CAPA Process for a small Software company - Ideas and recommendations wanted

M

Micked

#1
Hi fellow cove dwellers,

I am designing a light weight and efficient QMS for a *very* small SW company. Most CAPA threads seem to very HW oriented.
If you go by the book you would have different procedures, and possibly tools, for problem reports, customer complaints, CAPA, incident reporting etc.
This is simply out of the question for my client, they would never make it work in practice.

What I am thinking of is to use one tool for "issues" from many sources, from simple internal bugs to adverse event reporting.
The tool will have provisions, check boxes and information fields, that will support the different processes.
As an example, a prototype version has a checkbox: "Risk analysis needs to be updated" [Yes, No, Not checked (Default)] This way I want to force them to make active decisions.

The only thing I have to do is to write a SOP to guide them through the "issue" handling and prescribe what steps have to be taken for different classes of issues. The current prototype uses ["Simple bug", "Larger change that needs document changes", "Documentation change", "Adverse event"].

The C and P in CAPA would simply be decisions in the "issue" handling process.

Any thoughts on my approach?
 
Elsmar Forum Sponsor

Jen Kirley

Quality and Auditing Expert
Staff member
Admin
#2
Re: CAPA process for a small SW company

Hello,

I got hung up on the HW and SW. Can you elaborate please?
 
M

Micked

#3
Re: CAPA process for a small SW company

Hi,

I clearly see the point of a traditional CAPA process for mechanical and chemical products. There you would normally do some statistical trending, and then take appropriate action.
Let's take an example. If I get a lot of returns on ball bearings, I could start an investigation on lubrication, correct polishing of the bearing balls etc. From that you would infer if corrective and possibly preventive actions are needed.

If I deal with a pure SW product it is a bit different, at least to my simplistic mind.
"Returns" are usually bug reports in this case. To me it seems a bit over the top to analyze bugs for:
- Specification errors (preventive action is better training in writing specifications?)
- Coding errors (Corrective action is to fix the bug? Do I have to make a CAPA investigation for this? Preventive action is training in coding rules?)

And, in my case where there is one (!) programmer in the company, what is reasonable to do there?

That is why I want to create one simple to use and simple to understand system for everything from internal bug reports to customer complaints.

I think this is a question of general relevance, because there will be a lot of small SW companies trying to implement a QMS before March 21st 2010...
 
J

JaneB

#4
Re: CAPA process for a small SW company

Hello,

I got hung up on the HW and SW. Can you elaborate please?
HW = hardware (ie, the computers, printers, all the physical stuff)

SW = software (ie, the programs and instructions that turn the hardware into something far more useful than a very large paperweight)
 
J

JaneB

#5
Re: CAPA process for a small SW company

Micked,

I think it depends n whether the bug reports you're talking about are part of the normal process of developing software, or whether they're something that turns up after the product has been released/delivered.

The former don't require CA or PA - assuming you're using an iterative development process etc. The latter do.

If I deal with a pure SW product it is a bit different, at least to my simplistic mind.
"Returns" are usually bug reports in this case. To me it seems a bit over the top to analyze bugs for:
- Specification errors (preventive action is better training in writing specifications?)
- Coding errors (Corrective action is to fix the bug? Do I have to make a CAPA investigation for this? Preventive action is training in coding rules?)
Disagree. If you have delivered /sold software to a customer which you subsequently discover had errors in it, you absolutely need to figure out why and how those errors were in there, to prevent recurrence. And yes, if that means better spec writing or having some coding standards/rules, yes. WHy on earth not? What makes IT so 'special' that it shouldn't have to do this, whether you have 1 programmer or 50?

I think this is a question of general relevance, because there will be a lot of small SW companies trying to implement a QMS before March 21st 2010...
Why before then?
 
H

Hodgepodge

#6
Re: CAPA process for a small SW company

If I deal with a pure SW product it is a bit different, at least to my simplistic mind.
I don't see how it is different. The purpose of a CAPA program is to fix a problem and prevent its recurrence. A software company would want to do this the same as a hardware manufacturing company. The end result is customer satisfaction. An added benefit is the potential savings in time on future projects (and time equals money).

- Specification errors (preventive action is better training in writing specifications?)
- Coding errors (Corrective action is to fix the bug? Do I have to make a CAPA investigation for this? Preventive action is training in coding rules?)
It depends. Preventive action is a planning activity and can be used as input for training requirements. Corrective action should definitely fix the problem, but it can be much more. Though not every corrective action must be formally documented, if a company keeps having to fix the same problem, it hasn't addressed the root cause. This could lead to better training, safeguards, etc. I agree with Jane B. Every company can benefit from a good CAPA program and good training/instruction.

And, in my case where there is one (!) programmer in the company, what is reasonable to do there?

That is why I want to create one simple to use and simple to understand system for everything from internal bug reports to customer complaints.
I think your idea of keeping it simple is a great idea. If your customer actually uses this simple system AND they can find ways to improve, then it is a successful system. The smaller the operation, the more everyone has to do to make a successful CAPA program work. Perhaps instead of just participating in a meeting or discussion to determine root cause, those involved may have to enter data into the system or fill out paperwork themselves, keeping them from their normal, hopefully productive, duties. A simple program is imperative. It sounds like you are on the right track.
 
M

Micked

#7
JaneB and Hodgepodge,

Thanks for your feedback.
Nothing beats a little provocation to get the discussion going ;)

First a note on March 21st 2010. That's when the new European Medical Device Directive 2007/47/EG will apply. It now specifically defines standalone software products as medical devices, if they are used for diagnostic purposes. This has been a gray area so far. Just think about all the patient management and imaging systems out there...

I don't think programmers are exempt from quality activities, even if my first post sounded like it. My problem is to get the client do the minimum required activities, and make it consistently, instead of just being overwhelmed with a cumbersome process.

I guess most people in this forum have a background from mid-size to large corporations. Mine is from Siemens Medical, one of the largest electromedical manufacturers in the world. It was no problem to have two full-time engineers handle customer complaints at my workplace, as an example. This is simply not realistic for most small companies. That's why I am being a bit provocative to get a feeling for the minimum acceptable level.

How about two checkboxes: "Needs corrective action" and "Needs preventive action" in the issue handling tool?
The SOP would then prescribe the actions and follow-ups needed if checked.

I have so far described the process such that all actions and follow-ups shall be entered as comments in the tool. If a requirement has to be changed or added, then it should be referenced in the tool. Together with reference to verification, of course. If done this way, there should be a very small need to make printouts and sign them with ink. Currently I recommend to make printouts at opening a customer complaint, when a decision not to investigate is made and at closure of the complaint.
Any comments to this "hybrid approach" to electronic signatures?
 

jkuil

Quite Involved in Discussions
#8
I recently made a CAPA procedure for a mid-sized medical device company. I recognize the requirements for a simple CAPA system. We have managed this through the handling of 'simple' NCs at engineering level.

If at any time in the life cycle non-conforming SW is detected, the software should be corrected. Subsequently, the need for corrective actions (CAPA) is analysed. If the issue is simple, i.e. is straightforward and the corrective actions (if required) are obvious, actions can be determined, approved and implemented at engineering level. There is no requirement for detailed root cause analysis or risk analysis.
If the issue is complex or potentially a high risk for the software users is involved, the non-conformance handling requires approval at management level. These issues are thoroughly investigated: detailed root cause and risks analysis, in order to ensure effective corrective actions.

Non-conformances are trended and the trend analysis is reviewed by top management. Through this review (simple) NCs repeating at too high frequency are detected and the need for corrective actions is determined.
 
M

Micked

#9
That sounds like a good approach. I will simply put in a checkpoint in the issue handling process, "CAPA needed?".
 
Thread starter Similar threads Forum Replies Date
B Corrective and Preventive Action (CAPA) A Key Process of the Quality Management System Dec 17... Training - Internal, External, Online and Distance Learning 0
T QIP (Quality Improvement Process) for CAPA Process. Nonconformance and Corrective Action 5
K CAPA Training for Process Nonconformances Nonconformance and Corrective Action 2
L Proposal to Senior Management - Three options for our new CAPA process Quality Manager and Management Related Issues 2
Q CAPA - Process - Class III Medical Device Manufacturing Nonconformance and Corrective Action 7
Q Other observations During the CAPA process. 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 12
R Incorporating 8D into our CAPA process... Nonconformance and Corrective Action 6
B FDA requirement for CAPA Signoff ISO 13485:2016 - Medical Device Quality Management Systems 6
F NCMRs and its relation to CAPA Nonconformance and Corrective Action 7
C Projects in the CAPA system Preventive Action and Continuous Improvement 6
S EU MDR CAPA - GAP Assessment on CAPA SOPs EU Medical Device Regulations 1
R Non conformance (NC) or Corrective & Preventive action (CAPA) CE Marking (Conformité Européene) / CB Scheme 7
C ISO 13485 :2016 - CAPA - Does every CAPA need to be checked by regulations? ISO 13485:2016 - Medical Device Quality Management Systems 9
B Do you use paper or web-based templates for CAPA processes? ISO 13485:2016 - Medical Device Quality Management Systems 3
G Any good examples of CAPA forms that include a risk based approach? ISO 13485:2016 - Medical Device Quality Management Systems 8
B CAPA - Extensions vs Overdue Nonconformance and Corrective Action 11
G New CAPA Work Flow with Revised 8D Approach Process Maps, Process Mapping and Turtle Diagrams 35
Y Blank Fields on CAPA Form Document Control Systems, Procedures, Forms and Templates 21
V CAPA effectiveness check Nonconformance and Corrective Action 3
Ed Panek CAPA against Notified Body? EU Medical Device Regulations 5
CPhelan Nonconformance opened as incorrect expiration date placed on received product. Escalate to CAPA? Nonconformance and Corrective Action 4
N How to monitor the effectiveness of the CAPA system ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 8
G Differences - Nonconformances vs CAPA, Corrections vs Corrective Actions ISO 13485:2016 - Medical Device Quality Management Systems 16
Q Raising A CAPA on Current CAPA system US Food and Drug Administration (FDA) 3
Z Security for Approvals - Cloud based Complaint, NC, and CAPA systems Qualification and Validation (including 21 CFR Part 11) 8
S FDA requirements and CAPA's Qualification and Validation (including 21 CFR Part 11) 2
J MDR reporting and CAPA thoughts? Classifying Complaints on Risk 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 13
P Documentation for correction, corrective action, mini CAPA Nonconformance and Corrective Action 9
P Quality objectives - must they include CAPA and internal audit topic? ISO 13485:2016 - Medical Device Quality Management Systems 28
A Can change control can be closed if the CAPA is still open? Nonconformance and Corrective Action 3
Don Fardie CAPA vs. Risk Assessment - Changing a product material for better performance ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 2
A NCR, NCMR, CAPA, Deviations - Medical Device Distributor Nonconformance and Corrective Action 2
S CAPA Investigation Methods Nonconformance and Corrective Action 3
qualprod Should I initiate CAPA for a nonconformance not recorded? Nonconformance and Corrective Action 25
R CAPA Verification - ISO 13485:2016 Requirements and Objective Evidence ISO 13485:2016 - Medical Device Quality Management Systems 2
J CAPA and other Log Requirements ISO 13485:2016 - Medical Device Quality Management Systems 8
D Any Elsmar members using Traqpath to manage CAPA? Nonconformance and Corrective Action 2
D CAPA - Suggested Action vs Action Plan Nonconformance and Corrective Action 5
A Audit Finding - CAPA, Improvement Initiatives not filed in CAR System ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 5
Moncia Complaint / Non-Conforming Product / CAPA Procedures - Please share your experience ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 3
M Issue with CAPA system - Should Over Due CAs warrant a CAPA? Nonconformance and Corrective Action 17
K CAPA (Corrective and Preventive Action) - ISO 13485 Nonconformance and Corrective Action 1
M CAPA due to Consumer not following Maintenance Instructions... Nonconformance and Corrective Action 9
A Escalation to CAPA - Assessing if an NC warrants a CAPA Nonconformance and Corrective Action 4
P Trending CAPA's in our Management Review Meetings ISO 13485:2016 - Medical Device Quality Management Systems 1
J Software and Methods for Tracking CAPA (Corrective and Preventive Action) items US Food and Drug Administration (FDA) 3
Q Customer Complaint Vs. Nonconformance - CAPA SYSTEM Customer Complaints 2
P How CAPA's are trended in Management Review Nonconformance and Corrective Action 1
P Sample FDA compliant CAPA procedure wanted Document Control Systems, Procedures, Forms and Templates 2
Q Effectiveness Plan for CAPA initiated from External Audit US Food and Drug Administration (FDA) 3

Similar threads

Top Bottom