Corrective Action Plan: How to Write One That Holds Up to Audit

A corrective action plan (CAP) is the bridge between root cause and closure. It is where the findings from the investigation become real changes on the floor — specific actions, with names attached, dates attached, and evidence defined up front. Without a plan, a CAPA is a memo. With a weak plan, it is a memo that wastes a follow-up audit cycle. See the full corrective action process for where the plan sits in the loop.

What a corrective action plan actually is

A CAP is the section of the corrective action record that lists the actions you will take to remove the root cause, prevent recurrence, and improve the detection system. It is distinct from the containment (which addresses the immediate exposure) and distinct from the root cause analysis (which identifies why the problem occurred). The plan is the "what we will do about it" section.

Every standard that requires corrective action — ISO 9001 clause 10.2, IATF 16949, AS9100, ISO 13485, FDA 21 CFR 820.100 — expects to see specific actions tied to root causes, with owners, dates, and evidence. The plan is what auditors trace through during a surveillance review.

Plan structure

Use a table. One row per action. The minimum columns are:

• Action number — for traceability when actions are split, combined, or rescheduled.
• Root cause link — which occurrence or detection cause this action addresses.
• Action description — specific enough that someone outside the team can execute it.
• Action type — process change, equipment change, control change, documentation update, training, or supplier change.
• Owner — a single named person, not a department.
• Target date — when the action will be complete, not when it will be reviewed.
• Evidence required — the specific artifact that proves completion (revised work instruction rev X, PFMEA dated Y, training record for operators A, B, C).
• Status — open, in progress, complete, verified.

Owners and due dates

Every action needs a single owner. "Quality" or "Engineering" is not an owner. If two people will do the work, one of them owns the action and the other is listed as support. Joint ownership is one of the most reliable predictors of a missed due date.

Due dates should be specific and realistic. Customers in the automotive industry typically expect a first response (containment plus interim corrective action) within 24 hours, a full root cause analysis within 14 days, and the corrective action plan within 30 days of the original complaint. Effectiveness checks are usually scheduled 60 to 90 days after implementation. AS9100 and ISO 13485 do not name specific durations, but customer-specific requirements (CSRs) often do.

Writing the actions

Actions should change something in the system. The hierarchy that auditors look for, from strongest to weakest:

1. Elimination or substitution — change the design or the material so the failure mode cannot occur.
2. Engineering controls / poka-yoke — change the equipment or fixture so the wrong action becomes physically or electronically impossible.
3. Process control change — change the parameters, sequence, or in-process monitoring.
4. Detection control change — change inspection method, frequency, or technology.
5. Administrative controls — updated work instruction, control plan, PFMEA.
6. Training — almost never sufficient on its own.

A plan made up entirely of training and administrative actions is the most common pattern customers reject. The expectation is that at least one action moves up the hierarchy — a poka-yoke, an in-line sensor, an interlock, a tool change, a fixture change. Without one, the plan reads as a request to the operator to be more careful, which the next variation will defeat.

Evidence and closure

Define the evidence when the action is written, not at the closure meeting. Acceptable evidence is specific: "Work Instruction WI-2034 revised to Rev D, dated 2026-04-15, including torque sequence diagram and re-issued to operators on training matrix line 12-14." Unacceptable evidence is generic: "Procedure updated."

Each action closes when the evidence is attached and someone other than the owner has verified it. That second signature is verification of implementation — the auditable confirmation that the action was actually done. It is separate from the effectiveness check that comes later.

Effectiveness criteria

Set the effectiveness criteria when the plan is written. Typical examples:

• Zero recurrence in the next 10,000 units produced.
• No customer complaints related to this failure mode in 90 days.
• Cpk above 1.67 on the affected characteristic over 30 consecutive production runs.
• Zero failed audits on the modified inspection point in the next quarterly audit.

Vague criteria like "monitor for recurrence" or "review at next management review" fail every audit. The criteria must be measurable and the data source must exist before the action closes.

Pitfalls to avoid

The plans that fail most often share a small number of patterns. The plan is overloaded with training and administrative actions and contains no engineering controls. The owner column lists departments rather than people. The due dates are all the same day, usually quarter-end. The evidence column says "see attached." The effectiveness check has no acceptance criteria, or the criteria are written months after the fact.

For the structure expanded into a usable form, see the corrective action template guide. For worked plans on real manufacturing issues, see corrective action examples. For the upstream document that triggers the plan, see the corrective action report guide.