Issue Tracking and CAPA (Corrective and Preventive Action) Management

paul van oppen

I would appreciate your comments and suggestions on the following topic: we have a robust CAPA system in place (we are a medical device company) and we use a rigorous issue assessment process that rates issues for severity and occurrence (modelled after ISO14971). This assessment then assigns a risk rating to the issue, which in its turn drives the CAPA process. All good so far.

As in any organisation there are many issues that continuously occur, most of which would never make it to the level of a CAPA, even if rated. In fact, most issues do not get rated and are handled by the professionals in who's area the issue occurs.
And this is the concern: once a decision has been taken that an issue is important enough the formal process kicks in, but what about all those cases where we make informal decisions not to initiate the CAPA assessment process?

In other words, I am considering if there would be a need to have an issue tracking system that would log a larger volume of issues and require a quick assessment to:
1) further assess the issue for CAPA
2) not assess the issue for CAPA and allow a local correction of the issue
In case of no CAPA assessment, a justification would be required.

The advantages of tracking issues would be, amongst others:
- better visibility of non-conformances within the organisation (in addition to e.g. existing MRB and concession systems)
- having a recorded justification to NOT start a CAPA for a larger amount of issues.
The main disadvantages are increased complexity and the resource claims that such a system would bring with it.

I would like to get feedback from those of you in either medical device or pharmaceutical industry who has gone through similar evaluations and learn from you.


Jim Ivey

Grand Avenue Software

Hopefully others will chime in with feedback. However, I can at least provide one positive datapoint... in our quality system software we implemented an independent "issue management" process similar to what you described. Issues of all types are fed in through there, and triaged to different processes (complaint handling, CAPA, etc.) In the case where an issue is addressed locally rather than by one of those downstream processes, the user is required to provide a justification.

We also use the software internally for our own quality system, and employ that practice effectively. All customer interaction is fed in through the issue management process. Feature requests become CAPAs, potential defects become complaints (which may also result in CAPAs), and so on. However, we also keep track of questions that customers ask (e.g. "How do I establish a periodic review schedule for specific documents?") as issues, even when they're resolved immediately by answering the question via email or phone. Then later we can easily review/trend issues and see if there are areas that do warrant a CAPA from a usability perspective (e.g. "Looks like we've had seven customers in the past month with questions about periodic document review, let's initiate a CAPA to investigate ways we can reduce or eliminate confusion").

The approach has worked well for us internally. It allows us to easily capture all customer interaction, focus on the immediate problems, and not lose track of opportunities that might surface in an analysis of the remaining issues.

From what we've seen across our customer base this type of approach is becoming much more common in the medical device industry (where previously issues were almost always identified and handled locally). Hopefully others will contribute more direct experience.

Good luck,

Jim Ivey
Last edited by a moderator:

Bev D

Heretical Statistician
Super Moderator
what you must do is dependent on your customer requriements and industry requirements...

that said what we do is track 'issues' in several different databases but in similar ways.

For product nonconformances that cannot be handled via standardized rework procedures, we issue an NCR (Non conforming material report). The great majority of NCR events are corrected and documented on the NCR report without a Corrective Action. However, we track the number and type of NCRs and may issue a corrective action if a systemic cause is detected, a high repeat occurence rate or if a specific NCR has a severe effect.

For nonconforming product that can be reworked with standard rework processes, we record each failure and track the failure rates (using SPC). We issue corrective actions for the top 3 occuring failures by effect on the organization (cost or cycle time)

For field failures, we track both customer calls and service events (some field problems can be resolved via the phone and do not require a service event). Again we track using SPC, issue corrective actions on the top pareto items AND because they are field problmes we also issue corrective actions when a failure mode exceeds an SPC signal that the rate has increased. The only exception to this is for low severity failures and we set an upper threshold limit instead of an SPC limit for these...

This way we know what our problems are and we attack them in an organized prioritized fashion...


Quite Involved in Discussions
Indeed you need to record and analyse your product non-conformances, but also process non-conformances identified.

In the non-conformity handling you need to assess the need for CAPA. If the observed risk is equal or less than the risk identified in your product risk management report you do not need to issue a CAPA. This means that the harm was identified and the frequency of occurance in the last specified period (e.g. year, 20 batches) is equal or less than the frequency in the risk management report. For any new risk, which was not identified previously, you need to determine the risk and evaluate whether is acceptable or not (according ISO 14971). If not, a CAPA is required. Obviously, you need to update your risk management report to add the new risk.

Commonly, compagnies only raise a formal CAPA when the handling of the non-conformance requires management oversight, e.g. when it involves distributed products, the non-conformance is critical to the business, additional resources are required to execute the actions. Straightforward non-conformities that can be fixed easily at operating level are handled within the NCR.
I consider this practice only acceptable when the actions required for non-confomances not raised to a formal CAPA are still tracked until closure at operational management level, e.g. by NCR tracking. Performance data of NCR occurance and NCR handling must be communicated to senior management, e.g. through Management Review. This provides senior management the opportunity to initiate preventive actions at their descretion.

Jen Kirley

Quality and Auditing Expert
My organization's Environmental Engineer and I worked out an internal nonconformance tracking process and log that he uses to record, track and look for patterns independent of the Internal Audit process. I have attached the Tracking Log in the PA, CA and Risk-Based Decision Making - Need Input thread.

I have read-only access to this log on an ongoing basis, and use it to plan audits, as well as look for issues that have something in common with the quality, safety and Process Safety Management systems so as to identify areas of opportunity beyond the process.

In this way, issues don't get forgotten as soon as they are resolved. If the Environmental Engineer finds repeats, he can ask for a resolution from the next management level up from the last time, and press for a more systemic solution.

I don't know if this would help you and I do not work in medical devices - thought I'd offer just in case.

paul van oppen

Thanks for all your valuable feedback!

I see that most of you have a more elaborate issue tracking system in place that is preceding the CAPA process. I am concerned about the impact on the resource that is required to actually log, review and arrive at a disposition about the issues. I would appreciate your further comments and sharing about this aspect of issue management.




I consult to the FDA regulated industries (Pharma, bio, device, API) and capturing, analyzing/investigating (as required), tracking, trending, corrective and preventive actions are a must. It is one of the highest 'problems' in the industry, just take a look at the warning letters on the FDA web site. There are many challenges to a successful system, including identifying observations, reporting them, time lines, incorrect metrics etc. The one thing that is absolute key to success is total executive management support. They or for medical devices the Management Representative are the ones named in the warning letters. I know from first hand knowledge of running workshops, performing investigations, running a CAPA system, reporting metrics etc that it's not easy but it is possible !!!!! thanks
Thread starter Similar threads Forum Replies Date
I SaMD Software bug and issue tracking. Manufacturing and Related Processes 3
G Ergonomic issue caused by supplier material ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 2
S Supply Issue Supplier Quality Assurance and other Supplier Issues 4
bzachary1968 Issue Log / Tracker with dashboard. Document Control Systems, Procedures, Forms and Templates 2
S PPAP- (When to issue ECN,ECR & PCN ,PCR) APQP and PPAP 2
S ISO9001 Major for repeat issue. ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 24
O Issue with free sales certificate for implants from China China Medical Device Regulations 1
L Unique Supplier Control Issue AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 0
S Reliability issue - Frequent component failure of the product Reliability Analysis - Predictions, Testing and Standards 2
S Issue No. & Revision No. Document Control Systems, Procedures, Forms and Templates 4
Ch00Ch00 Evaluate a process - Issue number Lean in Manufacturing and Service Industries 7
M MSA angle issue - Nylon parts using Aberlink 3D Gage R&R (GR&R) and MSA (Measurement Systems Analysis) 0
P MedWatch Report from a hospital due to a quality issue US Food and Drug Administration (FDA) 5
Marc Media Gallery Issue? Elsmar Cove Forum Suggestions, Complaints, Problems and Bug Reports 1
M "Issue & continuous improvement" columns in AIAG-VDA PFMEA form FMEA and Control Plans 4
R Do we need issue ECN (Engineering Change Notice) towards updated Material Specification? Design and Development of Products and Processes 2
R Problem solving activity - Three hours to fix the issue Manufacturing and Related Processes 15
I Reissuing documents due to missing version / issue numbers Document Control Systems, Procedures, Forms and Templates 3
Marc Fuel tank issue (FOD) hits Boeing’s 737 MAX - Feb 2020 World News 19
F Struggling with a root cause analysis - Customer Returns - Escape issue Problem Solving, Root Cause Fault and Failure Analysis 15
Ron Rompen 2D matrix issue - Parts (machined steel) returned from the customer Design and Development of Products and Processes 0
G PolyWorks Alignment Issue - How to align the part General Measurement Device and Calibration Topics 1
M Accredited Calibration Sevice Provider using computerized system to issue calibration certificate Qualification and Validation (including 21 CFR Part 11) 3
M Accredited Calibration Sevice Provider using computerized system to issue calibration certificate General Measurement Device and Calibration Topics 2
A External Auditor issue with Internal Audits Internal Auditing 7
V Every good documentation practice observation is an data integrity issue US Food and Drug Administration (FDA) 7
V What is the criteria to cite an good documentation practices observation as an data integrity related issue US Food and Drug Administration (FDA) 6
A Domain of the component (EASA CM No.: CM-SWCEH-001 Issue 01 Revision 02) Point 9.3.3 (Usage domain aspects) EASA and JAA Aviation Standards and Requirements 0
B How to reply NCR on ineffectiveness of corrective action during IATF external audit? This is repeated issue whereby some mistake was done. IATF 16949 - Automotive Quality Systems Standard 7
J Control of nonconforming product issue (AS91000) AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 7
C TL-9000 Certifying Body Issue - Auditor failed to find an issue for 10 years TL 9000 Telecommunications Standard and QuEST 16
E Determining what is good and what is bad can be subjective - when is it a quality issue? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 9
Ed Panek Sensitive Supplier Issue - Single source supplier ISO 13485:2016 - Medical Device Quality Management Systems 6
B NB won't issue CE Certificate or return phone calls CE Marking (Conformité Européene) / CB Scheme 3
A Drawing Issue with Supplier - xb file did not match that of the pdf drawing Nonconformance and Corrective Action 4
J MAG 6 and EASA Part-145 Issue 005. EASA and JAA Aviation Standards and Requirements 0
A ISO/IEC 27001 - Issue during implementation of system IEC 27001 - Information Security Management Systems (ISMS) 3
M Saturated salts issue - Humidity Chamber General Measurement Device and Calibration Topics 5
N Do I need to approach galvanized steel sheet flatness issue with DOE? Problem Solving, Root Cause Fault and Failure Analysis 9
Sidney Vianna ASQ apparently doesn't know ISO does not issue ISO 9001 certificates? ASQ, ANAB, UKAS, IAF, IRCA, Exemplar Global and Related Organizations 4
D Can an AS9100 auditor issue an NCR a month after the audit? AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 6
K Class II Medical Device Compatibility Issue - Removal or Market withdrawal? US Food and Drug Administration (FDA) 2
J Can you stock parts without an 8130 and issue one at time of sale? Federal Aviation Administration (FAA) Standards and Requirements 2
R How many Corrective Action Request can be Issued by DCMA for a single issue? Nonconformance and Corrective Action 2
K NCR or CA? We're taking any issue we have and saying its a nonconformance Nonconformance and Corrective Action 11
R DCMA QAR Service Issue - Resident Inspectors absent from the plant AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 4
R Wet Signature Document Attachments in SAP - Risk on Data Integrity issue? Records and Data - Quality, Legal and Other Evidence 6
Mikishots Definition Issue - "Issue" vs. "Risk" in ISO 9001:2015 and AS9100 Rev D (Definitions) Definitions, Acronyms, Abbreviations and Interpretations Listed Alphabetically 2
F Power Cord Length Issue - Medical Device Electrical Safety IEC 60601 - Medical Electrical Equipment Safety Standards Series 2
D Breach of Contract from Registrar (Auditor Payment Issue) Registrars and Notified Bodies 18

Similar threads

Top Bottom