other requirement in the standard produces information — complaints, audit findings, nonconforming product, supplier defects, post-market signals. Corrective and preventive action is the only process that is obligated to do something with it. And since February 2, 2026, when the FDA's Quality Management System Regulation took effect and pulled ISO 13485:2016 into federal law by reference, the way a device manufacturer runs corrective and preventive action is no longer just an auditor's concern. It is an investigator's.

Across 200+ certification and surveillance audits, Management Systems International (MSI) has watched a consistent pattern hold: the corrective and preventive action file is the first place a competent auditor goes and the last place an organization has actually invested. Design controls get attention because they are visible. The medical device file gets attention because it is unmistakably required. Corrective and preventive action gets a spreadsheet, an owner who inherited it, and a quiet backlog of open records nobody wants to explain.

This guide walks the entire loop — what the clauses actually demand, the seven operational steps, the five failure modes that reliably produce findings, what changed when the FDA QMSR replaced the old Quality System Regulation, what the next edition of ISO 9001 adds to the picture, and how a corrective and preventive action system that works becomes the single most persuasive piece of evidence a device organization can put in front of a regulator.

THE REQUIREMENT

What Is Corrective and Preventive Action Under ISO 13485?

Two clauses. One loop. Zero shortcuts.

The single most common misconception about corrective and preventive action is that CAPA is one process. It is not. ISO 13485:2016 writes it as two distinct requirements, sitting side by side in Clause 8.5:

• Clause 8.5.2 — Corrective action. Action to eliminate the cause of a nonconformity that has already occurred, to prevent it from recurring. The organization must document a procedure covering review of the nonconformity, determination of cause, evaluation of the need for action, planning and documenting the action, verification that the action does not adversely affect the ability to meet regulatory requirements or device safety and performance, and review of the effectiveness of the action taken.
• Clause 8.5.3 — Preventive action. Action to eliminate the cause of a potential nonconformity, to prevent it from occurring at all. Same procedural rigor. Different trigger.

Two clauses, two triggers, one shared discipline. In practice, most device organizations run them through a single procedure with a classification field — and that is fine, provided the records demonstrate that preventive action is genuinely happening and not just a checkbox that nobody has ever ticked. An empty preventive action register is one of the fastest findings an experienced auditor can write.

It matters that ISO 13485 keeps its own architecture here. The standard deliberately retained the pre-Annex SL structure — it is not built on the harmonized ten-clause backbone that ISO 9001, ISO 14001, and ISO 45001 share. So a team arriving from ISO 9001 looking for “Clause 10.2” will not find it. The corrective and preventive action requirements live at 8.5.2 and 8.5.3, and the surrounding furniture — document control at 4.2.4, records at 4.2.5, the medical device file at 4.2.3 — sits where ISO 9001:2008 left it. MSI's guide to document control across the standards maps this difference clause by clause, and the free document control maturity check scores your own version of it in about six minutes.

If you are writing the document rather than researching the clause, MSI's cross-standard pillar on how to write a corrective action procedure covers the drafting decisions that determine whether the finished document works — the two failures that account for most recurring findings, and what each of the five standards forces into the procedure that the others do not.

THE DIVERGENCE

Why ISO 13485 Kept Preventive Action When ISO 9001 Dropped It

Deliberate. Defensible. Device-specific.

When ISO 9001 moved to the 2015 edition, it removed the standalone preventive action clause and absorbed the intent into Clause 6.1, risks and opportunities. The logic was sound for general quality management: if you are systematically identifying and treating risk during planning, you are already doing preventive action, and a separate clause is redundant machinery. ISO 14001 and ISO 45001 followed the same path.

ISO 13485 did not follow. It kept preventive action as an explicit, separately auditable requirement — and that decision was not an oversight. In a medical device context, the distinction between “we manage risk during design” and “we take documented action on a potential nonconformity we have detected in the running system” is the distinction between a hazard analysis and a recall that never happened. Risk-based thinking is anticipatory. Preventive action is responsive to a signal — a trend in complaint data, a supplier drifting toward the edge of specification, a competitor's field safety notice on a similar device. Corrective and preventive action, taken together, gives the device organization a formal home for both halves.

The practical consequence for an organization holding both ISO 9001 and ISO 13485 is that one corrective and preventive action procedure can serve both, but it must be written to the stricter parent. Build to ISO 13485's requirements and ISO 9001 Clause 10.2 is satisfied automatically. Build to ISO 9001 alone and the preventive action records will not exist when the notified body asks for them. MSI's work on integrated management systems is built on exactly this principle: write once, to the highest bar, and satisfy every standard in scope.

THE PROCESS

The Seven Steps of the Corrective and Preventive Action Loop

Catch. Correct. Continually improve.

A working corrective and preventive action procedure has seven steps. Organizations that skip one usually skip the same one — step six.

1. Identification and Intake

Define the triggers explicitly in the procedure, or the system will only ever see what someone remembers to report. The standard set: customer complaints, internal audit findings, external audit findings, nonconforming product, supplier nonconformity, process monitoring data out of control, post-market surveillance and vigilance signals, servicing and installation reports, and management review outputs. Each needs a named route into the corrective and preventive action system and a named person who owns intake.

Complaint handling deserves special mention because ISO 13485 Clause 8.2.2 is explicit: if a complaint is not investigated, the justification must be documented. That is one of the most reliably missed records in the entire standard — and it is trivially easy for an investigator to sample.

2. Evaluation, Risk Assessment, and Escalation

Not every issue deserves a full corrective and preventive action record. Trying to run one for every deviation collapses the system under its own weight — and an overloaded CAPA queue is itself a finding. The procedure needs a documented triage: assess severity, scope, detectability, and patient risk, then decide whether the issue is handled as a correction, escalated to corrective action, or routed to preventive action.

This is where the risk file connects. ISO 14971 is the risk management standard ISO 13485 Clause 7.1 points to, and a corrective and preventive action record that changes the hazard picture must feed back into the risk management file. If your CAPA system and your ISO 14971 file do not talk to each other, you have two systems and one of them is lying. That interface is a closure field, not an intention — which is why MSI's ISO 13485 risk management procedure template names what feeds risk and what risk hands on, and why the guide to writing a risk management procedure treats corrective action as one of the three interfaces that fail most often. If you would rather see where yours stands first, score your current risk process free — about six minutes, no details required.

Escalation criteria also belong here: at what threshold does an issue trigger a field safety corrective action, a regulatory notification, or an advisory notice? Those criteria must be written down before you need them, not improvised while the clock runs.

3. Root Cause Analysis — Proportionate to Risk

The governing principle: the depth of investigation should be proportionate to the level of risk. A low-risk labeling typo does not need a fault tree. A sterilization excursion does.

The procedure should name the methods and say when each applies. ASQ's root cause analysis resources catalogue the standard toolkit — 5 Whys for simple, single-thread causes; fishbone (Ishikawa) when the cause could sit in any of several categories; FMEA when you are analyzing failure modes across a design or process; fault tree analysis when a serious harm needs to be traced backward through combinations of contributing events.

Two tells that root cause analysis has failed, both of which auditors recognize instantly. First: the root cause is “human error.” Human error is a symptom, not a cause — the cause is whatever made the error possible and undetected. Second: the corrective action is “retrain the operator.” Retraining is almost never a root cause fix; it is what organizations write when they have not found one.

Note also that root cause work performed for corrective and preventive action frequently surfaces preventive opportunities elsewhere — the same failure mode sitting undetected in an adjacent product line or process. Capturing that is the whole point of Clause 8.5.3.

4. Action Planning

Every action in a corrective and preventive action plan needs three attributes an auditor can verify: an owner (a person, not a department), a due date, and a definition of what “done” looks like. Plans that fail audit are almost always plans that fail one of those three. The plan must also address the “similar nonconformities elsewhere” question — ISO 13485 expects the organization to determine whether the same cause is present in other processes, products, or sites.

5. Implementation — Including the Impact Check

Actions land in procedures, work instructions, tooling, specifications, supplier agreements, or training. This is also where ISO 13485 adds a requirement ISO 9001 does not: before implementing, the organization must verify that the corrective and preventive action does not adversely affect the ability to conform to regulatory requirements or the safety and performance of the device. Changing a process to fix one problem can create another, and in a device context that consequence can reach a patient.

If the action touches a design output, it becomes a design change under Clause 7.3.9 — which, since the QMSR, is federal law in the United States for finished devices in commercial distribution. MSI covers that intersection in its guide to change management automation across ISO 9001 and ISO 13485. Where the action lands in production — a revised work instruction, a new inspection point, a changed acceptance criterion — it lands inside the Clause 7.5 production and service procedure, which is where an investigator will look for evidence that it actually took hold. Where it lands in competence — a revised qualification, a re-evaluation after training — it lands inside the Clause 6.2 human resource management procedure, which is where the evaluation-of-effectiveness record has to exist before “retrain the operator” can ever be a defensible action.

6. Verification of Effectiveness — The Step Everyone Skips

This is the step that separates a corrective and preventive action system from a ticketing system, and it is the step most organizations quietly do not perform.

Completion is not effectiveness. “The procedure was revised” is completion. “The revised procedure has been in effect for two quarters and the defect rate that triggered this record has not recurred” is effectiveness. The standard requires the latter. That means the record must define, up front, what evidence will demonstrate that the action worked, over what period, and measured how. Then someone has to go back and look.

MSI's methodology for internal audit follow-up draws the same bright line, and it applies identically to corrective and preventive action: a record is only truly closed when the root cause was correctly identified, objective evidence shows the action was implemented, and the condition that produced the nonconformity no longer exists. Anything less is paperwork. Auditors themselves are now working to a newer rulebook here: ISO 19011:2026 published on May 27, 2026 and cancelled the 2018 edition outright, with no transition period. If your internal audit programme still cites the withdrawn edition in its procedure, that is a documentation finding waiting to be written.

7. Documentation and Closure

Every step generates a record, and the records must be retained and retrievable under Clause 4.2.5. The corrective and preventive action file is not merely an audit artifact — over time it becomes the organization's institutional memory of what actually goes wrong and what actually fixes it. That is a genuine asset. Organizations that mine their CAPA data for patterns typically find that a small number of root causes are responsible for the majority of their findings, which is exactly the insight leadership needs to allocate resources intelligently.

THE REGULATOR

What the FDA QMSR Changed for Corrective and Preventive Action

Inspectable. Federal. Now.

On February 2, 2026, the FDA's Quality Management System Regulation replaced the Quality System Regulation. 21 CFR Part 820 now incorporates ISO 13485:2016 by reference. For corrective and preventive action, three consequences matter more than the rest.

The practical translation: a corrective and preventive action backlog that used to be an internal embarrassment is now an inspectable liability. Historically, quality-system deficiencies have been among the most frequently cited categories in device FDA warning letters, and corrective and preventive action sits at the center of that category. MSI's detailed breakdown of the QMSR alignment with ISO 13485 walks through what device organizations need to have in place.

This is not a U.S.-only story. The Medical Device Single Audit Program (MDSAP) lets a single audit satisfy multiple national regulators, and the EU Medical Device Regulation expects a quality system that ISO 13485 satisfies. Harmonization work through the International Medical Device Regulators Forum continues to converge these expectations, and accreditation of the bodies that audit you now runs through Global ACI, which unified the former IAF and ILAC frameworks on January 1, 2026. One well-run corrective and preventive action system now answers to nearly every regulator a device company will meet.

THE FAILURE MODES

Five Ways a Corrective and Preventive Action System Quietly Dies

Recognizable. Recurring. Repairable.

Across 200+ audits attended, MSI has watched corrective and preventive action systems fail in the same five ways. None of them is exotic. All of them are visible from the outside.

MSI's analysis of the top maintenance risks certified companies overlook and its list of the most common post-certification mistakes both land on the same conclusion from different directions: certification is not the hard part. Keeping the improvement loop alive between audits is. MSI's guide to sustaining improvement under ISO 13485 traces the same decay pattern in device organizations specifically. If you would rather measure the decay than describe it, the free Nonconformity and Corrective Action Maturity Check scores your process against all five of these failure modes and tells you which one is actually costing you.

THE LEADERSHIP LOOP

How Corrective and Preventive Action Feeds Management Review

Data. Decisions. Direction.

ISO 13485 Clause 5.6 requires management review, and it names corrective action and preventive action as explicit, separate inputs. This is not a formality. It is the mechanism by which the corrective and preventive action system stops being a quality department problem and becomes a leadership one.

A management review that receives a corrective and preventive action count — “we opened 14, closed 11” — has received nothing useful. A management review that receives root cause categories, time-to-closure trends, recurrence rates, and effectiveness verification pass rates has received a diagnosis. The first produces a nod. The second produces a resource decision.

Since the QMSR made management review records FDA-inspectable, this input has an additional dimension. An investigator reading a management review that shows leadership examining corrective and preventive action effectiveness — and allocating resources in response — is reading evidence of a system that works. An investigator reading a review that lists a CAPA count and moves on is reading something else entirely. MSI's guidance on running an ISO management review covers the input structure in detail, and the ISO 13485 management review playbook walks a first-time device review end to end.

ONE SYSTEM, MANY STANDARDS

One CAPA Process Can Serve Every Standard You Hold

Write once. Satisfy all.

Device organizations rarely hold ISO 13485 alone. Many also carry ISO 9001 because a customer requires it, ISO 14001 because of an ESG mandate or a supply chain questionnaire, and ISO 45001 because manufacturing operations demand it. Running four separate improvement procedures is a self-inflicted wound.

The corrective and preventive action machinery is substantially the same across all of them. ISO 9001 Clause 10.2, ISO 14001 Clause 10.2, and ISO 45001 Clause 10.2 all require reaction, root cause evaluation, action, effectiveness review, and retained documented information. ISO 13485 requires the same plus explicit preventive action, the regulatory-impact check, and heavier record retention. Write the procedure to the ISO 13485 bar, add the environmental and safety triggers to the intake list, and one corrective and preventive action process now serves the whole certificate portfolio.

The divergences are real and they are specific. ISO 9001 requires the risk register to be updated as part of the action. ISO 13485 requires action without undue delay and the verification that the fix has not compromised regulatory compliance or device safety. ISO 14001:2026 scales action to environmental significance and carries the compliance obligation chain. ISO 45001 requires worker participation in evaluating the cause and a hierarchy-of-controls step at action selection. ISO 7101 requires the service user to be told. MSI's cross-standard guide to writing a corrective action procedure reads down that column in full, and the integrated ISO 9001 + ISO 14001 + ISO 45001 improvement procedure is what it looks like when three of them are carried in a single register.

That principle only survives contact with an auditor if the divergences are recorded rather than assumed. Where two standards genuinely ask for different things, the procedure has to name the point of divergence, state which requirement was followed, and record why — which is exactly what MSI's combined ISO 9001 + ISO 13485 corrective action procedure and the integrated ISO 9001 + ISO 13485 risk template carry as a standing appendix. When the auditor asks why one obligation was met and not the other, the answer is already written down instead of reconstructed in the room.

MSI's companion guides make the same point from the quality and environmental sides: continual improvement in ISO 9001 and continual improvement in ISO 14001 both stall at the same place — the corrective-action engine — and both are repaired by the same discipline. The quality improvement culture that makes any of it stick is built on the loop, not on the poster.

This is also the practical case for ISO consulting that spans standards rather than specializing in one. A consultant who only knows ISO 13485 will write you a device procedure. A consultant who knows the family will write you one procedure that carries every standard you hold and every standard you will add. For organizations running CAPA, document control, training, audit, and FMEA modules on a single platform, MSI's alliance with CAQ AG Factory Systems connects the procedure to the software that enforces it.

WHAT IS COMING

Why ISO 9001:2026 Matters to Corrective and Preventive Action

Culture. Reporting. Evidence.

ISO 13485 is not being revised on this cycle, so a device organization can be forgiven for tuning out the next edition of ISO 9001. That would be a mistake for anyone holding both certificates — which, in the device sector, is most people. The Final Draft International Standard ballot closed on July 9, 2026, and publication is now confirmed for September 16, 2026, with a transition period to follow. The technical content is frozen. This is no longer a date to watch for; it is a date to plan against.

Corrective action stays where it is, at Clause 10.2. What changes sits upstream of it, in leadership. The 2026 edition introduces an explicit quality culture obligation at Clause 5.1 — a requirement with no predecessor in the 2008 or 2015 editions. Top management is expected to promote and support a culture consistent with the quality policy, and to be able to show it.

Read that against Failure 5 above and the connection is immediate. A corrective and preventive action system only ever sees what people are willing to report. In an organization where raising a problem is treated as creating one, the intake list is complete on paper and empty in practice — complaints get logged, but the near-miss on the line, the operator's workaround, and the supplier drift nobody wants to escalate never enter the system at all. The register looks healthy. The failure rate does not move.

Where the new clause has teeth is in the evidence it will require, and the corrective and preventive action file is the most persuasive evidence available. Reporting volume from the floor rather than only from customers. Time from detection to intake. The proportion of records that originate internally rather than externally. The absence of retaliation in how findings are handled. An auditor looking for proof of quality culture will not accept a poster, and MSI's work on why quality systems drive retention covers the same organizational mechanics from the workforce side.

There is a practical sequencing point in the confirmed date. A procedure written now to the 2015 edition will need revisiting; one written now with the intake metrics already instrumented will not. The same logic applies on the environmental side, where ISO 14001:2026 published on April 15, 2026 and the transition deadline is already fixed at April 2029. Organizations carrying more than one certificate get one chance to make these edits together rather than three times over — MSI's guide to the combined ISO 9001 and ISO 14001 transition sequences it as a single project, and the ISO 2026 transition deadline breakdown does the arithmetic on both clocks.

BUILDING IT RIGHT

Building Corrective and Preventive Action That Holds Under Inspection

Evidence. Not intention.

Management Systems International (MSI) has spent 28 years building management systems in regulated environments where the evidence has to survive contact with an investigator. Across 80+ certifications supported, 200+ audits attended, and 600+ professionals trained, the corrective and preventive action pattern that holds is consistently the same one.

• Triage before you open. Not everything becomes a corrective and preventive action record. Define the threshold and defend it in the procedure.
• Name the root cause method per risk tier. Do not leave it to whoever is assigned.
• Define effectiveness evidence at the time you plan the action — not at the time you want to close.
• Build the internal audit capability to test your own system before a registrar does. MSI's ISO Internal Auditor Workshop and internal audit services both exist for that purpose.
• Review the log as leadership, quarterly — not annually at the management review, by which time the trend is history.
• Measure the intake, not only the output. Under the incoming ISO 9001 culture clause this stops being good practice and becomes evidence.

If you want a structured read on where your ISO 13485 system currently stands before committing to anything, MSI publishes a free ISO 13485 self-scoring readiness tool — a spreadsheet that scores each requirement for documentation and implementation separately and produces a readiness view by clause. Most teams complete a first pass in a day or two, on their own, at no cost. MSI does not charge organizations to tell them what they already suspect. The work worth paying for starts after that: a planning session to sequence the response, or a direct project to build the system.

Organizations building a device quality management system from scratch, or repairing one that is generating repeat findings, typically report that the corrective and preventive action procedure is the component that takes longest to get right and pays back fastest once it is. MSI's guidance on building a medical device quality management system, on what medical device startups get wrong about ISO 13485, and the plain-English overview of the standard itself all trace the same throughline.

FREQUENTLY ASKED

Corrective and Preventive Action Under ISO 13485: Common Questions

Asked. Answered. Audited.

What is the difference between correction, corrective action, and preventive action?

Which ISO 13485 clauses cover CAPA?

How long should a CAPA record stay open?

Does the FDA QMSR change how CAPA must be run?

Does ISO 9001:2026 change corrective action for a device company?

Can one CAPA procedure serve ISO 9001, ISO 13485, ISO 14001, and ISO 45001?

Is there a template for an ISO 13485 corrective action procedure?

What is the most common CAPA finding in a device audit?