What Is Corrective Action (CAPA)

Two weeks after the walkthrough where you documented a nonconformity on the blocked emergency exit at the Damascus warehouse, you return to find the same scene: the east exit is blocked again — different pallets, a different shipment, the same problem.

The first time, you "handled" it: the pallets were removed and the file was closed. Today you're paying for conflating two concepts that ISO deliberately keeps distinct: Correction and Corrective Action. The first removes the visible symptom right now; the second removes the cause that produced it so it doesn't happen again. In the field you'll hear the abbreviation CAPA (Corrective and Preventive Action) used as the name for this whole file.

Correction puts out the fire; Corrective Action stops it from starting

Removing the pallets is a correction: necessary, immediate, and no substitute for what comes after. Wiping up spilled oil is a correction; fixing the leak that spilled it is a Corrective Action. The rule for telling them apart: if what you did only restores things to how they were before the incident, it's a correction; if it changes something in how the work is done so the incident can't recur, it's a Corrective Action.

The bridge between the two is a single question: why did this happen in the first place?

Root cause via the "Five Whys"

The simplest root cause analysis tool is the "Five Whys": ask why, follow every answer with another why, until you reach a cause within your control whose treatment breaks the chain of recurrence. Apply it to the exit:

1. Why was the exit blocked? Because the new shipment's pallets were placed in the east aisle.
2. Why were they placed in the aisle? Because the storage bays were full.
3. Why were they full? Because the shipment arrived before goods scheduled for dispatch had gone out.
4. Why was a shipment received with nowhere to put it? Because whoever confirms receiving appointments doesn't know available capacity at the moment of confirmation.
5. Why don't they know it? Because there's no procedure linking appointment confirmation to a capacity check.

The root cause, then, isn't "the warehouse keeper's negligence" — it's the absence of a procedure linking receiving to capacity. Notice where we stopped: at a cause we can actually change, whose treatment prevents recurrence. Had we stopped at the second why, we'd have treated the overcrowding by building a bigger warehouse — an expensive fix for a procedural problem.

From action to verification of effectiveness

Once the cause is diagnosed, the Corrective Action follows a defined path:

1. Design an action that treats the root cause itself: a new receiving procedure that requires a capacity check before confirming any appointment, plus an overflow zone marked on the floor, away from the aisles, to absorb the unexpected.
2. Assignment and a deadline: one owner for the action and a binding completion date — "everyone is responsible" in practice means no one is.
3. Documented execution: the approved version of the new procedure, and a record of training the receiving staff on it.
4. Verification of Effectiveness: after a sufficient period and with evidence — eight consecutive weekly inspection rounds with the exit clear, and three large shipments received without exceeding capacity. "We implemented the action" doesn't mean "the action worked"; effectiveness is proven by time and measurement, not by a signature.
5. Closure by an independent verifier: whoever implemented the action doesn't get to judge its success — this separation of duties is the very condition for a credible closure.

Before closing the file, ask the prevention question: where else could the same cause recur? The new receiving procedure isn't just for the east exit — roll it out across all the warehouse's gates and the second branch before their own inspections discover the problem the hard way. This is the "P" in CAPA: treating the cause where it hasn't surfaced yet.

Common mistakes

1. "Root cause: staff negligence — action: retraining." If the answer to every analysis you do is training, you're not analyzing. Good systems are designed so individual error is hard to make, not so the person who made it can be blamed.
2. Closing at implementation, not at verification. The file gets closed the day the new procedure is issued, and no one checks two months later whether it's actually working. This is where half of all corrective actions die.
3. A Corrective Action that's just a correction in disguise. "We'll monitor the aisle daily and remove any pallets" — this is monitoring the symptom, not treating the cause; it buys you faster detection of recurrence, not prevention of it.

In goiso

A nonconformity raised from an inspection flows into the Corrective Action board (CAPA board): one card per action, with an owner and a due date, moving through the columns up to the verification column. Separation of duties is built into the platform, not left to good intentions: the internal auditor role (internal_auditor) is the only one authorized to verify and close corrective actions — whoever implemented the action cannot vouch for themselves. Verification evidence (the approved procedure, the training record, inspection round results) is attached in its place; and if the evidence sits with a colleague, request it directly via "Request Evidence." See What Do I Do With a Nonconforming Item and How Do I Request Evidence From a Colleague.

Summary

• Correction removes the symptom now; Corrective Action changes how the work is done, preventing recurrence.
• The "Five Whys" lead you to a cause within your control — and it's rarely "someone's negligence."
• An action isn't closed at implementation, but once its effectiveness is proven with evidence and enough time.
• Whoever implements doesn't verify: separation of duties is the condition for a credible closure.

One question remains, opening the next lesson: this independent verifier who examines your work with a critic's eye — where do they come from, and how do they operate? They're the hero of Internal Audit.