Corrective Action vs Preventive Action: Definitions, Triggers, Examples

Corrective action and preventive action are the two halves of CAPA. They share a structure but not a trigger, and conflating them is the single most common source of confusion when teams first build out their CAPA system. See the broader corrective action and CAPA guides for context.

Definitions

Corrective action is the response to a confirmed nonconformance. The problem has happened. The corrective action eliminates the cause so it cannot recur.

Preventive action is the response to a potential nonconformance. The problem has not happened, but has been identified as a credible risk through trending, FMEA, internal audit, near-miss analysis, or lessons learned from a similar part or sister plant. The preventive action eliminates the cause before the problem occurs.

The distinction is timing relative to the failure, not the strength of the fix. A well-executed corrective action and a well-executed preventive action look identical once implemented — what differs is the evidence that triggered each.

Triggers

The simplest test: if you can point to the specific defect, complaint, NCR, or audit finding that opened the record, it is corrective. If you are acting on a trend, a near miss, a risk assessment, an FMEA score, a management review observation, or a lesson learned from elsewhere, it is preventive.

• Corrective triggers — NCR, customer complaint, field return, SCAR, internal/external audit finding, process monitoring alarm.
• Preventive triggers — PFMEA RPN above threshold, scorecard trend (e.g. PPM drifting up without a single triggering event), near-miss report, sister-plant CAPA shared through lessons learned, supplier risk assessment, management review action.

Manufacturing examples

Corrective

Three OEM returns in one week for loose fasteners on a chassis cross-member. CAR opened, 8D executed, hard interlock added between part scan and DC tool program (full example walked through in corrective action examples).

Preventive

After implementing the torque interlock above, the supplier quality team reviewed all torque applications across the plant via PFMEA. Three additional lines used similar DC tools without interlocks. PFMEA RPN was recalculated and exceeded the action threshold. A preventive action was opened to add interlocks across the remaining lines on a phased schedule — no defect had occurred on those lines, but the conditions were the same.

Lessons-learned preventive

A sister plant closed a CAPA on label-master cache corruption. The lessons-learned record was shared cross-plant. The receiving plant opened a preventive action and added the same cache invalidation rule even though the issue had not occurred locally.

ISO 9001:2015 — risk-based thinking

ISO 9001:2015 removed the standalone preventive action clause. The activity is still required — it moved into clause 6.1, "Actions to address risks and opportunities." In practice that means risk assessments, FMEAs, and management-review-driven actions take the place of formal PA records. IATF 16949 and AS9100 build on top of ISO 9001 and follow the same model.

The practical effect: a clean ISO 9001:2015 CAPA system often does not have a separate "PA log" — preventive activity lives in the risk register, the FMEA, and the management review minutes. Auditors are looking for evidence that risk-based thinking is happening, not for a specific record format.

FDA 21 CFR 820.100 — both still required

FDA 21 CFR 820.100 continues to require both corrective and preventive action as distinct elements of the CAPA system. Medical device manufacturers therefore typically run a combined CAPA log with explicit type (Corrective / Preventive) on every record. ISO 13485:2016 aligns with this approach.

For a medical device organization, the CAPA log usually carries a higher proportion of preventive entries than a typical automotive plant — trend analysis, complaint trending, and post-market surveillance regularly trigger preventive records.

Shared workflow

Once opened, both follow the same path: problem or risk statement, cause analysis, action plan, implementation, verification, effectiveness check, closure. The corrective action plan template works for preventive records with the trigger and the "potential nonconformance" framing swapped in.

FAQ

What is the difference between corrective and preventive action?

Corrective action eliminates the cause of a problem that has already occurred. Preventive action eliminates the cause of a problem that has not yet occurred but has been identified as a risk through trending, FMEA, audit, or lessons learned.

Did ISO 9001:2015 remove preventive action?

It removed the standalone clause and folded the activity into risk-based thinking under clause 6.1. The work is still required — the explicit "PA record" format is not.

Does FDA still require preventive action?

Yes. FDA 21 CFR 820.100 continues to require both as separate CAPA elements. ISO 13485:2016 aligns with the FDA approach.

Can a CAPA be both corrective and preventive?

It can have both elements — for example, a corrective action triggered by an NCR plus a preventive read-across to similar parts. In the CAPA log, typically the primary type is set to the trigger (corrective) and the read-across actions are tracked as linked preventive items.