Root Cause and Corrective Action for CAPA's lacking validation/verification

[Ronen E]

Is that the Practical Field Guide for ISO 13485:2016 by Myhrberg and Raciti?

No, it's a guidance issued by ISO itself, a companion to the standard.

 

[mrsrobinson1110]

No, it's a guidance issued by ISO itself, a companion to the standard.

View attachment 29002

Gotcha.....thanks, I think that will help a lot!

 

[Enternationalist]

Are you asking about how to write a CAPA for your mismanaged CAPAs? If yes, it's pretty simple. Why did this happen? The root cause is likely either your procedure is poorly constructed or your staff are not sufficiently competent - or both. How do you prevent this in future? You decide. Then, you check the fix is effective by showing that new CAPAs handle things properly - if you don't trust your internals to verify this, you can have a third party audit it again.

 

[cosmeticqg]

I had a similar finding in the past with processes-related CAPA. We had to update our CAPA process to require all corrective actions to be verified and/or validated prior to implementation. If V&V was not applicable, we provided a justification for not conducting V&V.
As a result of this finding, all process changes resulting from CAPA required a proper validation with stakeholders and systems. It was super helpful is educating process owners and impacted stakeholders!

 

[John Predmore]

ensure that such action is effective and does not adversely affect the finished device

(quoting the audit finding, emphasis added)

One angle I did not see anyone else mention, a focus that the MD industry does better than I see in other industries, is ensure that a correction does not "adversely affect" the product or production process or any other aspect of your operations, in an unplanned or unexpected way. In addition to the excellent advice you received from others at the Cove, I encourage you to include a statement in your CAPA that no adverse consequences or unacceptable risks arising from the correction or corrective action were found upon effectiveness review. And then make sure your effectiveness review includes checking for unintended consequences. You may want to update your risk management documents to reflect your assessment of risk, post corrective action. That documentation would be one more way to show an auditor that effectiveness was validated.

 

[Bev D]

Even basic ISO standards require that both Corrective Actions be assessed for effectiveness and that changes to materials, product related processes and product ’design’ be assessed to ensure that no adverse consequences occur. These changes can be for many reasons including from a corrective action.

While the medical device industry has placed a lot of emphasis on this recently and it is true that some companies are lax or even resistant in this area I can personally vouch for the fact that many companies and industries do both of these things. My most recent company was extremely rigorous about it - I made sure of it as did other leadership. Most aerospace companies were obsessive about it for good reason. I know from personal experience. And this makes the Boeing 77 max software problem so disheartening…but saying that one industry is better than another is simply not helpful - or true. All companies strengthen and weaken in cycles. As do industries…

I would also say that we shouldn’t do these things to satisfy an auditor but to protect ourselves and our Customers.

One more thing: can we please please please stop using the phrase CAPA?

 

[Enternationalist]

One more thing: can we please please please stop using the phrase CAPA?

I'm up for that. Even though the processes are superficially similar, they're fundamentally different tasks. Grouping them casually usually hamstrings one or the other, and usually that's at the price of good preventive actions.

 

[Ronen E]

all corrective actions to be verified and/or validated prior to implementation.

What does the "and/or" mean here?... "Verified" and "validated" entail different activities (not to mention different mindsets), for fulfilling different types of goals. Besides, I can speculate what "verifying a corrective action" means (it can actually mean more than one thing in particular, as I tried to explain earlier); but for the love of [...] I can't make sense of "validating a corrective action". That would imply you're thinking of repeatedly applying that same corrective action!... While the whole point of a corrective action it to prevent recurrence, hence requiring it to only be taken once. Sure, sometimes corrective actions fail, but in that case you'd probably want to try a different corrective action, not the same one again and again (assuming you verified the action, so you know what was done was in fact what you intended done).

If V&V was not applicable, we provided a justification for not conducting V&V.

V&V of what?...
Additionally, I wouldn't use "V&V" that casually because N/Aity would be completely separate (and probably based on different reasons) for each of the Vs. Actually, personally I wouldn't use "V&V" at all! It's a bad, masking term that promotes confusion and ill practice (with maybe a single exception in the case of pure SW).

As a result of this finding, all process changes resulting from CAPA required a proper validation with stakeholders and systems.

"Stakeholders and systems" is very general, so it's hard to tell whether you were referring to design validation or to process validation; either way this is a separate topic from verifying root cause identification, corrective action implementation or corrective action effectiveness (either perceived root cause elimination or non-recurrence of NC). Design and process validation (as necessary) after process changes are in mainstream Design Control domain more than in CAPA management domain (though of course these 2 domains are not completely mutually exclusive).

 

[Ronen E]

include a statement in your CAPA that no adverse consequences or unacceptable risks arising from the correction or corrective action were found upon effectiveness review. And then make sure your effectiveness review includes checking for unintended consequences.

While I certainly agree that the "no adverse consequences" check/analysis should be proactively taken and documented, I don't see a reason to bundle it with the "effectiveness review" of the corrective action. In my view these are 2 separate aspects. The purpose of an effectiveness review is to determine to what extent the (predefined) goal was achieved; in the case of corrective actions the goal should be to prevent recurrence, which in most cases would practically mean to eliminate the (perceived) root cause. Strictly speaking, the (direct) goal of a corrective action is NOT to maintain the overall suitability of the product design or of its realisation process. Of course the latter is highly desirable, but checking/verifying it should stay separate from the corrective action effectiveness review - to promote focus and clarity.

You may want to update your risk management documents to reflect your assessment of risk, post corrective action. That documentation would be one more way to show an auditor that effectiveness was validated.

This is a better approach IMO - the "no adverse consequences" check/analysis should be a part of the post-action RMF review/update that should be taken after ANY non-negligible change. It'd certainly be helpful to show it to an auditor as evidence for good controls in action (as intended/prescribed), but has little to do - IMO - with showing that CA effectiveness was verified (not validated).

 

[BradM]

Note:
The great discussion regarding Preventive Action was split to this thread:
Are we spending enough time and resources on effective Preventive Actions?

Please continue discussion there. Thanks!!