Corrective vs. preventive action
Corrective action responds to an event that has already happened: a nonconformance, complaint, or deviation. Preventive action acts on a risk before it materializes — usually surfaced through trending, FMEA, internal audit, or management review. A mature CAPA system uses both, and tracks them in the same workflow with clear differentiation.
The CAPA lifecycle
A defensible CAPA record includes problem definition, risk assessment, containment, root cause analysis with evidence, a corrective action plan, implementation, verification of implementation, and an effectiveness check at a defined interval. Closure without an effectiveness check is the most common audit finding against CAPA.
Regulatory context
CAPA requirements appear across ISO 9001, IATF 16949, AS9100, ISO 13485, FDA 21 CFR 820 (Quality System Regulation), and FSMA. The fundamentals are the same; the documentation depth and effectiveness-verification rigor scale with regulation.