CAPA Workflow: States, Transitions, and Approvals That Hold Up

The CAPA process describes the steps. The workflow describes how the system enforces them. The two are easy to confuse, especially in plants moving from a spreadsheet log to a managed CAPA system.

Why the workflow matters as much as the process

A documented CAPA process with no workflow enforcement degrades quickly. Steps get skipped under time pressure, dates slip without escalation, and the closure approver ends up being whoever clicked the button last. A workflow turns the process into a sequence the system itself enforces — and gives the auditor a state log to read.

CAPA states

A working CAPA workflow has 8 active states plus reopen:

1. Draft — record created, not yet submitted for screening.
2. Open — passed screening, owner assigned, dates set.
3. In Investigation — root cause analysis underway.
4. Plan Approved — corrective/preventive action plan signed off.
5. In Implementation — actions executing.
6. Verified — verification of implementation complete.
7. In Effectiveness — within the effectiveness verification window.
8. Closed — effectiveness verified, read-across documented, approvals captured.
9. Reopened — effectiveness check failed or related recurrence triggered re-investigation.

Transitions

Each transition requires specific evidence in the record and a named role to push the button. Examples:

• Draft → Open: screening complete, type set, severity assessed, owner named.
• Open → In Investigation: containment evidence attached (corrective CAPAs only).
• In Investigation → Plan Approved: RCA worksheet attached with occurrence and detection causes; action plan rows complete with owners and dates.
• Plan Approved → In Implementation: change-control packages (where required) submitted.
• In Implementation → Verified: all action evidence attached; independent verification signature recorded.
• Verified → In Effectiveness: effectiveness criteria visible (must have been written at the Plan Approved stage).
• In Effectiveness → Closed: effectiveness data attached, disposition recorded, read-across performed.

A transition that fails its evidence check should be blocked, not bypassed with a note. Bypass notes are the second-most-common audit finding after missing effectiveness checks.

Approval roles

• Screening — Quality Assurance lead.
• Plan approval — Quality Manager (and Regulatory if FDA-class CAPA).
• Verification of implementation — independent verifier (engineer or supervisor other than the action owner).
• Effectiveness sign-off — Quality Engineer with Quality Manager counter-sign.
• Closure — Quality Manager, with Quality Director sign-off for high-severity or regulatory-reportable CAPAs.

The action owner should never sign their own action verified or effective. The system should enforce this with role-based controls.

SLA timing

Default SLAs that map to most automotive, aerospace, and medical device customer expectations:

• Screening: 2 business days from intake.
• Containment: 24-48 hours from screening (corrective CAPAs).
• Root cause: 14 days from open.
• Plan approved: 30 days from open.
• Implementation: per plan, typically 30-60 days from approval.
• Verification: within 7 days of implementation complete.
• Effectiveness check: at 60-90 days, with the check itself completed within 14 days of the window closing.
• Closure: within 14 days of effectiveness verified.

SLAs are workflow-enforced — aging is calculated continuously, not at month-end. Records that stay in one state past SLA escalate automatically.

Escalation

• Level 1 — auto-email to owner at 75% of SLA.
• Level 2 — auto-email to owner's manager at 100% of SLA.
• Level 3 — appearance on the weekly Quality Management Review aging report at 125% of SLA.
• Level 4 — escalation to Quality Director at 150% of SLA, with mandatory written justification entered into the record.

System vs spreadsheet

Below ~50 CAPAs/year, a structured spreadsheet with discipline can work — but you give up automatic escalation, role-based control, and clean audit reports. Above 50/year, a CAPA module in an eQMS pays back quickly. The workflow described above maps cleanly onto every major eQMS; configuring the states and SLAs is straightforward once the process is defined.

If you stay on a spreadsheet, build the screening criteria, SLA enforcement, and approval signoff as separate columns and run a weekly aging review against them. The auditor will read them either way.

FAQ

What states should a CAPA workflow have?

Draft, Open, In Investigation, Plan Approved, In Implementation, Verified, In Effectiveness, Closed, and (optionally) Reopened.

Who approves a CAPA closure?

Typically the Quality Manager, with Quality Director sign-off for high-severity or FDA-reportable records. The action owner never signs their own closure.

What SLAs should the workflow enforce?

Containment 24-48 hours, root cause 14 days, plan 30 days, verification within 7 days of implementation, effectiveness at 60-90 days. Aging past SLA triggers automatic escalation.

Should CAPA workflow live in the eQMS or in a spreadsheet?

Below 50 CAPAs/year, a disciplined spreadsheet can work. Above that, an eQMS module is faster to maintain and easier to audit. Either way, the workflow states and SLAs are the same.